Appendices with PVS source code and proofs for the document

Nova Micro-Hypervisor Verification B PVS Theory Sources

Contents for Appendix B

B.1 abstract_data.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
B.2 allocators.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
B.3 bits.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
B.4 challenge-linear.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
B.5 challenge-phymem.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
B.6 challenge-ptab-sync-master.pvs . . . . . . . . . . . . . . . . . . . . . . . 119
B.7 constants.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
B.8 conversions.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
B.9 cpp-examples.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
B.10 cpp-verification.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
B.11 datatype_model.pvs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
B.12 device_memory.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
B.13 everything.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
B.14 expressions.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
B.15 graph.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
B.16 hoare.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
B.17 linear_memory.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
B.18 memory.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
B.19 paging-data-models.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
B.20 paging-data.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
B.21 physical_memory.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
B.22 plain_memory.pvs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
B.23 plain_memory_rewrites.pvs. . . . . . . . . . . . . . . . . . . . . . . . . . 272
B.24 ptab-sync-master-defs.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . 288
B.25 ptab-sync-master.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
B.26 random_device.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
B.27 result.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
B.28 search-example.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
B.29 statement-rewrites.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
B.30 statements.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336
B.31 state-transformer.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
B.32 types.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
B.33 vfiasco-prelude.pvs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434

B PVS Theory Sources

B.1 abstract_data.pvs

Uninterpreted_Data: Theory

Begin

Importing IA32
Uninterpreted_data_type: Type =

[#

size : nat,
valid? : [list[Byte], Address −> bool]

#]

uninterpreted_data_type ? : PRED[Uninterpreted_data_type ] =
Lambda(uidt : Uninterpreted_data_type ) :
(Forall(l : list[Byte], a : Address) :
not length(l) = size(uidt) Implies
valid?(uidt)(l,a) = False)
% proof status:−)
u_data_type_length : Lemma
Forall(uidt : (uninterpreted_data_type ?), l : list[Byte], a : Address) :
valid?(uidt)(l,a) Implies length(l) = size(uidt)
End Uninterpreted_Data
Interpreted_Data[Data : Type] : Theory

Begin

IMPORTING Uninterpreted_Data, Address_Util, Bitlist_ops
Interpreted_data_type: Type =

[#

uidt : Uninterpreted_data_type , % Assumptions:
to_byte: [Data, Address −> list[Byte]], % to_byteis zero at unmodifiedbits
to_mask: [Data, Address −> list[Byte]], % to_maskis one at unmodifiedbits
from_byte: [list[Byte], Address −> lift[Data]]

#]

% Thus, new_value= (read & ~to_mask) | to_byte
% and from_bytemust be reasonableon &= to_maskvalues
% proof status:−)
% interpreted_data_type ?_TCC1: TCCObligation
interpreted_data_type ? : PRED[Interpreted_data_type ] =
Lambda(idt : Interpreted_data_type ) :
uninterpreted_data_type ?(idt‘uidt) AND
% resultof to_byteis valid(and has lengthsize)
(Forall(d : Data, a : Address) :
valid?(uidt(idt))(to_byte(idt)(d,a), a)) And

B.1 abstract_data.pvs

% from_bytefails on invalidstuff
(Forall(l : list[Byte], a : Address) :
valid?(uidt(idt))(l, a) IFF
up?(from_byte(idt)(l, a))) And
% from_byteis the left inverseof to_byte
% 1. from_bytedoes not fail on to_byteresults
% this follows from the previoustwo

%

% (Forall(d : Data, a : Address) :
% up?(from_byte(idt)(to_byte(idt)(d,a), a))) AND
% 2. the resultis the same
(Forall(d : Data, a : Address) :
down(from_byte(idt)(to_byte(idt)(d,a), a)) = d)
pod_data_type ? : PRED[Interpreted_data_type ] =
Lambda(idt : Interpreted_data_type ) :
interpreted_data_type ?(idt) AND
(Forall(l : list[Byte], a1, a2 : Address) :
valid?(uidt(idt))(l, a1) IFF valid?(uidt(idt))(l, a2)) And
size(uidt(idt)) > 0
% subtypejudgements
% the firsttwo are intuetivelyright, but are not accepted because
% of the subrecordstructure
% interpreted_data_is_uninterpreted_data : Judgement
% (interpreted_data_type ?) SUBTYPE_OF(uninterpreted_data_type ?)
% pod_id_uninterpreted_data : Judgement
% (pod_data_type ?) SUBTYPE_OF(uninterpreted_data_type ?)
% proof status:−)
pod_is_interpreted_data : Judgement
(pod_data_type ?) SUBTYPE_OF(interpreted_data_type ?)
% proof status:−)
pod_size: Lemma
Forall (dt : (pod_data_type ?)) : size(uidt(dt)) > 0
% Utilitypredicates
idt : Var (interpreted_data_type ?)
addr : Var Address
min : Var Memory_Address
max : Var Memory_Address
in_memory?(idt, addr, min, max) : bool =
in_memory(min, max)(addr) And in_memory(min, max)(addr + size(uidt(idt)))

B PVS Theory Sources

in_blessed_memory ?(idt, addr, (address_range: PRED[Address])) : bool =
subset?(address_block(addr, size(uidt(idt))), address_range)
% proof status:−)
data_type_length: Lemma Forall(l : list[Byte]) :
valid?(uidt(idt))(l,addr) Implies length(l) = size(uidt(idt))
% proof status:−)
length_to_byte: Lemma Forall(data : Data) :
length(to_byte(idt)(data, addr)) = size(uidt(idt))
% proof status:−)
valid_from_byte: Lemma Forall(l : list[Byte]) :
idt‘uidt‘valid?(l, addr) Implies up?(from_byte(idt)(l, addr))
% proof status:−)
valid_iff_from_byte : Lemma Forall(l : list[Byte]) :
idt‘uidt‘valid?(l, addr) <=> up?(from_byte(idt)(l, addr))
% proof status:−)
valid_to_byte: Lemma Forall(data : Data) :
idt‘uidt‘valid?(to_byte(idt)(data, addr), addr)
% proof status:−)
up_from_byte_to_byte : Lemma Forall(data : Data) :
up?(from_byte(idt)(to_byte(idt)(data, addr), addr))
% proof status:−)
from_byte_to_byte : Lemma Forall(data : Data) :
from_byte(idt)(to_byte(idt)(data, addr), addr) = up(data)
% proof status:−)
in_blessed_memory_subset : Lemma
Forall (address_range: PRED[Address]) :
in_blessed_memory ?(idt, addr, address_range) Implies
subset?(address_block(addr, size(uidt(idt))), address_range)
End Interpreted_Data

Interpreted_Data_Lift [Data1, Data2 : Type] : Theory

Begin

Importing Interpreted_Data
dt_lift(dt : Interpreted_data_type [Data1],
ext : [Data2 −> Data1],
inj : [Data1 −> Data2]) : Interpreted_data_type [Data2] =
(# uidt := uidt(dt),
to_byte:= Lambda (d2 : Data2, a : Address) : to_byte(dt)(ext(d2), a),
to_mask:= Lambda (d2 : Data2, a : Address) : to_mask(dt)(ext(d2), a),

B.2 allocators.pvs

from_byte:= Lambda (l : list[Byte], a : Address) :
Cases from_byte(dt)(l, a) Of
up(d1) : up(inj(d1)),
bottom : bottom

EndCases

#)

End Interpreted_Data_Lift

Abstract_Read_Write [State, Data : Type] : Theory

Begin

IMPORTING Memory_Change[State]
IMPORTING State_Transformer_Lift , Interpreted_Data
dt : Var (interpreted_data_type ?[Data]) % dt aka Data_type
addr : Var Address
s : Var State % s aka state
data : Var Data
pm : Var Memory_struct[State]
valid_in_mem (pm,dt)(addr)(s) : bool =
Cases memory_read_list (pm)(addr, size(uidt(dt)))(s) OF
OK(sn, bl) : dt‘uidt‘valid?(bl, addr)
Else true

EndCases

read_data(pm,dt)(addr) : [State −> ExprResult[State, Data]] =
(memory_read_list (pm)(addr, size(uidt(dt))) ##
Lambda(bl : list[Byte]) : ok_lift(from_byte(dt)(bl, addr)))
write_data(pm,dt)(addr, data) : [State −> ExprResult[State, Unit]] =
memory_write_list (pm)(addr, to_byte(dt)(data, addr))
% proof status:−)
read_data_valid_in_mem : Lemma
OK?(read_data(pm, dt)(addr)(s)) Implies valid_in_mem (pm, dt)(addr)(s)
End Abstract_Read_Write

B.2 allocators.pvs

Allocator[State : Type] : Theory
% Specificationof memoryallocatorsworkingon plainmemory,
% such as the stack allocatorand the one for globalvariables.

Begin

Importing Plain_Memory[State]
% The allocatorinterfaceconsistsof two real methodsand four
% logicalones.
% alloc allocatesmemory

% free frees memory

%

% memory_poolThe memoryfrom whichthe allocatorallocates. Thisshould
% be disjointfrom all other liveallocators.
% allocatedGivesthe set of addressesthat have been allocatedby this
% allocator. Used to get the disjointnessof correctly
% allocatedvariables.
% private_memReturnsthose memoryregionsthat must not be changed
% for this allocatorto work properly.
% freed_sizeReturnsthe size of the block that willbe freed by
% a free in the same state. Needed to requirea correct
% adjustmentof the allocatedpredicateduringfree.
% We excludethe possibilityto allocate0 Byteshere (this is
% permittedby manymalloclibraries). We furtherrequirethat free
% makes a visiblechange in the allocatedpredicate. Some malloc
% libraries(or was it the C++ standard?) do not guaranteethat freed
% memoryis reallyfreed. We onlyrequirethat the predicateis changed
% (and not that freed memorycan be allocatedagain), nevertheless, this
% excludesemptyfree functions(such as in conservativegarbage
% collectors).

%

% One wouldexpecta validpredicate, whichis turnedon by initand
% maintainedafterwards. Thisvalidpredicatewouldsomehow classify
% the set of states in whichthe allocatoris expectedto work.
% However, the real methodsalloc and free
% have alwaysthe possibilityto returnfatal. The validpredicatewould
% onlyclutterthe specification, thereforewe keep it implicit.
% The set of states in whichthe allocatoris expectedto work is
% givenby the states predicateof the involvedplainmemory.
Allocator : Type = [#
memory_pool: [(plain_memory?) −> [State −> PRED[Address]]],
allocated : [(plain_memory?) −> [State −> PRED[Address]]],
private_mem: [(plain_memory?) −> PRED[Address]],
freed_size: [(plain_memory?) −> [Address −> [State −> lift[posnat]]]],
% init: [(plain_memory?) −> [State −> ExprResult[State, Unit]]],
alloc: [(plain_memory?) −>
[posnat −> [State −> ExprResult[State, Address]]]],
free: [(plain_memory?) −> [Address −> [State −> ExprResult[State, Unit]]]]

#]

% proof status:−)
% null_address_TCC1: TCCObligation
% HT: Thisshouldbe NULLfor an arbitrarypointertype, coming from
% the pointersemantics
null_address: Memory_Address= Mem(0)
% Requiredpropertiesof allocators:

% − allocatedis a subset of the memorypool
% − Newlyallocatedmemoryis disjointand comes from the memorypool.
% − If allocateand free succeed the allocatedpredicateis adjusted
% accordingly, whilethe memorypool staysconstant.
% − Freesucceeds preciselywhen freed_sizedoes.
% − Readingmemoryand writingmemoryat non−privateaddresses
% does not change the allocatedpredicateand the memorypool
% proof status:−)
% allocator?_TCC1: TCCObligation
% proof status:−)
% allocator?_TCC2: TCCObligation
% proof status:−)
% allocator?_TCC3: TCCObligation
% proof status:−)
% allocator?_TCC4: TCCObligation
% proof status:−)
% allocator?_TCC5: TCCObligation
% proof status:−)
% allocator?_TCC6: TCCObligation
% proof status:−)
% allocator?_TCC7: TCCObligation
% proof status:−)
% allocator?_TCC8: TCCObligation
allocator?(pm : (plain_memory?)) : PRED[Allocator] = Lambda(ac : Allocator) :
% privatememoryis in plainmemory−− thereforethe
% allocatorwon’t change underread access
subset?(ac‘private_mem(pm), union(pm‘ro_addr, pm‘rw_addr))

And

Forall(s : State) : pm‘states(s) Implies
% allocatefrom the memorypool
subset?(ac‘allocated(pm)(s), ac‘memory_pool(pm)(s)) And
% alloc properties
(Forall(size : posnat) :
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
disjoint?(ac‘allocated(pm)(s),
address_block(data(ac‘alloc(pm)(size)(s)), size))

And

ac‘allocated(pm)(state(ac‘alloc(pm)(size)(s))) =
union(ac‘allocated(pm)(s),

address_block(data(ac‘alloc(pm)(size)(s)), size))

And

ac‘memory_pool(pm)(state(ac‘alloc(pm)(size)(s))) =
ac‘memory_pool(pm)(s))

And

% connectionof free <−−> freed_size
(Forall(addr : Address) :
OK?(ac‘free(pm)(addr)(s)) IFF up?(ac‘freed_size(pm)(addr)(s)))

And

% free properties
(Forall(addr : Address) :
OK?(ac‘free(pm)(addr)(s)) Implies
ac‘allocated(pm)(state(ac‘free(pm)(addr)(s))) =
difference(ac‘allocated(pm)(s),
address_block(addr, down(ac‘freed_size(pm)(addr)(s))))

And

ac‘memory_pool(pm)(state(ac‘free(pm)(addr)(s))) =
ac‘memory_pool(pm)(s))

And

% The privatememorycontainsthe state of the allocator. If
% it staysconstant, then the allocatoris unchanged.
(Forall(s2 : State) :
pm‘states(s2) And
stays_unchanged(pm)(s, s2, ac‘private_mem(pm))

Implies

ac‘memory_pool(pm)(s) = ac‘memory_pool(pm)(s2) And
ac‘allocated(pm)(s) = ac‘allocated(pm)(s2))

And

% next_stateinvariants
% (has_next_state(ac‘init(pm)(s)) Impliespm‘states(state(ac‘init(pm)(s))))
% And
(Forall(size : posnat) :
has_next_state (ac‘alloc(pm)(size)(s)) Implies
pm‘states(state(ac‘alloc(pm)(size)(s))))

And

(Forall(addr : Address) :
has_next_state (ac‘free(pm)(addr)(s)) Implies
pm‘states(state(ac‘free(pm)(addr)(s))))

And

% alloc and free onlychange privatememory, more precisely,
% onlywritableprivatememory
(Forall(size : posnat) :
OK?(ac‘alloc(pm)(size)(s)) And
NOT data(ac‘alloc(pm)(size)(s)) = null_address

Implies

only_changes(pm)(s, state(ac‘alloc(pm)(size)(s)),
ac‘private_mem(pm)))

B.2 allocators.pvs

And

(Forall(free_addr: Address) :
OK?(ac‘free(pm)(free_addr)(s)) Implies
only_changes(pm)(s, state(ac‘free(pm)(free_addr)(s)),
ac‘private_mem(pm)))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% privatememoryis insideplainmemory

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_subset_private_memory_plain_memory : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm))) :
subset?(ac‘private_mem(pm), union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
allocator_private_memory_in_plain_memory : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)), addr : Address) :
ac‘private_mem(pm)(addr) Implies
union(pm‘ro_addr, pm‘rw_addr)(addr)
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% allocatefrom the memorypool

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_subset_allocated_memory_pool : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)), s : State) :
pm‘states(s) Implies
subset?(ac‘allocated(pm)(s), ac‘memory_pool(pm)(s))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% alloc properties

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_alloc_disjoint: Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
disjoint?(ac‘allocated(pm)(s),

address_block(data(ac‘alloc(pm)(size)(s)), size))
% proof status:−)
% allocator_allocated_alloc_TCC1 : TCCObligation
% proof status:−)
allocator_allocated_alloc: Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
ac‘allocated(pm)(state(ac‘alloc(pm)(size)(s))) =
union(ac‘allocated(pm)(s),
address_block(data(ac‘alloc(pm)(size)(s)), size))
% proof status:−)
allocator_memory_pool_alloc : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
ac‘memory_pool(pm)(state(ac‘alloc(pm)(size)(s))) =
ac‘memory_pool(pm)(s)
% proof status:−)
allocator_subset_address_block_alloc_allocated : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, addr : Address, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
NOT data(ac‘alloc(pm)(size)(s)) = null_addressImplies
subset?(address_block(data(ac‘alloc(pm)(size)(s)), size),
ac‘allocated(pm)(state(ac‘alloc(pm)(size)(s))))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% connectionof free <−−> freed_size

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_free_freed_size : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) Implies
(OK?(ac‘free(pm)(addr)(s)) IFF up?(ac‘freed_size(pm)(addr)(s)))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

B.2 allocators.pvs

%

% free properties

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_allocated_free_TCC1 : TCCObligation
% proof status:−)
% allocator_allocated_free_TCC2 : TCCObligation
% proof status:−)
allocator_allocated_free: Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
OK?(ac‘free(pm)(addr)(s)) Implies
ac‘allocated(pm)(state(ac‘free(pm)(addr)(s))) =
difference(ac‘allocated(pm)(s),
address_block(addr, down(ac‘freed_size(pm)(addr)(s))))
% proof status:−)
allocator_memory_pool_free : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
OK?(ac‘free(pm)(addr)(s)) Implies
ac‘memory_pool(pm)(state(ac‘free(pm)(addr)(s))) =
ac‘memory_pool(pm)(s)
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% constantprivatememoryimpliesmemory_pooland allocatedare constant

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocator_const_private_memory_memory_pool : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)), s1, s2 : State) :
pm‘states(s1) And
pm‘states(s2) And
stays_unchanged(pm)(s1, s2, ac‘private_mem(pm))

Implies

ac‘memory_pool(pm)(s1) = ac‘memory_pool(pm)(s2)
% proof status:−)
allocator_const_private_memory_allocated : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)), s1, s2 : State) :
pm‘states(s1) And
pm‘states(s2) And
stays_unchanged(pm)(s1, s2, ac‘private_mem(pm))

B PVS Theory Sources

Implies

ac‘allocated(pm)(s1) = ac‘allocated(pm)(s2)
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% next_stateinvariants

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_next_state_alloc_TCC1 : TCCObligation
% proof status:−)
allocator_next_state_alloc : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
has_next_state (ac‘alloc(pm)(size)(s)) Implies
pm‘states(state(ac‘alloc(pm)(size)(s)))
% proof status:−)
% allocator_next_state_free_TCC1 : TCCObligation
% proof status:−)
allocator_next_state_free : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
has_next_state (ac‘free(pm)(addr)(s)) Implies
pm‘states(state(ac‘free(pm)(addr)(s)))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% alloc and free onlychange privatememory

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_only_changes_alloc_TCC1 : TCCObligation
% proof status:−)
allocator_only_changes_alloc : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
NOT data(ac‘alloc(pm)(size)(s)) = null_address

Implies

only_changes(pm)(s, state(ac‘alloc(pm)(size)(s)),
ac‘private_mem(pm))

% proof status:−)
% allocator_only_changes_free_TCC1 : TCCObligation
% proof status:−)
allocator_only_changes_free : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
free_addr: Address, s : State) :
pm‘states(s) And
OK?(ac‘free(pm)(free_addr)(s)) Implies
only_changes(pm)(s, state(ac‘free(pm)(free_addr)(s)),
ac‘private_mem(pm))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% memory_readinvariant

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_allocated_memory_read_TCC1 : TCCObligation
% proof status:−)
allocator_allocated_memory_read : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr) Implies
ac‘allocated(pm)(state(memory_read(pm‘mem)(addr)(s))) =
ac‘allocated(pm)(s)
% proof status:−)
allocator_memory_pool_memory_read : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, s : State) :
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr) Implies
ac‘memory_pool(pm)(state(memory_read(pm‘mem)(addr)(s))) =
ac‘memory_pool(pm)(s)
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% memory_writeinvariant

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocator_stays_unchanged_memory_write_private_mem_TCC1 : TCCObligation
% proof status:−)
% allocator_stays_unchanged_memory_write_private_mem_TCC2 : TCCObligation

% proof status:−)
allocator_stays_unchanged_memory_write_private_mem : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, byte : Byte, s : State) :
pm‘states(s) And
pm‘rw_addr(addr) And
Not ac‘private_mem(pm)(addr)

Implies

stays_unchanged(pm)(s, state(memory_write(pm‘mem)(addr, byte)(s)),
ac‘private_mem(pm))
% proof status:−)
allocator_allocated_memory_write : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, byte : Byte, s : State) :
pm‘states(s) And
pm‘rw_addr(addr) And
Not ac‘private_mem(pm)(addr) Implies
ac‘allocated(pm)(state(memory_write(pm‘mem)(addr, byte)(s))) =
ac‘allocated(pm)(s)
% proof status:−)
allocator_memory_pool_memory_write : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
addr : Address, byte : Byte, s : State) :
pm‘states(s) And
pm‘rw_addr(addr) And
Not ac‘private_mem(pm)(addr) Implies
ac‘memory_pool(pm)(state(memory_write(pm‘mem)(addr, byte)(s))) =
ac‘memory_pool(pm)(s)
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% more complexproperties

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% proof status:−)
allocator_subset_address_block_alloc_memory_pool : Lemma
Forall(pm : (plain_memory?), ac : (allocator?(pm)),
size : posnat, addr : Address, s : State) :
pm‘states(s) And
OK?(ac‘alloc(pm)(size)(s)) And
NOT data(ac‘alloc(pm)(size)(s)) = null_addressImplies
subset?(address_block(data(ac‘alloc(pm)(size)(s)), size),
ac‘memory_pool(pm)(s))

End Allocator

Allocation_Info[State : Type] : Theory
% Thistheoryformalizesthe (additional) informationthat
% we trackfor allocatorsand its consistencycondition.

Begin

Importing Allocator[State], More_Relations
% The allocationinfo containsthe set of allocationpointsof one
% specificallocator. An allocationpointis an (address, size) pair
% that has been allocatedwiththis veryallocator(that is, the
% addresswas returnedby an alloc withargumentsize in some former
% state and no free has been done so far.

%

% Note that the consistencybelow requiresonlythat the allocation
% info containsa subset of the allocatedmemory. In the following
% cases correctlyallocatedmemorymust not be in the allocationinfo:

%

% − Memoryallocatedin allocatorA that is used as memorypool of
% allocatorB.
Allocator_Info: Type = list[[Address, posnat]]
allocator_info? : PRED[Allocator_Info] = Lambda(ai : Allocator_Info) :
blocks_pairwise_disjoint (ai)
pm : Var (plain_memory?)
ai : Var Allocator_Info
s : Var State
consistent_allocator?(pm)(ac : (allocator?(pm)), ai)(s) : bool =
allocator_info?(ai) And
Forall(addr : Address, size : posnat) : member((addr, size), ai) Implies
subset?(address_block(addr, size), ac‘allocated(pm)(s))
% proof status:−)
consistent_allocator_state_change : Lemma
Forall(ac : (allocator?(pm)), s1, s2 : State) :
consistent_allocator?(pm)(ac, ai)(s1) And
ac‘allocated(pm)(s1) = ac‘allocated(pm)(s2) Implies
consistent_allocator?(pm)(ac, ai)(s2)

% proof status:−)
% consistent_allocator_read_TCC1 : TCCObligation
% proof status:−)
consistent_allocator_read: Lemma
Forall(ac : (allocator?(pm)), addr : Address) :
pm‘states(s) And
consistent_allocator?(pm)(ac, ai)(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr) Implies
consistent_allocator?(pm)(ac, ai)(state(memory_read(pm‘mem)(addr)(s)))

% proof status:−)
% consistent_allocator_write_TCC1 : TCCObligation
% proof status:−)
consistent_allocator_write: Lemma
Forall(ac : (allocator?(pm)), addr : Address, byte : Byte) :
pm‘states(s) And
consistent_allocator?(pm)(ac, ai)(s) And
pm‘rw_addr(addr) And
Not ac‘private_mem(pm)(addr) Implies
consistent_allocator?(pm)(ac, ai)
(state(memory_write(pm‘mem)(addr, byte)(s)))
% proof status:−)
% consistent_allocator_alloc_TCC1 : TCCObligation
% proof status:−)
consistent_allocator_alloc: Lemma
Forall(ac : (allocator?(pm)), size : posnat) :
pm‘states(s) And
consistent_allocator?(pm)(ac, ai)(s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
consistent_allocator?(pm)
(ac, cons((data(ac‘alloc(pm)(size)(s)), size), ai))
(state(ac‘alloc(pm)(size)(s)))
% proof status:−)
% consistent_allocator_free_TCC1 : TCCObligation
% proof status:−)
% consistent_allocator_free_TCC2 : TCCObligation
% proof status:−)
consistent_allocator_free: Lemma
Forall(ac : (allocator?(pm)), addr : Address) :
pm‘states(s) And
consistent_allocator?(pm)(ac, ai)(s) And
OK?(ac‘free(pm)(addr)(s)) And
(member((addr, down(ac‘freed_size(pm)(addr)(s))), ai) OR

blocks_pairwise_disjoint

(

cons((addr, down(ac‘freed_size(pm)(addr)(s))), ai)))

Implies

consistent_allocator?(pm)
(ac, list_remove((addr, down(ac‘freed_size(pm)(addr)(s))), ai))
(state(ac‘free(pm)(addr)(s)))
End Allocation_Info

Allocation_Table[State : Type] : Theory

Begin

Importing Allocation_Info[State], Graph, Finite_Set_Reduce ,

More_List_Props_2

pm : Var (plain_memory?)
% An allocationtable containsa hierarchyof allocatorstogether
% withtheirallocationinfo’s. The hierarchyis a finite, directedgraph.
% hierarchy(ac1, ac2) means that the memorypool of ac2 is allocated
% insideac1. Currentlythe hierarchymust be a tree, that is a
% non−root allocatorgets its memoryfrom precieselyone allocator.
% ThusFiascosreagionmanageris currentlyunsupported.
Allocation_Table(pm) : Type = [#
hierarchy : (finite_tree?[(allocator?(pm))]),
info : [(hierarchy‘nodes) −> Allocator_Info]

#]

ai : Var Allocator_Info
s : Var State
allocation_ok?(pm)(at : Allocation_Table(pm), s) : bool =
(Forall(ac1, ac2 : (at‘hierarchy‘nodes)) :
at‘hierarchy‘edges(ac1, ac2) Implies
subset?(ac2‘memory_pool(pm)(s), ac1‘allocated(pm)(s)) And
block_is_free (ac2‘memory_pool(pm)(s), at‘info(ac1))

)

And

(Forall(ac1, ac2, ac3 : (at‘hierarchy‘nodes)) :
at‘hierarchy‘edges(ac1, ac2) And
at‘hierarchy‘edges(ac1, ac3) Implies
ac2 = ac3 OR
disjoint?(ac2‘memory_pool(pm)(s), ac3‘memory_pool(pm)(s))

)

And

(Forall(ac1, ac2 : (roots(at‘hierarchy))) :
ac1 = ac2 OR disjoint?(ac1‘memory_pool(pm)(s), ac2‘memory_pool(pm)(s)))

And

(Forall(ac1, ac2 : (at‘hierarchy‘nodes)) :
ac1 = ac2 OR disjoint?(ac1‘private_mem(pm), ac2‘private_mem(pm)))

And

(Forall(ac : (at‘hierarchy‘nodes)) :
consistent_allocator?(pm)(ac, at‘info(ac))(s))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% allocationaccess lemmas

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
allocation_finite_tree: Lemma
Forall(at : Allocation_Table(pm)) :

finite_tree?(at‘hierarchy)
% proof status:−)
allocation_subnodes_allocated_and_free : Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (at‘hierarchy‘nodes)) :
allocation_ok?(pm)(at, s) And
at‘hierarchy‘edges(ac1, ac2) Implies
subset?(ac2‘memory_pool(pm)(s), ac1‘allocated(pm)(s)) And
block_is_free (ac2‘memory_pool(pm)(s), at‘info(ac1))
% proof status:−)
allocation_subnodes_disjoint: Lemma
Forall(at : Allocation_Table(pm), ac1, ac2, ac3 : (at‘hierarchy‘nodes)) :
allocation_ok?(pm)(at, s) And
at‘hierarchy‘edges(ac1, ac2) And
at‘hierarchy‘edges(ac1, ac3) Implies
ac2 = ac3 OR
disjoint?(ac2‘memory_pool(pm)(s), ac3‘memory_pool(pm)(s))
% proof status:−)
allocation_roots_disjoint: Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (roots(at‘hierarchy))) :
allocation_ok?(pm)(at, s) Implies
ac1 = ac2 OR
disjoint?(ac1‘memory_pool(pm)(s), ac2‘memory_pool(pm)(s))
% proof status:−)
allocation_private_memory_disjoint : Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (at‘hierarchy‘nodes)) :
allocation_ok?(pm)(at, s) Implies
ac1 = ac2 OR
disjoint?(ac1‘private_mem(pm), ac2‘private_mem(pm))
% proof status:−)
allocation_consistent_allocator: Lemma
Forall(at : Allocation_Table(pm), ac : (at‘hierarchy‘nodes)) :
allocation_ok?(pm)(at, s) Implies
consistent_allocator?(pm)(ac, at‘info(ac))(s)
% proof status:−)
allocation_allocated_allocation_point : Lemma
Forall(at: Allocation_Table(pm), ac : (at‘hierarchy‘nodes),
addr : Address, size : posnat) :
allocation_ok?(pm)(at, s) And
member((addr, size), at‘info(ac)) Implies
subset?(address_block(addr, size), ac‘allocated(pm)(s))
% proof status:−)
allocation_allocation_point_in_memory_pool : Lemma
Forall(at: Allocation_Table(pm), ac : (at‘hierarchy‘nodes),
addr : Address, size : posnat) :
pm‘states(s) And

allocation_ok?(pm)(at, s) And
member((addr, size), at‘info(ac)) Implies
subset?(address_block(addr, size), ac‘memory_pool(pm)(s))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% generalutilitylemmas

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% proof status:−)
allocators_different_in_hierachy : Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (at‘hierarchy‘nodes)) :
at‘hierarchy‘edges(ac1, ac2) Implies
Not ac1 = ac2
% proof status:−)
uppath_memory_pool: Lemma
Forall(at : Allocation_Table(pm), p : (path?(at‘hierarchy))) :
allocation_ok?(pm)(at, s) And
pm‘states(s) Implies
subset?(path_end(p)‘memory_pool(pm)(s),
path_start(p)‘memory_pool(pm)(s))
% proof status:−)
% uppath_memory_pool_allocated_and_free_TCC1 : TCCObligation
% proof status:−)
uppath_memory_pool_allocated_and_free : Lemma
Forall(at : Allocation_Table(pm), p : (path?(at‘hierarchy))) :
pm‘states(s) And
allocation_ok?(pm)(at, s) And
length(p) >= 2 Implies
subset?(path_end(p)‘memory_pool(pm)(s), path_start(p)‘allocated(pm)(s))

And

block_is_free (path_end(p)‘memory_pool(pm)(s), at‘info(path_start(p)))
% proof status:−)
allocation_memory_pools: Lemma
Forall(at : Allocation_Table(pm), ac1, ac2 : (at‘hierarchy‘nodes)) :
pm‘states(s) And
allocation_ok?(pm)(at, s) Implies
ac1 = ac2

OR

disjoint?(ac1‘memory_pool(pm)(s), ac2‘memory_pool(pm)(s))

OR

(subset?(ac1‘memory_pool(pm)(s), ac2‘allocated(pm)(s)) And
block_is_free (ac1‘memory_pool(pm)(s), at‘info(ac2)))

OR

(subset?(ac2‘memory_pool(pm)(s), ac1‘allocated(pm)(s)) And

block_is_free (ac2‘memory_pool(pm)(s), at‘info(ac1)))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% generalallocationresults

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% allocation_info_TCC1: TCCObligation
allocation_info(pm)(at : Allocation_Table(pm)) : Allocator_Info=
flatten(map(at‘info)(list_of_finite_set (at‘hierarchy‘nodes)))
% proof status:−)
member_allocation_info: Lemma
Forall(at : Allocation_Table(pm), addr : Address, size : posnat) :
member((addr, size), allocation_info(pm)(at)) Implies
Exists(ac : (at‘hierarchy‘nodes)) : member((addr, size), at‘info(ac))
% all allocationpointsare disjoint
% proof status:−)
allocation_consistent: Lemma
Forall(at : Allocation_Table(pm)) :
pm‘states(s) And
allocation_ok?(pm)(at, s) Implies
allocator_info?(allocation_info(pm)(at))
% proof status:−)
% allocation_alloc_other_private_memory_TCC1 : TCCObligation
% proof status:−)
% allocation_alloc_other_private_memory_TCC2 : TCCObligation
% proof status:−)
allocation_alloc_other_private_memory : Lemma
Forall(at : Allocation_Table(pm),
ac1, ac2 : (at‘hierarchy‘nodes), size : posnat) :
pm‘states(s) And
allocation_ok?(pm)(at, s) And
OK?(ac1‘alloc(pm)(size)(s)) And
Not data(ac1‘alloc(pm)(size)(s)) = null_addressAnd
Not ac1 = ac2 Implies
stays_unchanged(pm)(s, state(ac1‘alloc(pm)(size)(s)),
ac2‘private_mem(pm))
% proof status:−)
% allocation_alloc_TCC1: TCCObligation
% proof status:−)
allocation_alloc: Lemma

B.3 bits.pvs

Forall(at : Allocation_Table(pm),
ac : (at‘hierarchy‘nodes), size : posnat) :
pm‘states(s) And
allocation_ok?(pm)(at, s) And
OK?(ac‘alloc(pm)(size)(s)) And
Not data(ac‘alloc(pm)(size)(s)) = null_addressImplies
allocation_ok?(pm)(
at WITH [‘info(ac) :=
cons((data(ac‘alloc(pm)(size)(s)), size), at‘info(ac))],
state(ac‘alloc(pm)(size)(s)))
End Allocation_Table

B.3 bits.pvs

Bits : Theory

Begin

Importing Alignment
% MV: do we need the size limitatsany more
n, i : Var nat
bool_to_nat (b : bool) : nat = if b then 1 else 0 endif
% proof status:−)
bool_to_nat_below : Judgement bool_to_nat (b : bool) HAS_TYPEbelow(2)
nat_to_bool (n : below(2)) : bool = n = 1
% proof status:−)
nat_bool_iso: Lemma Forall(b : bool) : nat_to_bool (bool_to_nat (b)) = b
% returntrue if the i−th bit in n is 1
cut_bit(n, i) : bool = rem(2)(ndiv(n, expt(2, i))) = 1
% proof status:−)
cut_bit_zero: Lemma cut_bit(0, i) = False
% cut k bits out of n, startingat i
cut_bits(n, i, k : nat) : nat =
rem(expt(2, k))(ndiv(n, expt(2, i)))
% proof status:−)
cut_bits_below: Judgement cut_bits(n, i, k : nat)
HAS_TYPEbelow(expt(2, k))
% proof status:−)
cut_bits_aligned: Lemma Forall(n, i, k : nat) :
i <= k And cut_bits(n, 0, k) = 0 Implies aligned?(i)(n)
% proof status:−)

aligned_cut_bits: Lemma Forall(n, i, j : nat, k : nat) :
i + j <= k And aligned?(k)(n) Implies
cut_bits(n, i, j) = 0
% proof status:−)
aligned_add_cut_bits : Lemma Forall(n, m, i, j, k : nat) :
i + j <= k And aligned?(k)(n) Implies
cut_bits(n + m, i, j) = cut_bits(m, i, j)
% proof status:−)
cut_bit_bits: Lemma
cut_bit(n, i) = IF cut_bits(n, i, 1) = 1 Then true Else false Endif
% proof status:−)
cut_bits_zero: Lemma Forall(i, k : nat) : cut_bits(0, i, k) = 0
% proof status:−)
zero_cut_bits: Lemma Forall(n, i, k : nat) : k = 0 Implies
cut_bits(n, i, k) = 0
% proof status:−)
% cut_bits_cut_bits_TCC1 : TCCObligation
% proof status:−)
cut_bits_cut_bits : Lemma
Forall(n, i1, k1, i2, k2 : nat) :
cut_bits(cut_bits(n, i1, k1), i2, k2) =
IF i2 >= k1 Then 0
Elsif i2 + k2 > k1 Then cut_bits(n, i1 + i2, k1 − i2)
Else cut_bits(n, i1 + i2, k2)

Endif

% proof status:−)
cut_bit_cut_bits : Lemma
Forall(n, i1, k1, i2 : nat) :
cut_bit(cut_bits(n, i1, k1), i2) =
IF i2 >= k1 Then False
Else cut_bit(n, i1 + i2)

Endif

shift_bits_left (n, i) : nat = n ∗ expt(2, i)
% proof status:−)
% shift_bits_left_less_TCC1 : TCCObligation
% proof status:−)
shift_bits_left_less : Lemma Forall(n, i, k : nat) :
k >= i And n < expt(2, k − i) Implies
shift_bits_left (n, i) < expt(2, k)
% proof status:−)

aligned_shift_bits_ok : Lemma Forall(n, i, j : nat) :
i <= j Implies
aligned?(i)(shift_bits_left (n, j))
% proof status:−)
% aligned_shift_bits_reduce_TCC1 : TCCObligation
% proof status:−)
aligned_shift_bits_reduce : Lemma Forall(n, i, j : nat) :
i > j And aligned?(i − j)(n) Implies
aligned?(i)(shift_bits_left (n, j))
shift_bits_right (n, i) : nat = ndiv(n, expt(2, i))
% proof status:−)
% overwrite_bits_TCC1: TCCObligation
% overwrite_bits(n, m, i, j)
% replacesk bits startingfrom i in word n
% withk bits startingat i in word m
overwrite_bits(n, m, i, k : nat) : nat =
n − rem(expt(2, i + k))(n)
+ shift_bits_left (cut_bits(m, i, k), i)
+ rem(expt(2, i))(n)
% proof status:−)
overwrite_bits_less: Lemma Forall(n, m, i, k, j : nat) :
n < expt(2, j) And i + k <= j Implies
overwrite_bits(n, m, i, k) < expt(2, j)
overwrite_bit(n, m, i : nat) : nat = overwrite_bits(n, m, i, 1)
% proof status:−)
overwrite_bit_less: Lemma Forall(n, m, i, k : nat) :
n < expt(2, k) And i < k Implies
overwrite_bit(n, m, i) < expt(2, k)

% overwritesbit i in n withb
overwrite_bool_bit (n : nat, b : bool, i : nat) : nat =
overwrite_bit(n, shift_bits_left (bool_to_nat (b), i), i)
% proof status:−)
overwrite_bool_bit_less : Lemma Forall(n : nat, b : bool, i, k : nat) :
n < expt(2, k) And i < k Implies
overwrite_bool_bit (n, b, i) < expt(2, k)

% overwritek bits in n at indexi withthe firstk bits from m
overwrite_shift_bits (n, m, i : nat, k : nat) : nat =
overwrite_bits(n, shift_bits_left (m, i), i, k)

% proof status:−)
overwrite_shift_bits_less : Lemma Forall(n, m, i, k, j : nat) :
n < expt(2, j) And i + k <= j Implies
overwrite_shift_bits (n, m, i, k) < expt(2, j)
% proof status:−)
aligned_overwrite_shift_bits_more : Lemma
Forall(a, n, m, i : nat, k : posnat) :
a <= i And aligned?(a)(n) Implies
aligned?(a)(overwrite_shift_bits (n, m, i, k))

% proof status:−)
% aligned_overwrite_shift_bits_less_TCC1 : TCCObligation
% the aligned(a)(n) is a verystrong assumptions,
% closer to necessitywouldbe
% aligned(a)(delete bits i to i + k −1 in n)
% proof status:−)
aligned_overwrite_shift_bits_less : Lemma
Forall(a, n, m, i : nat, k : posnat) :
i < a And aligned?(a)(n) And aligned?(a − i)(m) Implies
aligned?(a)(overwrite_shift_bits (n, m, i, k))

% proof status:−)
% cut_bits_shift_bits_left_TCC1 : TCCObligation
% proof status:−)
% cut_bits_shift_bits_left_TCC2 : TCCObligation
% Don’t installcut_bits_shift_bits_left as auto rewrite,
% it can be circularfor ci = 0. Use the lemmasbelow instead.
% proof status:−)
cut_bits_shift_bits_left : Lemma Forall(n, si, ci, ck : nat) :
cut_bits(shift_bits_left (n, si), ci, ck) =
If ci + ck <= si Then 0
Elsif ci < si
Then cut_bits(shift_bits_left (n, si − ci), 0, ck)
Else cut_bits(n, ci − si, ck)

Endif

% proof status:−)
cut_bits_shift_bits_left_outside : Lemma
Forall(n, si, ci, ck : nat) :
ci + ck <= si Implies
cut_bits(shift_bits_left (n, si), ci, ck) = 0
% proof status:−)
% cut_bits_shift_bits_left_overlap_TCC1 : TCCObligation

% proof status:−)
cut_bits_shift_bits_left_overlap : Lemma
Forall(n, si, ci, ck : nat) :
ci + ck > si And ci < si And ci > 0 Implies
cut_bits(shift_bits_left (n, si), ci, ck) =
cut_bits(shift_bits_left (n, si − ci), 0, ck)
% proof status:−)
cut_bits_shift_bits_left_in : Lemma
Forall(n, si, ci, ck : nat) :
ci >= si Implies
cut_bits(shift_bits_left (n, si), ci, ck) =
cut_bits(n, ci − si, ck)

% proof status:−)
overwrite_shift_bits_zero : Lemma
Forall(z, m, i, k : nat) :
z = 0 Implies
overwrite_shift_bits (z, m, i, k) =
shift_bits_left (cut_bits(m, 0, k), i)
% proof status:−)
zero_overwrite_shift_bits : Lemma
Forall(n, m, i, k : nat) : k = 0 Implies
overwrite_shift_bits (n, m, i, k) = n
% proof status:−)
% bit_split_TCC1: TCCObligation
% proof status:−)
bit_split: Lemma Forall(n, i, k : nat) :
k <= i And n < expt(2, i) Implies
n = overwrite_shift_bits (cut_bits(n, 0, k),
cut_bits(n, k, i − k), k, i − k)
% proof status:−)
shift_bits_left_cut_bits : Lemma Forall(n, i, k, j : nat) :
i = j And aligned?(i)(n) And n < expt(2, i + k) Implies
shift_bits_left (cut_bits(n, i, k), j) = n
% proof status:−)
cut_bits_0_to_below : Lemma Forall(n, k : nat) :
n < expt(2, k) Implies cut_bits(n, 0, k) = n
% proof status:−)
cut_bits_overwrite_bits_disjoined : Lemma
Forall(n, m, oi, ok : nat, ci, ck : nat) :
oi + ok <= ci Or ci + ck <= oi Implies
cut_bits(overwrite_bits(n, m, oi, ok), ci, ck) = cut_bits(n, ci, ck)
% proof status:−)

cut_bits_overwrite_bool_bit_disjoined : Lemma
Forall(n : nat, b : bool, oi, ci, ck : nat) :
oi < ci Or ci + ck <= oi Implies
cut_bits(overwrite_bool_bit (n, b, oi), ci, ck) = cut_bits(n, ci, ck)

% proof status:−)
cut_bits_overwrite_bits_contained : Lemma
Forall(n, m, oi, ok, ci, ck : nat) :
oi <= ci And ci + ck <= oi + ok Implies
cut_bits(overwrite_bits(n, m, oi, ok), ci, ck) =
cut_bits(m, ci, ck)
% proof status:−)
cut_bits_overwrite_shift_bits_disjoint : Lemma
Forall(n, m, i1, k1, i2, k2 : nat) :
i1 + k1 <= i2 OR i2 + k2 <= i1 Implies
cut_bits(overwrite_shift_bits (n, m, i1, k1), i2, k2) =
cut_bits(n, i2, k2)
% proof status:−)
% cut_bits_overwrite_shift_bits_contained_TCC1 : TCCObligation
% proof status:−)
cut_bits_overwrite_shift_bits_contained : Lemma
Forall(n, m, i1, k1, i2, k2 : nat) :
i1 <= i2 And i2 + k2 <= i1 + k1 Implies
cut_bits(overwrite_shift_bits (n, m, i1, k1), i2, k2) =
cut_bits(m, i2 − i1, k2)
% proof status:−)
% cut_bit_overwrite_shift_bits_TCC1 : TCCObligation
% proof status:−)
cut_bit_overwrite_shift_bits : Lemma
Forall(n, m, i1, k1, i2 : nat) :
cut_bit(overwrite_shift_bits (n, m, i1, k1), i2) =
IF i1 <= i2 And i2 < i1 + k1
Then cut_bit(m, i2 − i1)
Else cut_bit(n, i2)

Endif

% not needed any more, proof savedbelow
% cut_bits_overwrite_bool_bit_contained : Lemma
% Forall(n : nat, b : bool, oi : nat, ci, ck : nat) :
% ck = 1 Andoi = ci Implies
% cut_bits(overwrite_bool_bit (n, b, oi), ci, ck) =
% bool_to_nat(b)
% proof status:−)
cut_bit_overwrite_bool_bit : Lemma
Forall(n : nat, b : bool, i, j : nat) :

cut_bit(overwrite_bool_bit (n, b, i), j) =
IF i = j Then b
Else cut_bit(n, j)

Endif

% proof status:−)
overwrite_shift_bits_merge : Lemma
Forall(m, ci1, ck1, si, ci2, ck2, os, ok : nat) :
ci1 + ck1 = ci2 And
si + ck1 = os And
ck2 = ok

Implies

overwrite_shift_bits (shift_bits_left (cut_bits(m, ci1, ck1), si),
cut_bits(m, ci2, ck2), os, ok) =
shift_bits_left (cut_bits(m, ci1, ck1 + ck2), si)
End Bits

% Bit operationsfor below[2^p]
Bitops[p : posnat] : Theory

Begin

Importing Bits, More_List_Props
n : Var nat
val : Var nat
v1, v2 : Var nat
bit_set?(n, val) : bool = cut_bit(val, n)
% proof status:−)
bit_set_zero_mask : Lemma
Forall (n : nat) : Not bit_set?(n, 0)
% proof status:−)
bit_set_ndiv_expt2 : Lemma
Forall (n, val, m : nat) :
bit_set?(n, ndiv(val, expt(2, m))) = bit_set?(n + m, val)
% proof status:−)
% bit_set_full_mask_TCC1 : TCCObligation
% proof status:−)
bit_set_full_mask : Lemma
Forall (n : nat) : n < p Implies bit_set?(n, expt(2, p) − 1)
% proof status:−)
bits_equal: Lemma
Forall (v1, v2, p : nat) :
(Forall (n : nat) : n < p Implies bit_set?(n, v1) = bit_set?(n, v2)) Implies
rem(expt(2, p))(v1) = rem(expt(2, p))(v2)

% proof status:−)
bits_equal2: Lemma
Forall (v1, v2 : below[expt(2, p)]) :
(Forall (n : nat) : n < p Implies bit_set?(n, v1) = bit_set?(n, v2)) IFF
v1 = v2
% proof status:−)
bits_equal3: Lemma
Forall (v1, v2 : nat) :
(Forall (n : nat) : bit_set?(n, v1) = bit_set?(n, v2)) Implies
v1 = v2
% proof status:−)
bits_equal4: Lemma
Forall (v1, v2 : nat, m : nat) :
(Forall (n : nat) : n >= m Implies bit_set?(n, v1) = bit_set?(n, v2)) Implies
ndiv(v1, expt(2, m)) = ndiv(v2, expt(2, m))
set_bit(n, val) : nat =
If bit_set?(n, val) Then

val Else

val + expt(2,n)

Endif

% proof status:−)
% clear_bit_TCC1: TCCObligation
clear_bit(n, val) : nat =
If bit_set?(n, val) Then
val − expt(2,n)

Else

val Endif

change_bit(val : nat, c : [nat −> bool])(n : nat) : nat =
If c(n) Then
set_bit(n, val)

Else

clear_bit(n, val)

Endif

% proof status:−)
change_bit_single_bit_op : Lemma
Forall (n, m, v : nat, c : [nat −> bool]) : n /= m Implies
bit_set?(n, v) = bit_set?(n, change_bit(v, c)(m))
% proof status:−)
change_bit_result: Lemma
Forall (n, v : nat, c : [nat −> bool]) :
bit_set?(n, change_bit(v, c)(n)) = c(n)

% proof status:−)
% change_bits_TCC1: TCCObligation
% proof status:−)
% change_bits_TCC2: TCCObligation
change_bits(v : nat, c : [nat −> bool])(n : nat) : Recursive nat =
If n = 0 Then
change_bit(v, c)(0)

Else

change_bit(change_bits(v, c)(n − 1), c)(n)

Endif

Measure n
% proof status:−)
change_bits_result: Lemma
Forall (m, n : nat, val : nat, c : [nat −> bool]) : m <= n Implies
bit_set?(m, change_bits(val, c)(n)) = c(m)
% proof status:−)
change_bits_unchanged: Lemma
Forall (m, n : nat, val : nat, c : [nat −> bool]) : m > n Implies
bit_set?(m, change_bits(val, c)(n)) = bit_set?(m, val)
% proof status:−)
% change_bits_below_TCC1 : TCCObligation
% proof status:−)
change_bits_below: Lemma
Forall (v : below[expt(2, p)], c : [nat −> bool]) :
change_bits(v, c)(p−1) < expt(2, p)
% proof status:−)
% binary_not_TCC1: TCCObligation
% binaryops
% −−−−−−−−−−−−
binary_not(val : below[expt(2, p)]) : below[expt(2, p)] =
change_bits(val, Lambda (n : nat) : Not bit_set?(n, val))(p − 1)
% proof status:−)
binary_not_not: Lemma
Forall ( val : below[expt(2, p)]) :
binary_not(binary_not(val)) = val
% proof status:−)
% binary_and_TCC1: TCCObligation
binary_and(v1, v2 : below[expt(2, p)]) : below[expt(2, p)] =
change_bits(v1, Lambda (n : nat) : bit_set?(n, v1) And bit_set?(n, v2))(p − 1)

% proof status:−)
binary_and_not: Lemma
Forall (val : below[expt(2, p)]) :
binary_and(val, binary_not(val)) = 0
% proof status:−)
% binary_and_full_TCC1 : TCCObligation
% proof status:−)
binary_and_full: Lemma
Forall (val : below[expt(2, p)]) :
binary_and(val, expt(2, p) − 1) = val
% proof status:−)
% binary_and_zero_TCC1 : TCCObligation
% proof status:−)
binary_and_zero: Lemma
Forall (val : below[expt(2, p)]) :
binary_and(val, 0) = 0
% proof status:−)
% binary_or_TCC1: TCCObligation
binary_or(v1, v2 : below[expt(2, p)]) : below[expt(2, p)] =
change_bits(v1, Lambda (n : nat) : bit_set?(n, v1) Or bit_set?(n, v2))(p − 1)
% proof status:−)
binary_or_not: Lemma
Forall (val : below[expt(2, p)]) :
binary_or(val, binary_not(val)) = expt(2, p) − 1
% proof status:−)
% binary_xor_TCC1: TCCObligation
binary_xor(v1, v2 : below[expt(2, p)]) : below[expt(2, p)] =
change_bits(v1, Lambda (n : nat) : bit_set?(n, v1) /= bit_set?(n, v2))(p − 1)
% proof status:−)
binary_xor_self: Lemma
Forall (val : below[expt(2, p)]) :
binary_xor(val, val) = 0
% proof status:−)
binary_or_full: Lemma
Forall (val : below[expt(2, p)]) :
binary_or(val, expt(2, p) − 1) = expt(2, p) − 1
% proof status:−)
binary_or_zero: Lemma
Forall (val : below[expt(2, p)]) :
binary_or(val, 0) = val

End Bitops
Bitlist_ops: Theory

Begin

Importing General, Bitops[bits_per_byte ]
% Liftingto lists
% ==================
% proof status:−)
% binary_not_TCC1: TCCObligation
binary_not(l : list[Byte]) : list[Byte] =
map[Byte, Byte](binary_not)(l)
% proof status:−)
% binary_and_TCC1: TCCObligation
binary_and(l1, l2 : list[Byte]) : list[Byte] =
map2[Byte](binary_and)(l1, l2)
% proof status:−)
% binary_or_TCC1: TCCObligation
binary_or(l1, l2 : list[Byte]) : list[Byte] =
map2[Byte](binary_or)(l1, l2)
% proof status:−)
% binary_xor_TCC1: TCCObligation
binary_xor(l1, l2 : list[Byte]) : list[Byte] =
map2[Byte](binary_xor)(l1, l2)
full_mask?(size : nat)(l : list[Byte]) : bool =
length(l) = size And every(Lambda (t : Byte) : t = max_byte− 1)(l)
zero_mask?(size : nat)(l : list[Byte]) : bool =
length(l) = size And every(Lambda (t : Byte) : t = 0)(l)
% proof status:−)
singleton_zero_mask: Lemma
Forall (s : nat) :
singleton?(zero_mask?(s))
% proof status:−)
% bit_set?_TCC1: TCCObligation
% proof status:−)
% bit_set?_TCC2: TCCObligation

bit_set?(n : nat, l : list[Byte]) : bool =
If n < length(l) ∗ max_byteThen
bit_set?(rem(max_byte)(n), nth(l, ndiv(n, max_byte)))

Else false Endif

apply_bitop_valuefield (mask : list[Byte], bitop : [list[Byte] −> list[Byte]])(l : list[Byte]) : list[Byte] =
binary_or(binary_and(l, binary_not(mask)), binary_and(bitop(l), mask))
End Bitlist_ops

B.4 challenge-linear.pvs

% MV: there are a few assumptionsin the addressin page table range stuff

%

% CurrentAddressSpace Layout(hypervisor/include/memory.h)

%

% | GlobalArea| CPULocalArea| AS Loc|
% |−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−|
% |−−−−−−− −−−−−−−−−−−−−−−−− −− −−− −−−−−− −−−− −−−−− −− −−−−−− −−−−−−−|
% | Kcode | Mem Pool | |RM|VGA|IOAPIC| Loc| |LAPIC|SP|CPULoc| IOPBM|
% |−−−−−−− −−−−−−−−−−−−−−−−− −− −−− −−−−−− −−−− −−−−− −− −−−−−− −−−−−−−|
% |−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−|

%

% HV: Assumptions
% − The globalarea is syncedat the masterPDIRlevel(fault.cpp/paging.cpp).
% − MasterPDIRis in Kcode (.bss segment)

%

% Model:
% − address_in_page_table_range gives all page table entriesused for the given
% addressrange. Page table entriesoutsidethis range may be in plainmemory
% − this shouldat least allowto enter the fault handlerwithoutloosing plain
% memorybecause subset(ro_PFu rw_PF, ro u rw)
% ? is this a generic resultfor plainmemory, i.e., pm(range) => pm(sub_range)
% and if so do we have it.
Linear_Memory_Blessing [% the underlyingphysicalmemory
Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm_phy: Plain_Memory] : Theory

Begin

Importing Linear_Memory[Physical_memory, pm_phy],
Memory_Change, Control_Register_Datatype
oact : Var PRED[[Linear_memory−> SuperResult[Linear_memory]]]
ro_addr: Var PRED[Memory_Address_4G ]
rw_addr: Var PRED[Memory_Address_4G ]
states : Var PRED[Linear_memory]
linear_range: Var PRED[Memory_Address_4G ]

B.4 challenge-linear.pvs

s : Var Linear_memory
lvl : Var Level

% Sharing
% =========
% tuplesof linearaddressesthat share the same physicaladdress
linear_shared?(s)(a1, a2 : Memory_Address_4G ) : bool =
Exists(ac1, ac2 : Memory_access) :
OK?(linear_resolve(a1, ac1)(s)) And
OK?(linear_resolve(a2, ac2)(s)) And
data(linear_resolve(a1, ac1)(s)) =
data(linear_resolve(a2, ac2)(s))
% AddressIn Page Table
% =======================
% proof status:−)
% PTab_Address_TCC1: TCCObligation
PTab_Address: Type =
{a : Memory_Address_4G| aligned?(bits_per_level+ pe_size)(offset(a))}
% proof status:−)
% pe_in_pdir_range ?_TCC1: TCCObligation
pe_in_pdir_range ?(s, linear_range)(phy_a: Memory_Address_4G ) : bool =
Let res = read_data(pm_phy, pdbr_data_type )(PDBR)(s) In
OK?(res) And
Exists (lin_a: (linear_range)) :
xlat_idx(pdir_lvl, data(res)‘base_addr, lin_a) = phy_a
% proof status:−)
% pe_in_ptab_range ?_TCC1: TCCObligation
% proof status:−)
% pe_in_ptab_range ?_TCC2: TCCObligation
% proof status:−)
% pe_in_ptab_range ?_TCC3: TCCObligation
% proof status:−)
% pe_in_ptab_range ?_TCC4: TCCObligation
pe_in_ptab_range ?(s, linear_range)(phy_a: Memory_Address_4G ) : bool =
Exists (pde : (pe_in_pdir_range ?(s, linear_range))) :
Exists (lin_a: (linear_range)) :
Let res = read_data(pm_phy, paging_data_type (pdir_lvl))(pde)(s) In
OK?(res) And pde_pt?(pdir(data(res))) And

xlat_idx(ptab_lvl, base(data(res)), lin_a) = phy_a
% proof status:−)
% pe_in_pt_range ?_TCC1: TCCObligation
% proof status:−)
% pe_in_pt_range ?_TCC2: TCCObligation
pe_in_pt_range ?(s, linear_range, lvl)(phy_a: Memory_Address_4G ) : bool =

Cond

lvl = pdir_lvl−> pe_in_pdir_range ?(s, linear_range)(phy_a),
lvl = ptab_lvl−> pe_in_ptab_range ?(s, linear_range)(phy_a)

EndCond

% proof status:−)
pe_in_pt_range_aligned : Lemma
Forall (phy_a: Memory_Address_4G ) :
pe_in_pt_range ?(s, linear_range, lvl)(phy_a) Implies
aligned?(pe_size)(offset(phy_a))
address_in_pt_range ?(s, linear_range)(phy_a: Memory_Address_4G ) : bool =
Exists (pe : Memory_Address_4G , lvl : Level) :
pe_in_pt_range ?(s, linear_range, lvl)(pe) And
address_block(pe, expt(2, pe_size))(phy_a)
% proof status:−)
pe_in_pt_address_in_pt : Lemma
Forall (base : Memory_Address_4G ) :
pe_in_pt_range ?(s, linear_range, lvl)(base)

Implies

subset?(address_block(base, expt(2, pe_size)),
address_in_pt_range ?(s, linear_range))
% PhysicalAddresses
% ====================
virt_to_phys_range (s : Linear_memory, linear_range: PRED[Memory_Address_4G ],
mem_ac: PRED[Memory_access])
(phy_a: Memory_Address_4G ) : bool =
Exists (lin_a: (linear_range), ac : (mem_ac)) :
Let res = linear_resolve(lin_a, ac)(s) In
OK?(res) And data(res) = phy_a
virt_to_phys_range (s, linear_range) : [Memory_Address_4G−> bool] =
virt_to_phys_range (s, linear_range, fullset[Memory_access])
% LinearResolveTransformers
% =============================

linear_resolve_register_transformers

(q : [Physical_memory−> SuperResult[Physical_memory]]) : bool =
q = expr_2_super (read_data(pm_phy, segment_reg_data_type )(CS)) Or

q = expr_2_super (read_data(pm_phy, pdbr_data_type )(PDBR)) Or
Exists (a : Memory_Address_4G ) :
q = expr_2_super (write_data(pm_phy, address_data_type )(CR2, a))
% LinearBlessing
% =================
% Those page table entriesthat are used to translatethe address
% range for whichlinearmemoryis definedare not partof the
% linearblessedrange. Thisis because as partof the translation,
% referencebits in this area may be updated. OtherPTEsnot involved
% in the translationmay well be partof plainmemory.

%

% Thislets the page fault handlerwork insideplainmemoryand update
% the activekernelpage table in all areas besidesthe one in whichthe
% page−fault handleritself runs.
% make in memoryexplicitrequirement!!!
linear_blessed?(s, ro_addr, rw_addr) : bool =
% resolveOK?
(Forall (a : Memory_Address_4G ) : union(ro_addr, rw_addr)(a) Implies
OK?(linear_resolve(a, Read)(s)) And OK?(linear_resolve(a, Execute)(s)))

And

(Forall (a : Memory_Address_4G ) : rw_addr(a) Implies
OK?(linear_resolve(a, Write)(s))) And
% underlyingblessingmemoryread addresses
subset?(virt_to_phys_range (s, union(ro_addr, rw_addr),
union(singleton(Read), singleton(Execute))),
union(pm_phy‘ro_addr, pm_phy‘rw_addr))

And

subset?(virt_to_phys_range (s, rw_addr, singleton(Write)), pm_phy‘rw_addr)

And

subset?(address_in_pt_range ?(s, union(ro_addr, rw_addr)), pm_phy‘rw_addr)

And

% disjointmappingof (ro_addr, rw_addr) and ptabs
disjoint?(virt_to_phys_range (s, union(ro_addr, rw_addr)),
address_in_pt_range ?(s, union(ro_addr, rw_addr)))

And

% not shared
% blessingmemoryread, memory_writeaddressesif these are disjoint
(Forall (a1, a2 : Memory_Address_4G ) :
rw_addr(a1) And union(ro_addr, rw_addr)(a2) Implies
Not linear_shared?(s)(a1, a2)) And
% linearmemoryside effects
True % no side effect restrictions
% proof status:−)
% is_linear_plain_memory ?_TCC1: TCCObligation
% proof status:−)
% is_linear_plain_memory ?_TCC2: TCCObligation

% proof status:−)
% is_linear_plain_memory ?_TCC3: TCCObligation
% proof status:−)
% is_linear_plain_memory ?_TCC4: TCCObligation
% proof status:−)
% is_linear_plain_memory ?_TCC5: TCCObligation
% proof status:−)
% is_linear_plain_memory ?_TCC6: TCCObligation
is_linear_plain_memory ?(pm : Plain_Memory[Linear_memory]) : bool =
% linearpm
pm‘mem = linear_pmAnd
% unmodifiedpage−table area
% cs
(Forall (s : (pm‘states)) :
OK?(read_data(pm_phy, segment_reg_data_type )(CS)(s))) And
(Forall (s1, s2 : (pm‘states)) :
data(read_data(pm_phy, segment_reg_data_type )(CS)(s1)) =
data(read_data(pm_phy, segment_reg_data_type )(CS)(s2))) And
% pdbr
(Forall (s : (pm‘states)) :
OK?(read_data(pm_phy, pdbr_data_type )(PDBR)(s))) And
(Forall (s1, s2 : (pm‘states)) :
data(read_data(pm_phy, pdbr_data_type )(PDBR)(s1)) =
data(read_data(pm_phy, pdbr_data_type )(PDBR)(s2))) And
% pdirrange
(Forall (s1, s2 : (pm‘states)) :
pe_in_pdir_range ?(s1, union(pm‘ro_addr, pm‘rw_addr)) =
pe_in_pdir_range ?(s2, union(pm‘ro_addr, pm‘rw_addr)) And
pe_in_ptab_range ?(s1, union(pm‘ro_addr, pm‘rw_addr)) =
pe_in_ptab_range ?(s2, union(pm‘ro_addr, pm‘rw_addr))) And
% page tables
(Forall (s : (pm‘states), lvl : Level,
a : (pe_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr), lvl))) :
OK?(read_data(pm_phy, paging_data_type (lvl))(a)(s))) And
(Forall (s1, s2 : (pm‘states), lvl : Level,
a : (pe_in_pt_range ?(s1, union(pm‘ro_addr, pm‘rw_addr), lvl))) :
set_reference(data(read_data(pm_phy, paging_data_type (lvl))(a)(s1)),
Write) =
set_reference(data(read_data(pm_phy, paging_data_type (lvl))(a)(s2)),
Write)) And
% underlyingblessedmemory
plain_memory?(pm_phy) And
% underlyingstates
pm‘states = pm_phy‘states And
% underlyingother actions
subset?(pm‘other_actions, pm_phy‘other_actions) And
subset?(linear_resolve_register_transformers , pm_phy‘other_actions) And
% memoryaddressrange

(Forall (a : (union(pm‘ro_addr, pm‘rw_addr))) :
Mem?(type_of(a)) And 0 <= offset(a) And
offset(a) < max_linear_offset ) And
% linear_blessedstates
(Forall (s : (pm‘states)) : linear_blessed?(s, pm‘ro_addr, pm‘rw_addr))
% %%%%%%%%  PlainMemoryStructurefor LinearMemory%%%%%%%%%%%
linear_plain_memory (states, oact, ro_addr, rw_addr)
: Plain_Memory[Linear_memory] =

(#

mem := linear_pm,
states := states,
ro_addr:= ro_addr,
rw_addr:= rw_addr,
other_actions:= oact

#)

End Linear_Memory_Blessing
% >> MV:
% − todo: establishis_linear_plain_memory ? from a single state and
% concludethat applyingthe state transformersyieldsnew
% states for whichis_linear_plain_memory ? holds.
Linear_Memory_Properties [Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm_phy: Plain_Memory] : Theory

Begin

Importing Linear_Memory_Blessing [Physical_memory, pm_phy],

Plain_Mem_Rewrites

,

Even_More_List_Props

s : Var Linear_memory
lvl : Var Level
pm : Var Plain_Memory[Linear_memory]
% Helpers
% =========
% rewritememory_read(pm‘mem...) = linear_read(...)
% proof status:−)
pm_read_linear: Lemma
Forall (a : Address) :
is_linear_plain_memory ?(pm) Implies
memory_read(pm‘mem)(a) = linear_read(a)
% proof status:−)
pm_write_linear: Lemma
Forall (a : Address, b : Byte) :
is_linear_plain_memory ?(pm) Implies

memory_write(pm‘mem)(a, b) = linear_write(a, b)
% proof status:−)
pm_read_side_effect_linear : Lemma
Forall (a : Address, bl : list[Byte], cp : bool) :
is_linear_plain_memory ?(pm) Implies
memory_read_side_effect (pm‘mem)(a, bl, cp) =
linear_read_side_effect (a, bl, cp)
% proof status:−)
pm_write_side_effect_linear : Lemma
Forall (a : Address, bl : list[Byte], cp : bool) :
is_linear_plain_memory ?(pm) Implies
memory_write_side_effect (pm‘mem)(a, bl, cp) =
linear_write_side_effect (a, bl, cp)
% proof status:−)
pm_states: Lemma
is_linear_plain_memory ?(pm) Implies pm‘states = pm_phy‘states
% proof status:−)
pm_plain_phy: Lemma
is_linear_plain_memory ?(pm) Implies plain_memory?(pm_phy)
% proof status:−)
% pm_memory_addr_TCC1 : TCCObligation
% proof status:−)
% pm_memory_addr_TCC2 : TCCObligation
% proof status:−)
pm_memory_addr: Lemma
Forall (a : Address) :
is_linear_plain_memory ?(pm) And union(pm‘ro_addr, pm‘rw_addr)(a) Implies
in_memory(min_linear, max_linear)(a) And Mem?(type_of(a))
% proof status:−)
pm_linear_blessed: Lemma
is_linear_plain_memory ?(pm) And pm‘states(s) Implies
linear_blessed?(s, pm‘ro_addr, pm‘rw_addr)
% proof status:−)
% pm_linear_resolve_read_ok_TCC1 : TCCObligation
% proof status:−)
pm_linear_resolve_read_ok : Lemma
Forall (s : (pm‘states), a : (union(pm‘ro_addr, pm‘rw_addr))) :
is_linear_plain_memory ?(pm) Implies OK?(linear_resolve(a, Read)(s))
% proof status:−)
% pm_linear_resolve_write_ok_TCC1 : TCCObligation

% proof status:−)
pm_linear_resolve_write_ok : Lemma
Forall (s : (pm‘states), a : (pm‘rw_addr)) :
is_linear_plain_memory ?(pm) Implies OK?(linear_resolve(a, Write)(s))
% proof status:−)
pm_linear_resolve_reg_transformers_other : Lemma
is_linear_plain_memory ?(pm)

Implies

subset?(linear_resolve_register_transformers , pm_phy‘other_actions)
% proof status:−)
pm_unchanged_singleton_linear_resolve_reg_transformers : Lemma
Forall (q : [Physical_memory−> SuperResult[Physical_memory]]) :
is_linear_plain_memory ?(pm) And linear_resolve_register_transformers (q)

Implies

unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states, singleton(q),
union(pm_phy‘ro_addr, pm_phy‘rw_addr))
% proof status:−)
pm_address_in_pt_range_in_rw_addr : Lemma
is_linear_plain_memory ?(pm) And pm‘states(s) Implies
subset?(address_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr)),
pm_phy‘rw_addr)
% proof status:−)
% address_block_in_memory_TCC1 : TCCObligation
% proof status:−)
address_block_in_memory : Lemma
Forall (a : Address, bl : list[Byte]) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr)) And
cons?(bl)

Implies

a + length(bl) <= reg_size(max_linear)(type_of(a))
% proof status:−)
address_block_in_memory2 : Lemma
Forall (a : Address, bl : list[Byte]) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr)) And
cons?(bl)

Implies

0 <= a‘offset
% proof status:−)
raise_fault_transformer_invariant : Lemma
Forall (priv : Memory_privilege, access : Memory_access, present : bool,
pfa : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) Implies
transformer_invariant?(pm_phy‘states, singleton(expr_2_super (

raise_fault(priv, access, present, pfa))))
% proof status:−)
raise_fault_unchanged_memory_invariant : Lemma
Forall (priv : Memory_privilege, access : Memory_access, present : bool,
pfa : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) Implies
unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
singleton(expr_2_super (raise_fault(priv, access, present, pfa))),
union(pm_phy‘ro_addr, pm_phy‘rw_addr))
% Side Effects
% ==============
% proof status:−)
apply_side_effects_pm_states : Lemma
Forall (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]]) :
is_linear_plain_memory ?(pm) And
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states, singleton(expr_2_super (f(e)))))(l)

Implies

transformer_invariant?(pm‘states, singleton(
expr_2_super (apply_side_effects (l, f))))
% proof status:−)
apply_side_effects_ok : Lemma
Forall (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]]) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
(Forall (s1 : (pm‘states)) :
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(f(e)(s1)))(l)) And
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states,
singleton(expr_2_super (f(e)))))(l)

Implies

OK?(apply_side_effects (l, f)(s))
% proof status:−)
% apply_side_effects_same_result_TCC1 : TCCObligation
% proof status:−)
apply_side_effects_same_result : Lemma
Forall (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]]) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
(Forall (s1 : (pm‘states)) :

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(f(e)(s1)))(l)) And
(Forall (s1 : (pm‘states)) :
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(f(e)(s1)) Implies data(f(e)(s1)) = e‘2)(l)) And
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states, singleton(expr_2_super (f(e)))))(l)

Implies

data(apply_side_effects (l, f)(s)) =
reduce(null, Lambda (e : [Address, list[Byte]], tail : list[Byte]) :
Let head = e‘2 In append(head, tail))(l)
% proof status:−)
apply_side_effects_unchanged : Lemma
Forall (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]],
addresses : PRED[Memory_Address_4G ]) :
is_linear_plain_memory ?(pm) And
subset?(addresses, union(pm_phy‘ro_addr, pm_phy‘rw_addr)) And
every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
singleton(expr_2_super (f(e))), addresses))(l)

Implies

unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
singleton(expr_2_super (apply_side_effects (l, f))), addresses)
% MainResolveResults
% ======================
% proof status:−)
subset_ptab_address_rw_addr : Lemma
Forall (base : Memory_Address_4G ) :
subset?(address_in_pt_range ?(s,
union(restrict[Address, Memory_Address_4G , bool](pm‘ro_addr),
restrict[Address, Memory_Address_4G , bool](pm‘rw_addr))),
restrict[Address, Memory_Address_4G , bool](pm_phy‘rw_addr)) And
subset?(address_block(base, expt(2, pe_size)),
extend[Address, Memory_Address_4G , bool, FALSE]
(address_in_pt_range ?(s,
restrict[Address, Memory_Address_4G , bool]
(union(pm‘ro_addr, pm‘rw_addr)))))

Implies

subset?(address_block(base, expt(2, pe_size)), pm_phy‘rw_addr)

% proof status:−)
translate_transformer_invariant: Lemma
Forall (base : PTab_Address, lin_a: Memory_Address_4G ,
access : Memory_access, priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And

subset?(address_block(xlat_idx(lvl, base, lin_a), expt(2, pe_size)),
pm_phy‘rw_addr)

Implies

transformer_invariant?(pm‘states, singleton(expr_2_super (
translate(lvl, base, lin_a, access, priv))))
% proof status:−)
% translate_unchanged_pm_phy_except_pe_TCC1 : TCCObligation
% proof status:−)
% translate_unchanged_pm_phy_except_pe_TCC2 : TCCObligation
% proof status:−)
translate_unchanged_pm_phy_except_pe : Lemma
Forall (base : PTab_Address, lin_a: Memory_Address_4G ,
access : Memory_access, priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And
subset?(address_block(xlat_idx(lvl, base, lin_a), expt(2, pe_size)),
pm_phy‘rw_addr) And
(Forall (s : (pm‘states)) :
OK?(read_data(pm_phy, paging_data_type (lvl))
(xlat_idx(lvl, base, lin_a))(s))) And
(Forall (s1, s2 : (pm‘states)) :
set_reference(data(read_data(pm_phy, paging_data_type (lvl))
(xlat_idx(lvl, base, lin_a))(s1)), Write) =
set_reference(data(read_data(pm_phy, paging_data_type (lvl))
(xlat_idx(lvl, base, lin_a))(s2)), Write))

Implies

Let pe_addr= xlat_idx(lvl, base, lin_a) In
unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
singleton(expr_2_super (translate(lvl, base, lin_a, access, priv))),
difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr),
address_block(pe_addr, expt(2, pe_size))))
% proof status:−)
% translate_result_ok_TCC1 : TCCObligation
% proof status:−)
translate_result_ok: Lemma
Forall (s1, s2 : (pm‘states), base : PTab_Address,
lin_a: Memory_Address_4G , access : Memory_access,
priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And
pe_in_pt_range ?(s1, union(pm‘ro_addr, pm‘rw_addr), lvl)
(xlat_idx(lvl, base, lin_a)) And
OK?(translate(lvl, base, lin_a, access, priv)(s1))

Implies

OK?(translate(lvl, base, lin_a, access, priv)(s2))
% proof status:−)

% translate_result_as_read_TCC1 : TCCObligation
% proof status:−)
% translate_result_as_read_TCC2 : TCCObligation
% proof status:−)
translate_result_as_read : Lemma
Forall (base : PTab_Address, lin_a: Memory_Address_4G ,
access : Memory_access, priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And
OK?(translate(lvl, base, lin_a, access, priv)(s))

Implies

Let res = read_data(pm_phy, paging_data_type (lvl))
(xlat_idx(lvl, base, lin_a))(s) In
data(translate(lvl, base, lin_a, access, priv)(s)) =
(is_leaf?(data(res)), base(data(res)))
% proof status:−)
translate_same_result: Lemma
Forall (s1, s2 : (pm‘states), base : PTab_Address,
lin_a: Memory_Address_4G , ac1, ac2 : Memory_access,
priv : Memory_privilege) :
union(pm‘ro_addr, pm‘rw_addr)(lin_a) And
is_linear_plain_memory ?(pm) And
pe_in_pt_range ?(s1, union(pm‘ro_addr, pm‘rw_addr), lvl)
(xlat_idx(lvl, base, lin_a)) And
OK?(translate(lvl, base, lin_a, ac1, priv)(s1)) And
OK?(translate(lvl, base, lin_a, ac2, priv)(s2))

Implies

data(translate(lvl, base, lin_a, ac1, priv)(s1)) =
data(translate(lvl, base, lin_a, ac2, priv)(s2))
% proof status:−)
% xlat_pe_in_pdir_range_TCC1 : TCCObligation
% proof status:−)
% xlat_pe_in_pdir_range_TCC2 : TCCObligation
% proof status:−)
% xlat_pe_in_pdir_range_TCC3 : TCCObligation
% proof status:−)
xlat_pe_in_pdir_range : Lemma
Forall (addr : Memory_Address_4G , s1, s2 : Linear_memory) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s1) And pm‘states(s2)

Implies

pe_in_pdir_range ?(s1, union(pm‘ro_addr, pm‘rw_addr))
(xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type )
(PDBR)(s2))‘base_addr, addr))

% proof status:−)
% xlat_pe_in_pt_range_TCC1 : TCCObligation
% proof status:−)
% xlat_pe_in_pt_range_TCC2 : TCCObligation
% proof status:−)
% xlat_pe_in_pt_range_TCC3 : TCCObligation
% proof status:−)
% xlat_pe_in_pt_range_TCC4 : TCCObligation
% proof status:−)
% xlat_pe_in_pt_range_TCC5 : TCCObligation
% proof status:−)
xlat_pe_in_pt_range : Lemma
Forall (addr : Memory_Address_4G , access : Memory_access,
priv : Memory_privilege, s1, s2 : Linear_memory) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s1) And pm‘states(s2) And
OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type )
(PDBR)(s1))‘base_addr, addr, access, priv)
(state(read_data(pm_phy, pdbr_data_type )(PDBR)(s1)))) And
Not data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type )
(PDBR)(s1))‘base_addr, addr, access, priv)
(state(read_data(pm_phy, pdbr_data_type )(PDBR)(s1))))‘1

Implies

pe_in_pt_range ?(s2, union(pm‘ro_addr, pm‘rw_addr), ptab_lvl)
(xlat_idx(ptab_lvl, data(translate(pdir_lvl,
data(read_data(pm_phy, pdbr_data_type )
(PDBR)(s1))‘base_addr, addr, access, priv)
(state(read_data(pm_phy, pdbr_data_type )(PDBR)(s1))))‘2, addr))
% proof status:−)
linear_resolve_unchanged_pm_phy : Lemma
Forall (addr : Memory_Address_4G , access : Memory_access) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s)

Implies

unchanged_memory_invariant ?[Physical_memory](pm_phy‘mem, pm‘states,
singleton(expr_2_super [Physical_memory, Address](
linear_resolve(addr, access))),
difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr),
address_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr))))
% proof status:−)
linear_resolve_read_transformers_ok : Lemma
Forall (addr : Memory_Address_4G ) :

is_linear_plain_memory ?(pm) And
union(pm‘ro_addr, pm‘rw_addr)(addr)

Implies

transformers_ok?(pm‘states, singleton(expr_2_super (
linear_resolve(addr, Read))))
% proof status:−)
linear_resolve_write_transformers_ok : Lemma
Forall (addr : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) And
pm‘rw_addr(addr)

Implies

transformers_ok?(pm‘states, singleton(expr_2_super (
linear_resolve(addr, Write))))
% proof status:−)
linear_resolve_transformer_invariant : Lemma
Forall (addr : Memory_Address_4G , access : Memory_access) :
is_linear_plain_memory ?(pm) And
union(pm‘ro_addr, pm‘rw_addr)(addr)

Implies

transformer_invariant?(pm‘states, singleton(expr_2_super (
linear_resolve(addr, access))))
% proof status:−)
% linear_resolve_states_TCC1 : TCCObligation
% proof status:−)
linear_resolve_states: Lemma
Forall (addr : Memory_Address_4G , access : Memory_access) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s) And
OK?(linear_resolve(addr, access)(s))

Implies

pm_phy‘states(state(linear_resolve(addr, access)(s)))
% proof status:−)
linear_resolve_same_result : Lemma
Forall (addr : Memory_Address_4G , ac1, ac2 : Memory_access,
s1, s2 : Linear_memory) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
is_linear_plain_memory ?(pm) And
pm‘states(s1) And pm‘states(s2) And
OK?(linear_resolve(addr, ac1)(s1)) And
OK?(linear_resolve(addr, ac2)(s2))

Implies

data(linear_resolve(addr, ac1)(s1)) =
data(linear_resolve(addr, ac2)(s2))
% Translationof addresseswithinsame page
% ===========================================

% proof status:−)
delta_memory_address: Lemma
Forall (addr : Memory_Address_4G , delta : nat) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page)

Implies

offset(addr + delta) < max_linear_offset
% proof status:−)
% xlat_idx_same_page_address_TCC1 : TCCObligation
% proof status:−)
% xlat_idx_same_page_address_TCC2 : TCCObligation
% proof status:−)
xlat_idx_same_page_address : Lemma
Forall (addr : Memory_Address_4G , delta : nat, lvl : Level,
base : {a : Memory_Address_4G|
aligned?(bits_per_level+ pe_size)(offset(a))}) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page)

Implies

xlat_idx(lvl, base, addr) = xlat_idx(lvl, base, addr + delta)
% proof status:−)
% xlat_ofs_same_page_address_TCC1 : TCCObligation
% proof status:−)
% xlat_ofs_same_page_address_TCC2 : TCCObligation
% proof status:−)
xlat_ofs_same_page_address : Lemma
Forall (addr : Memory_Address_4G , delta : nat, lvl : Level,
base : {a : Memory_Address_4G| aligned?(bus_width− (lvl + 1) ∗
bits_per_level )(offset(a))}) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page)

Implies

xlat_ofs(lvl, base, addr) + delta = xlat_ofs(lvl, base, addr + delta)
% proof status:−)
translate_same_page_address_ok : Lemma
Forall (addr : Memory_Address_4G , delta : nat, lvl : Level,
base : {a : Memory_Address_4G|
aligned?(bits_per_level+ pe_size)(offset(a))},
access : Memory_access, priv : Memory_privilege) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page) And
OK?(translate(lvl, base, addr, access, priv)(s))

Implies

OK?(translate(lvl, base, addr + delta, access, priv)(s))
% proof status:−)
translate_same_page_address_result : Lemma
Forall (addr : Memory_Address_4G , delta : nat, lvl : Level,

base : {a : Memory_Address_4G|
aligned?(bits_per_level+ pe_size)(offset(a))},
access : Memory_access, priv : Memory_privilege) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page) And
OK?(translate(lvl, base, addr, access, priv)(s))

Implies

translate(lvl, base, addr, access, priv)(s) =
translate(lvl, base, addr + delta, access, priv)(s)
% proof status:−)
% linear_resolve_same_page_address_ok_TCC1 : TCCObligation
% proof status:−)
linear_resolve_same_page_address_ok : Lemma
Forall (addr : Memory_Address_4G , delta : nat, ac : Memory_access) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page) And
OK?(linear_resolve(addr, ac)(s))

Implies

OK?(linear_resolve(addr + delta, ac)(s))
% proof status:−)
% linear_resolve_same_page_address_TCC1 : TCCObligation
% proof status:−)
linear_resolve_same_page_address : Lemma
Forall (addr : Memory_Address_4G , delta : nat, ac : Memory_access) :
rem(expt(2, min_page))(offset(addr)) + delta < expt(2, min_page) And
OK?(linear_resolve(addr, ac)(s))

Implies

data(linear_resolve(addr, ac)(s)) + delta =
data(linear_resolve(addr + delta, ac)(s))
% LinearMemorySide Effects
% ============================
% proof status:−)
address_block_split_type : Lemma
Forall (a : Memory_Address_4G , bl : list[Byte]) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr))

Implies

every(LAMBDA (t: [Address, list[Byte]]): Mem?(t‘1‘type_of) AND
0 <= t‘1‘offset And
t‘1‘offset < max_linear_offset )
(split(min_page, a, bl))

% proof status:−)
% same_page_address_block_read_TCC1 : TCCObligation
% proof status:−)
same_page_address_block_read : Lemma

Forall (a1, a2 : Memory_Address_4G , s1, s2 : posnat) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(a2) And
a1 <= a2 And a2 + s2 <= a1 + s1 And
rem(expt(2, min_page))(offset(a2)) + s2 <= expt(2, min_page) And
subset?(address_block(a1, s1), union(pm‘ro_addr, pm‘rw_addr))

Implies

subset?(address_block(data(linear_resolve(a2, Read)(s)), s2),
union(pm_phy‘ro_addr, pm_phy‘rw_addr))
% proof status:−)
% same_page_address_block_write_TCC1 : TCCObligation
% proof status:−)
same_page_address_block_write : Lemma
Forall (a1, a2 : Memory_Address_4G , s1, s2 : posnat) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
pm‘rw_addr(a2) And
a1 <= a2 And a2 + s2 <= a1 + s1 And
rem(expt(2, min_page))(offset(a2)) + s2 <= expt(2, min_page) And
subset?(address_block(a1, s1), pm‘rw_addr)

Implies

subset?(address_block(data(linear_resolve(a2, Write)(s)), s2),
pm_phy‘rw_addr)
% proof status:−)
% split_linear_read_side_effects_states_TCC1 : TCCObligation
% proof status:−)
split_linear_read_side_effects_states : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr))

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states,
singleton(expr_2_super (linear_read_side_effect_in_page (e)))))
(split(min_page, a, bl))
% proof status:−)
% split_linear_write_side_effects_states_TCC1 : TCCObligation
% proof status:−)
split_linear_write_side_effects_states : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), pm‘rw_addr)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
transformer_invariant?(pm‘states,

singleton(expr_2_super (linear_write_side_effect_in_page (e)))))
(split(min_page, a, bl))
% proof status:−)
split_linear_read_side_effects_ok : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)),
union(pm‘ro_addr, pm‘rw_addr)) And
pm‘states(s)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(linear_read_side_effect_in_page (e)(s)))
(split(min_page, a, bl))
% proof status:−)
split_linear_write_side_effects_ok : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), pm‘rw_addr) And
pm‘states(s)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(linear_write_side_effect_in_page (e)(s)))
(split(min_page, a, bl))
% proof status:−)
split_linear_read_side_effects_data : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)),
union(pm‘ro_addr, pm‘rw_addr)) And
pm‘states(s)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(linear_read_side_effect_in_page (e)(s)) Implies
data(linear_read_side_effect_in_page (e)(s)) = e‘2)
(split(min_page, a, bl))
% proof status:−)
split_linear_write_side_effects_data : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), pm‘rw_addr) And
pm‘states(s)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
OK?(linear_write_side_effect_in_page (e)(s)) Implies
data(linear_write_side_effect_in_page (e)(s)) = e‘2)
(split(min_page, a, bl))
% proof status:−)

split_linear_read_side_effects_unchanged_memory : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr))

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
unchanged_memory_invariant ?(pm_phy‘mem, pm‘states,
singleton(expr_2_super (linear_read_side_effect_in_page (e))),
union(pm_phy‘ro_addr, pm_phy‘rw_addr)))
(split(min_page, a, bl))
% proof status:−)
split_linear_write_side_effects_unchanged_memory : Lemma
Forall (a : Memory_Address_4G , bl : (cons?[Byte])) :
is_linear_plain_memory ?(pm) And
subset?(address_block(a, length(bl)), pm‘rw_addr)

Implies

every(Lambda (e : [Memory_Address_4G , list[Byte]]) :
unchanged_memory_invariant ?(pm_phy‘mem, pm‘states,
singleton(expr_2_super (linear_write_side_effect_in_page (e))),
union(pm_phy‘ro_addr, pm_phy‘rw_addr)))
(split(min_page, a, bl))

% linear_unchanged_invariant
% ============================
% proof status:−)
linear_unchanged_invariant: Lemma
Forall (transformers : PRED[[Linear_memory−> SuperResult[Linear_memory]]],
addresses : PRED[Memory_Address_4G ]) :
is_linear_plain_memory ?(pm) And
subset?(addresses, union(pm‘ro_addr, pm‘rw_addr)) And
(Forall (s : (pm‘states)) :
unchanged_memory_invariant ?(pm_phy‘mem, pm_phy‘states,
transformers,
virt_to_phys_range (s, addresses, union(singleton(Read),
singleton(Execute)))))

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states, transformers, addresses)

% simplehelpersfor unchangedlemmas
% =====================================
% proof status:−)
% pm_phy_read_after_resolve_ok_TCC1 : TCCObligation
% proof status:−)
pm_phy_read_after_resolve_ok : Lemma

B.4 challenge-linear.pvs

Forall (a1 : Address, a2 : Memory_Address_4G , ac : Memory_access) :
OK?(linear_resolve(a2, ac)(s)) And
plain_memory?(pm_phy) And
pm_phy‘states(state(linear_resolve(a2, ac)(s))) And
union(pm_phy‘ro_addr, pm_phy‘rw_addr)(a1)

Implies

OK?(memory_read(pm_phy‘mem)(a1)(state(linear_resolve(a2, ac)(s))))
% proof status:−)
pm_resolve_address: Lemma
Forall (a : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
virt_to_phys_range (s, union(pm‘ro_addr, pm‘rw_addr),
union(singleton(Read), singleton(Execute)))(a)

Implies

difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr),
address_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr)))(a)
% proof status:−)
pm_resolve_address_write : Lemma
Forall (a : Memory_Address_4G ) :
is_linear_plain_memory ?(pm) And
pm‘states(s) And
virt_to_phys_range (s, pm‘rw_addr, singleton(Write))(a)

Implies

difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr),
address_in_pt_range ?(s, union(pm‘ro_addr, pm‘rw_addr)))(a)
End Linear_Memory_Properties

Linear_Memory_Blessing_Properties

[% the underlyingphysicalmemory
Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm_phy: Plain_Memory
] : Theory

Begin

Importing Linear_Memory_Properties [Physical_memory, pm_phy]
pm : Var Plain_Memory[Linear_memory]
% Blessingresults
% ==================
% proof status:−)
linear_plain_transformers_ok : Lemma
is_linear_plain_memory ?(pm)

Implies

transformers_ok?(pm‘states, union(union(
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)),
memory_write_transformers (pm‘mem, pm‘rw_addr)), union(
memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))))
% proof status:−)
linear_plain_unchanged_memory_invariant : Lemma
is_linear_plain_memory ?(pm)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
union(union(pm‘other_actions,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr))),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
linear_plain_unchanged_memory_invariant_write : Lemma
is_linear_plain_memory ?(pm)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_transformers (pm‘mem, pm‘rw_addr), pm‘ro_addr)

% proof status:−)
linear_plain_unchanged_memory_write_invariant : Lemma
is_linear_plain_memory ?(pm)

Implies

unchanged_memory_write_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% proof status:−)
linear_plain_transformer_invariant : Lemma
is_linear_plain_memory ?(pm)

Implies

transformer_invariant?(pm‘states, union(union(pm‘other_actions,
union(memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)),
memory_write_transformers (pm‘mem, pm‘rw_addr))),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))))
% proof status:−)
linear_plain_changed_memory_invariant : Lemma
is_linear_plain_memory ?(pm)

Implies

changed_memory_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% We must use expressiontransformersinsteadof supertransformers
% to match the list argumentof the side effect transformerin

B.5 challenge-phymem.pvs

% side_effect_content_unchangedagainstthe transformerobtained
% from the unionof memoryside effect transformers. Super
% transformersgive us onlyequalityon resultstates.
% proof status:−)
linear_plain_read_side_effect_unchanged : Lemma
is_linear_plain_memory ?(pm)

Implies

side_effect_content_unchanged (union(pm‘ro_addr, pm‘rw_addr), pm‘states,
memory_read_side_effect (pm‘mem))
% proof status:−)
linear_plain_write_side_effect_unchanged : Lemma
is_linear_plain_memory ?(pm)

Implies

side_effect_content_unchanged (pm‘rw_addr, pm‘states,
memory_write_side_effect (pm‘mem))
% %%%% FinalBlessingResult%%%%%
% proof status:−)
linear_memory_plain_memory : Lemma
is_linear_plain_memory ?(pm)
Implies plain_memory?(pm)
End Linear_Memory_Blessing_Properties

B.5 challenge-phymem.pvs

Phy_Mem_Properties [(IMPORTING IA32) min, max : Memory_Address] : Theory
% Propertiesof physicalmemory

Begin

IMPORTING Memory_Physical_Memory [min, max], Memory_Change_2
IMPORTING Physical_Memory_Properties [min, max]
addr : Var Address
s : Var Physical_memory
% proof status:−)
phy_mem_write_transformers_ok : Lemma
transformers_ok?(fullset[Physical_memory],
memory_write_transformers (phy_mem, in_memory(min, max)))
% proof status:−)
phy_mem_read_transformers_ok : Lemma
transformers_ok?(fullset[Physical_memory],
memory_read_transformers (phy_mem, in_memory(min, max)))
% proof status:−)
phy_mem_read_side_effects_transformers_ok : Lemma
transformers_ok?(fullset[Physical_memory],
memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)))

B PVS Theory Sources

% proof status:−)
phy_mem_write_side_effects_transformers_ok : Lemma
transformers_ok?(fullset[Physical_memory],
memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)))
% proof status:−)
phy_mem_unchanged_memory_invariant_read_transformers : Lemma
unchanged_memory_invariant ?(phy_mem, fullset[Physical_memory],
memory_read_transformers (phy_mem, in_memory(min, max)),
in_memory(min, max))
% proof status:−)
phy_mem_unchanged_memory_invariant_read_side_effect_transformers : Lemma
unchanged_memory_invariant ?(phy_mem, fullset[Physical_memory],
memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)),
in_memory(min, max))
% proof status:−)
phy_mem_unchanged_memory_invariant_write_side_effect_transformers : Lemma
unchanged_memory_invariant ?(phy_mem, fullset[Physical_memory],
memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)),
in_memory(min, max))
% proof status:−)
phy_mem_unchanged_memory_write_invariant : Lemma
unchanged_memory_write_invariant ?(phy_mem, fullset[Physical_memory],
in_memory(min, max))
% proof status:−)
phy_mem_changed_memory_invariant : Lemma
changed_memory_invariant ?(phy_mem, fullset[Physical_memory],
in_memory(min, max))
End Phy_Mem_Properties
Phy_Mem_Blessing [(IMPORTING IA32) min, max : Memory_Address] : Theory
% all physicalmemoryis blessedmemory

Begin

Importing Phy_Mem_Properties [min, max], Plain_Memory
oact : Var PRED[[Physical_memory−>SuperResult[Physical_memory]]]
phy_pm(oact) : Plain_Memory[Physical_memory] = (#
mem := phy_mem,
states := fullset[Physical_memory],
ro_addr:= emptyset[Address],
rw_addr:= in_memory(min, max),
other_actions:= oact

#)

B.5 challenge-phymem.pvs

% proof status:−)
phy_mem_plain_memory : Lemma
unchanged_memory_invariant ?(phy_mem,
fullset[Physical_memory], oact, in_memory(min, max))

Implies

plain_memory?(phy_pm(oact))
End Phy_Mem_Blessing

Phy_Mem_Blessing_Data [Data : Type, (IMPORTING IA32) min, max : Memory_Address] : Theory

Begin

Importing Phy_Mem_Blessing [min, max], Abstract_Read_Write
addr : Var Address
idt : Var (interpreted_data_type ?[Data])
% proof status:−)
in_memory_blessed_memory : Lemma
in_memory?(idt, addr, min, max) Implies
in_blessed_memory ?(idt, addr, in_memory(min, max))
End Phy_Mem_Blessing_Data

Phy_Mem_Challenge_Read_Same

[Data : Type, (IMPORTING IA32) min, max : Memory_Address] : Theory

%

% read after writeat the same place returnsthe item written

Begin

IMPORTING Phy_Mem_Blessing [min, max],
Plain_Mem_Properties_2 [Physical_memory, Data],
Phy_Mem_Blessing_Data [Data, min, max]
dt : Var (interpreted_data_type ?[Data])
s : Var Physical_memory
addr : Var Address
data : Var Data

% proof status:−)
read_write_ok: Lemma in_memory?(dt, addr, min, max)

IMPLIES

OK?((
write_data(phy_mem,dt)(addr, data) ##
read_data(phy_mem,dt)(addr)
)(s)

)

% proof status:−)

% read_write_res_TCC1 : TCCObligation
% proof status:−)
read_write_res: Lemma in_memory?(dt, addr, min, max)

IMPLIES

data((
write_data(phy_mem,dt)(addr, data) ##
read_data(phy_mem,dt)(addr)
)(s))
= data
end Phy_Mem_Challenge_Read_Same

Phy_Mem_Challenge_Read_Other

[(IMPORTING IA32) min, max : Memory_Address, Data1, Data2 : Type] : Theory
% Phy_Mem_Challenge_Read_Other : Theory

%

% for read after writeat a differentplace you can discardthe write

% Begin

IMPORTING Phy_Mem_Blessing [min, max],
Plain_Mem_Properties_3 [Physical_memory, Data1, Data2],

Phy_Mem_Blessing_Data

dt1 : Var (interpreted_data_type ?[Data1])
dt2 : Var (interpreted_data_type ?[Data2])
s : Var Physical_memory
addr1, addr2 : Var Address
data1 : Var Data1
% proof status:−)
read_write_other_ok : Lemma
in_memory?(dt1, addr1, min, max) AND
in_memory?(dt2, addr2, min, max) AND
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) AND
valid_in_mem (phy_mem,dt2)(addr2)(s)

IMPLIES

OK?

((

write_data(phy_mem,dt1)(addr1, data1) ##
read_data(phy_mem,dt2)(addr2)
)(s)

)

% proof status:−)
% read_write_other_res_TCC1 : TCCObligation
% proof status:−)
% read_write_other_res_TCC2 : TCCObligation
% proof status:−)

B.6 challenge-ptab-sync-master.pvs

read_write_other_res : Lemma
in_memory?(dt1, addr1, min, max) AND
in_memory?(dt2, addr2, min, max) AND
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) AND
valid_in_mem (phy_mem,dt2)(addr2)(s)

IMPLIES

data((
write_data(phy_mem,dt1)(addr1, data1) ##
read_data(phy_mem,dt2)(addr2)
)(s))

=

data(read_data(phy_mem,dt2)(addr2)(s))
% proof status:−)
read_read_ok: Lemma
in_memory?(dt1, addr1, min, max) AND
in_memory?(dt2, addr2, min, max) AND
valid_in_mem (phy_mem,dt1)(addr1)(s) And
valid_in_mem (phy_mem,dt2)(addr2)(s)

Implies

OK?(
( read_data(phy_mem, dt1)(addr1) ##
read_data(phy_mem, dt2)(addr2)
)(s)

)

% proof status:−)
% read_read_TCC1: TCCObligation
% proof status:−)
% read_read_TCC2: TCCObligation
% proof status:−)
read_read: Lemma
in_memory?(dt1, addr1, min, max) AND
in_memory?(dt2, addr2, min, max) AND
valid_in_mem (phy_mem,dt1)(addr1)(s) And
valid_in_mem (phy_mem,dt2)(addr2)(s)

Implies

data (
( read_data(phy_mem, dt1)(addr1) ##
read_data(phy_mem, dt2)(addr2)
)(s)

)

= data(read_data(phy_mem, dt2)(addr2)(s))
End Phy_Mem_Challenge_Read_Other

B.6 challenge-ptab-sync-master.pvs

Challenge_Ptab_Sync_Master : Theory

Begin

Importing ptab_sync_master
% to do: specificationand proofs
End Challenge_Ptab_Sync_Master

B.7 constants.pvs

% generalconstantsand types
% (includingarchitecturedependentones)
General : Theory
% architectureindependentconstantsand types

Begin

Importing Number_Props
bits_per_byte: posnat
min_bits_per_byte : nat = 8
bits_per_byte_minimum : Axiom bits_per_byte>= min_bits_per_byte
max_byte: nat = expt(2, bits_per_byte )
% proof status:−)
% Byte_TCC1: TCCObligation
Byte : Nonempty_Type = below(max_byte) containing 0
% proof status:−)
less_than_max_byte : Lemma Forall(n : nat) :
n < expt(2, 8) Implies n < max_byte
End General

Register_Id: Datatype

Begin

Mem_: Mem?
EAX_: EAX?
EBX_: EBX?
ECX_: ECX?
EDX_: EDX?
ESI_: ESI?
EDI_: EDI?
ESP_: ESP?
EBP_: EBP?

B.7 constants.pvs

CS_: CS?
DS_: DS?
ES_: ES?
FS_: FS?
GS_: GS?
SS_: SS?
IP_: IP?
EFLAGS_: EFLAGS?
CR0_: CR0?
CR2_: CR2?
PDBR_: PDBR?
CR4_: CR4?
IDTR_: IDTR?
GDTR_: GDTR?
LDTR_: LDTR?
TR_: TR?
SYSENTER_CS_: SYSENTER_CS?
SYSENTER_ESP_: SYSENTER_ESP?
SYSENTER_EIP_: SYSENTER_EIP?
End Register_Id

Address_Helpers: Theory

Begin

Importing General, Register_Id
Address : Type = [# type_of: Register_Id, offset : int #]
% AddressConstructors
Mem(offset : int) : Address = (# type_of:= Mem_, offset := offset #)
CR0 : Address = (# type_of:= CR0_, offset := 0 #)
CR2 : Address = (# type_of:= CR2_, offset := 0 #)
CR4 : Address = (# type_of:= CR4_, offset := 0 #)
PDBR : Address = (# type_of:= PDBR_, offset := 0 #)
CS : Address = (# type_of:= CS_, offset := 0 #)
DS : Address = (# type_of:= DS_, offset := 0 #)
ES : Address = (# type_of:= ES_, offset := 0 #)
FS : Address = (# type_of:= FS_, offset := 0 #)
GS : Address = (# type_of:= GS_, offset := 0 #)
SS : Address = (# type_of:= SS_, offset := 0 #)
Segment_Register_Address: Type =
{a : Address | a = CS Or a = DS Or a = ES Or a = FS Or a = GS Or a = SS}

Memory_Address: Type = {a : Address | Mem?(a‘type_of)}
a : Var Address
size : Var int
+(a, size) : Address = a With [(offset) := a‘offset + size]
m_addr: Var Memory_Address
% proof status:−)
type_add_rewrite: Lemma
(m_addr+ size)‘type_of= m_addr‘type_of
% proof status:−)
offset_add_rewrite: Lemma
(m_addr+ size)‘offset = m_addr‘offset + size
% proof status:−)
type_add_memory: Judgement +(m_addr, size) Has_TypeMemory_Address
% proof status:−)
address_add_zero: Lemma
Forall (a : Address) : a + 0 = a
% proof status:−)
address_add_sum: Lemma
Forall (a : Address, i, j : int) : (a + i) + j = a + (i + j)
a1, a2 : Var Address
< (a1, a2) : bool = a1‘type_of= a2‘type_ofAnd a1‘offset < a2‘offset;
<= (a1, a2) : bool = a1‘type_of= a2‘type_ofAnd a1‘offset <= a2‘offset
% Some registergroups
GP?(id: Register_Id) : bool =
EAX?(id) Or EBX?(id) Or ECX?(id) Or EDX?(id) Or ESI?(id) Or
EDI?(id) Or EBP?(id) Or ESP?(id)
Segment_Reg?(id : Register_Id) : bool =
CS?(id) Or DS?(id) Or ES?(id) Or FS?(id) Or GS?(id) Or SS?(id)
Control_Reg?(id : Register_Id) : bool =
CR0?(id) Or CR2?(id) Or CR4?(id) Or PDBR?(id)
Table_Reg?(id : Register_Id) : bool =
IDTR?(id) Or GDTR?(id) Or LDTR?(id) Or TR?(id)
MSR?(id : Register_Id) : bool =
SYSENTER_CS?(id) Or SYSENTER_ESP?(id) Or SYSENTER_EIP?(id)

B.7 constants.pvs

% Registersizes
% proof status:−)
% reg_size_TCC1: TCCObligation
% proof status:−)
% reg_size_TCC2: TCCObligation
reg_size(max : Memory_Address)(id : Register_Id) : Address =
Cases id Of
Mem_: (# type_of:= id, offset := offset(max) #),
IP_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
EFLAGS_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
IDTR_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 8) #),
GDTR_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 8) #),
LDTR_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 14) #),
TR_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 14) #),
SYSENTER_CS_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
SYSENTER_ESP_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
SYSENTER_EIP_: (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #)

Else

Cond

GP?(id) −> (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #),
Segment_Reg?(id) −> (# type_of:= id, offset := expt(2, bits_per_byte∗ 14) #),
Control_Reg?(id) −> (# type_of:= id, offset := expt(2, bits_per_byte∗ 4) #)

EndCond EndCases

reg_base(min : Memory_Address)(id : Register_Id) : Address =
If Mem?(id) Then

min Else

(# type_of:= id, offset := 0 #)

Endif

in_memory(min, max : Memory_Address)(a : Address) : bool =
reg_base(min)(a‘type_of) <= a And a < reg_size(max)(a‘type_of)
floor(b : posnat)(a : Address) : Address =
a With [(offset) := floor(b)(offset(a))]
End Address_Helpers

IA32 : Theory
% architecturedependentconstantsand types

Begin

IMPORTING Address_Helpers

% typeof addressesas subtypeof naturalnumbers
bus_width: nat = 32
max_linear_offset: nat = expt(2, bus_width)
max_linear: Address = Mem(max_linear_offset )
min_linear: Address = Mem(0)
% proof status:−)
max_linear_offset_val : Lemma max_linear_offset= 4294967296
% max_linear_expt_val : Lemmaoffset(max_linear) = expt(2, 32)

% memoryaddressesbelow 2^32, for those who need it
Memory_Address_4G: Type = {a : Memory_Address| 0 <= a‘offset And a‘offset < max_linear_offset }
% proof status:−)
% mem_addr_4g_TCC1: TCCObligation
mem_addr_4g (R : PRED[(in_memory(min_linear, max_linear))])(a : Memory_Address_4G ) : bool = R(a)
% smallestpage size
min_page: posnat = 12
AUTO_REWRITE− bus_width, max_linear, max_linear_offset_val
End IA32

B.8 conversions.pvs

% $Id: conversions.pvs,v 1.11.4.2.2.1.2.3 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber
% (c) 2007 RadboudUniversity

%

% A shallowembeddingof (some) C++ conversionsas state transformers.
% Section numbersin commentsthroughoutthis file refer to
% "Programminglanguages− C++", ISO/IEC14882:1998(E)
% Deviationsfrom the C++ standard:

%

% Thisis preliminarywork. Most of the standardhasn’t even been considered
% yet.
% A note on PVS conversions: PVS has conversionsas well. Shouldwe declare
% the C++ conversionfunctionsas PVS conversions, so that theyare applied
% automatically, based on typeinformation? We have decidedagainstdoing so
% for the followingreasons. 1) Explicitconversionsmake the PVS translation
% of C++ code less readable, but the translatedcode is of littleinterest.
% Whatreallymattersis the proof state, whichnecessarilycontainsthe

B.8 conversions.pvs

% conversionsanyway. 2) Explicitconversionsgive us more control. It is not
% quite clear (to me, anyway) how the PVS typechecker decides which
% conversionsmust be applied, and in whichorder. 3) Some C++ conversions
% requireadditionalinformation(e.g. the lvalue−to−rvalueconversionmust
% know the typeof the stored value), and must thereforebe made explicit
% anyway.
% Namingconvention: conversionsbetweendifferenttypesare named
% < source>2< dest>
% where < source> and < dest> are the source and destinationtype, respectively, as
% givenin types.pvs. Examples: bool2int, int2uint.
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 4.1: Lvalueto rvalueconversion

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
LvalueToRvalueConversion[State, Data : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain
pm : VAR Plain_Memory[State]
dt : VAR (interpreted_data_type ?[Data])
s : VAR State
a_ex: VAR [State −> ExprResult[State, Address]]
% MV>> do we need l2r for non−fundamentaltypes??
% 4.1.2: l2r(class) returnsan rvalueto a copy initialisedtemporary
l2r(pm, dt)(a_ex) : [State −> ExprResult[State, Data]] =

(

a_ex## lambda (a : Address):
read_data(pm, dt)(a) ## lambda (d : Data):
ok_result(d)

)

% MV>>
% l2r_class(pm, copy_constructor)(a_ex) : ET[State, Data]
% with_new_stackvar ()(lambda(temporary: Address) :
% copy_constructor(temporary, a_ex)
% XXX
% MV>>
% It seems like we could restrictData in ET[.., Data] to fundamentaltypes;
% Forclasses it seems the standardrequiresan in place creationor temporariesand the
% onlythingto do witha class is to access a member.
END LvalueToRvalueConversion

% MV:>> make promotionsand conversionspolymorphicover the fundamentaltypes

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 4.5: Integralpromotions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
IntegralPromotions[State : Type] : THEORY

BEGIN

IMPORTING Cpp_Types, Ok_Result_Rewrite
% 4.5(1)
% "An rvalueof typechar [...]can be convertedto an rvalueof typeint if
% int can representall the valuesof the source type; otherwise, the source
% rvaluecan be convertedto an rvalueof typeunsignedint."
% We take this to mean that in the formercase, the valueis not changed.
% TODO: I have no idea how to model this correctly, for the ∗type∗ of the
% conversionwoulddependon the condition. Also, I’m not sure what
% shouldhappento source rvalueswhen int cannot representall the
% valuesof the source type, and unsignedint cannot representthe
% particularrvalue. Below, onlythe firstalternative(conversionto
% int) is modeled. However, 4.7(3) specifiesthe behaviorof conversions
% to int when those conversionsare ∗not∗ availableas integral
% promotions. To sum up, we can ∗always∗ convertto int; the behavioris
% specifiedeitherby 4.5 or by 4.7. Likewise, we can alwaysconvertto
% unsignedint; this is modeledin theoryIntegralConversionsbelow.
% char2int
% schar2int
% uchar2int
% short2int
% ushort2int
typ : Var Cpp_Subtype(cv({t : Cpp_Type| char?(t) Or schar?(t) Or uchar?(t) Or
short?(t) Or ushort?(t)}))
% proof status:−)
% int_conversion_TCC1: TCCObligation
% proof status:−)
% int_conversion_TCC2: TCCObligation
% proof status:−)
% int_conversion_TCC3: TCCObligation
int_conversion(typ) : [(range(typ)) −> (range(int))]

% proof status:−)
% int_conversion_spec_TCC1 : TCCObligation
int_conversion_spec: AXIOM
forall (n : (range(typ))) :
% 4.5(1) / 4.7(3)
range(int)(n) Implies int_conversion(typ)(n) = n
% 4.7(3): otherwiseconversionis allowed, but the valueis
% implementation−defined
int_conversion(typ)(n_ex: ET[State, (range(typ))]) : ET[State, (range(int))] =

(

n_ex## lambda (n : (range(typ))) :
ok_result(int_conversion(typ)(n))

)

i_typ: Var Cpp_Subtype(cv(non_bool_integral_enum ?))
% range to PVS int
range_to_int (i_typ)(n_ex: ET[State, (range(i_typ))]) : ET[State, int] =

(

n_ex## lambda (n : (range(i_typ))) :
ok_result(n)

)

% PVS int to range
int_to_range (i_typ)(n_ex: ET[State, int]) : ET[State, (range(i_typ))] =

(

n_ex## lambda (n : int) :
If range(i_typ)(n) Then
ok_result(n)

Else

fatal_result Endif

)

% 4.5(2): TODO(wchar_t, enumerationtypes)
% 4.5(3): TODO(bit−fields)
% 4.5(4)
bool_ex: VAR ET[State, bool]
% proof status:−)
% bool2int_TCC1: TCCObligation
% proof status:−)
% bool2int_TCC2: TCCObligation
bool2int(bool_ex) : ET[State, (range(int))] =

B PVS Theory Sources

(

bool_ex## lambda (b : bool) :
ok_result(if b then 1 else 0 endif)

)

END IntegralPromotions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 4.7: Integralconversions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
IntegralConversions[State : Type] : THEORY

BEGIN

IMPORTING Cpp_Types, Ok_Result_Rewrite
% 4.7(1): "An rvalueof an integertypecan be convertedto an rvalueof
% anotherintegertype."
% The integertypesare bool, char, wchar_t, (signed/unsigned) char,
% (signed/unsigned) short, (signed/unsigned) int, (signed/unsigned) long
% (3.9.1(7)).
% bool_ex: VAR[State −> ExprResult[State, Semantics_bool]]
% char_ex: VAR[State −> ExprResult[State, Semantics_char]]
% wchar_t_ex: VAR[State −> ExprResult[State, Semantics_wchar_t ]]
% schar_ex: VAR[State −> ExprResult[State, Semantics_schar]]
% uchar_ex: VAR[State −> ExprResult[State, Semantics_uchar]]
% short_ex: VAR[State −> ExprResult[State, Semantics_short]]
% ushort_ex: VAR[State −> ExprResult[State, Semantics_ushort]]
% int_ex: VAR[State −> ExprResult[State, Semantics_int]]
% uint_ex: VAR[State −> ExprResult[State, Semantics_uint]]
% long_ex: VAR[State −> ExprResult[State, Semantics_long]]
% ulong_ex: VAR[State −> ExprResult[State, Semantics_ulong]]
% %%%%%%%%%%
% Conversionsto bool: see 4.12
% %%%%%%%%%%
% %%%%%%%%%%
% Conversionsto char
% %%%%%%%%%%
% bool2char(bool_ex) : [State −> ExprResult[State, Semantics_char]]=
% (
% bool_ex## lambda(b : Semantics_bool):
% ok_result(if b then 1 else 0 endif)
% )

% TODO: wchar_t2char
% TODO: schar2char
% TODO: uchar2char
% TODO: short2char
% TODO: ushort2char
% TODO: int2char
% TODO: uint2char
% TODO: long2char
% TODO: ulong2char
% %%%%%%%%%%
% Conversionsto wchar_t
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto schar
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto uchar
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto short
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto ushort
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto int
% %%%%%%%%%%
% 4.7(5): "The conversionsallowedas integralpromotionsare excludedfrom the
% set of integralconversions."TheoryIntegralPromotionsshouldtherefore
% containmost of the necessarydefinitionsalready.
% TODO: long2int
% TODO: ulong2int
% %%%%%%%%%%

% Conversionsto uint
% %%%%%%%%%%
% bool2uint(bool_ex) : [State −> ExprResult[State, Semantics_uint]]=
% (
% bool_ex## lambda(b : Semantics_bool):
% ok_result(if b then 1 else 0 endif)
% )
% TODO: wchar_t2uint
% TODO: schar2uint
% TODO: uchar2uint
% TODO: short2uint
% TODO: ushort2uint
% int2uint(int_ex) : [State −> ExprResult[State, Semantics_uint]]=
% (
% int_ex## lambda(i : Semantics_int):
% ok_result(mod(i, max_value(uint))) % 4.7(2)
% )
% TODO: long2uint
% TODO: ulong2uint
% %%%%%%%%%%
% Conversionsto long
% %%%%%%%%%%
% TODO
% %%%%%%%%%%
% Conversionsto ulong
% %%%%%%%%%%
% TODO
END IntegralConversions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 4.12: Booleanconversions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
BooleanConversions[State : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain , Cpp_Types
s : VAR State

B.9 cpp-examples.pvs

% TODO: there shouldprobablybe separateconversionsfor everyarithmetic
% and pointertype
integral_to_bool (i_typ: Cpp_Subtype(cv(non_bool_integral_enum ?)))
(n_ex: ET[State, (range(i_typ))]) : ET[State, bool] =

(

n_ex## lambda (n : (range(i_typ))) :
ok_result(not (n = 0))

)

% To do: floating_point_to_bool
% proof status:−)
% pointer_to_bool_TCC1: TCCObligation
pointer_to_bool (p_typ: Cpp_Subtype(cv(pointer?)))
(p_ex: ET[State, (range_pointer(cv_base(p_typ)))]) : ET[State, bool] =

(

p_ex## lambda (ptr_val: (range_pointer(cv_base(p_typ)))) :
ok_result(not_null?(p_typ)(ptr_val))

)

END BooleanConversions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% TODO: other conversions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Conversions: importseverything

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Conversions[State : Type] : THEORY

BEGIN

IMPORTING LvalueToRvalueConversion,
IntegralPromotions,
IntegralConversions,

BooleanConversions

END Conversions

B.9 cpp-examples.pvs

% $Id: cpp−examples.pvs,v 1.26.6.2.2.4.2.2 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber, MarcusVölp
% (c) 2007 RadboudUniversity

%

% Some (rathersimple) C++ programsand ((not yet) automatic) verification
% proofs.
Cpp_Examples[State : Type] : THEORY

BEGIN

IMPORTING Cpp_Verification[State]
STATES : PRED[State]
% skip
% proof status:−)
spec01 : LEMMA
Valid(STATES,
skip[State],
STATES)
pm : Plain_Memory[State]
a, b, c, n, m : Address
% proof status:−)
% PRECONDITION_TCC1 : TCCObligation
% proof status:−)
% PRECONDITION_TCC2 : TCCObligation
% proof status:−)
% PRECONDITION_TCC3 : TCCObligation
% proof status:−)
% PRECONDITION_TCC4 : TCCObligation
PRECONDITION : PRED[State] =
lambda (s : State):
pm‘states(s) and
in_blessed_memory ?(dt(int), n, pm‘rw_addr) and
in_blessed_memory ?(dt(int), m, pm‘rw_addr) and
in_blessed_memory ?(dt_bool, c, pm‘rw_addr) and
in_blessed_memory ?(dt(char), a, pm‘rw_addr) and
in_blessed_memory ?(dt(char), b, pm‘rw_addr) And
blocks_disjoint?(a, size_of(char), b, size_of(char)) And
blocks_disjoint?(b, size_of(char), a, size_of(char)) And
blocks_disjoint?(n, size_of(int), m, size_of(int)) And
blocks_disjoint?(m, size_of(int), n, size_of(int))
% proof status:−)
% POSTCONDITION_TCC1 : TCCObligation

B.9 cpp-examples.pvs

POSTCONDITION : PRED[State] =
lambda (s : State):
let ss = read_data(pm, dt(int))(n)(s) in
OK?(ss) and data(ss) = 42
% proof status:−)
% spec02_TCC1: TCCObligation
% a single assignment− partialcorrectness
% proof status:−)
spec02 : LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(int))(id(n), literal(42))),
POSTCONDITION)
% a single assignment− total correctness
% proof status:−)
spec03 : LEMMA
plain_memory?(pm) implies
Valid(PRECONDITION,
e2s(assign(pm, dt(int))(id(n), literal(42))),
POSTCONDITION)
% No disjointnessassumptionshouldbe necessaryfor this lemma.
% MV: Tjark: to removethe disjointnessassumptionwe need
% sizeof(char) = 1 and somethinglike:
% a /= b Andsizeof(dt) = 1 => block_disjoint(a, b) Andblock_disjoint(b, a)
% Do we reallyneed to check this automatically?
% proof status:−)
% spec04_TCC1: TCCObligation
% proof status:−)
% spec04_TCC2: TCCObligation
% two char assignments
% proof status:−)
spec04 : LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(char))(id(a), literal(42))) ##
e2s(assign(pm, dt(char))(id(b), literal(42))),
Lambda (s : State) : OK?(read_data(pm, dt(char))(a)(s)) And
data(read_data(pm, dt(char))(a)(s)) = 42)
% if−else
% proof status:−)
spec05: LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt_bool)(id(c), literal(true))) ##

if_else(l2r(pm, dt_bool)(id(c)),
e2s(assign(pm, dt(int))(id(n), literal(42))),
skip),
POSTCONDITION)
% proof status:−)
% spec06_TCC1: TCCObligation
% proof status:−)
% spec06_TCC2: TCCObligation
% proof status:−)
% spec06_TCC3: TCCObligation
% proof status:−)
% spec06_TCC4: TCCObligation
% a switchstatement(withseveralassignments)
% proof status:−)
spec06 : LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(char))(id(a), literal(0))) ##
e2s(assign(pm, dt(char))(id(b), literal(1))) ##
switch(l2r(pm, dt(char))(id(a)), (: 0, 1 :),
case(0) ##
skip ##
case(1) ##
e2s(assign(pm, dt(int))(id(n), literal(42))) ##
break ##
default ##
e2s(assign(pm, dt(int))(id(n), literal(0)))

),

POSTCONDITION)

% a trivialinfiniteloop
% proof status:−)
spec07: LEMMA
valid(PRECONDITION,
while(literal(true),
skip),
lambda (s : State): false)

% a nontrivialloop
% proof status:−)
% N_TCC1: TCCObligation
N : {n : (range(int)) | n >= 0} = 2

% proof status:−)
% range_int_values_TCC1 : TCCObligation
% proof status:−)
range_int_values: Lemma
Forall (i : int) :
−32767 <= i And i <= 32767

Implies

range(int)(i)
% proof status:−)
% spec08_TCC1: TCCObligation
% proof status:−)
spec08: LEMMA
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(int))(id(n), literal(0))) ##
e2s(assign(pm, dt(int))(id(m), literal(0))) ##
while(N + 1, lt(int)(l2r(pm, dt(int))(id(n)), literal(N)),
e2s(postinc(pm, int)(id(n))) ##
e2s(postinc(pm, int)(id(m)))),
lambda (s : State) :
OK?(read_data(pm, dt(int))(m)(s)) Implies
data(read_data(pm, dt(int))(m)(s)) = N)
% proof status:−)
spec09 : Lemma
plain_memory?(pm) implies
valid(PRECONDITION,
e2s(assign(pm, dt(int))(id(m), literal(0))) ##
for(
N + 1,
e2s(assign(pm, dt(int))(id(n), literal(0))),
lt(int)(l2r(pm, dt(int))(id(n)), literal(N)),
postinc(pm, int)(id(n)),
e2s(postinc(pm, int)(id(m)))),
Lambda (s : State) :
OK?(read_data(pm, dt(int))(m)(s)) Implies
data(read_data(pm, dt(int))(m)(s)) = N)
% proof status:−)
% spec10_TCC1: TCCObligation
% >>
% proof status:−( unfinished
spec10 : Lemma
plain_memory?(pm) implies
valid(PRECONDITION,
for(
e2s(assign(pm, dt(int))(id(n), literal(0))),
lt(int)(l2r(pm, dt(int))(id(n)), literal(N)),

postinc(pm, int)(id(n)),
skip)(
% P
(Lambda (s0 : State) : Lambda (res : StmtResult[State]) :
OK?(res) And OK?(read_data(pm, dt(int))(n)(state(res))) And
0 <= data(read_data(pm, dt(int))(n)(state(res))) And
data(read_data(pm, dt(int))(n)(state(res))) < N

),

% Q
(Lambda (s0 : State) : Lambda (res : StmtResult[State]) :
OK?(res) And OK?(read_data(pm, dt(int))(n)(state(res))) And
data(read_data(pm, dt(int))(n)(state(res))) = N

),

% R
(Lambda (s0 : State) : Lambda (res : StmtResult[State]) :
OK?(res) And OK?(read_data(pm, dt(int))(n)(state(res))) And
data(read_data(pm, dt(int))(n)(state(res))) <= N

),

% variant
(Lambda (s0 : State) : Lambda (s : State) :
If OK?(read_data(pm, dt(int))(n)(s)) And
data(read_data(pm, dt(int))(n)(s)) <= N

Then

N − data(read_data(pm, dt(int))(n)(s))

Else

N

Endif),
% order
Lambda (i, j : int) : i < j

),

Lambda (s : State) :
OK?(read_data(pm, dt(int))(n)(s)) Implies
data(read_data(pm, dt(int))(n)(s)) = N)
END Cpp_Examples
% Rewrite: Hoare rules
% (auto−rewrite"valid""Valid""PRECONDITION ""POSTCONDITION ")
% (smash)
% (skosimp∗ : preds? t)
% RequiredAxioms:
% size_of(typ)
% const and volatilemodels

% (auto−rewrite
% "address_of_spec""address_of_spec2""add_simplification "
% "address_add_zero ""address_add_sum "
% "add_spec""add_spec2""same_array_spec ""same_array_spec2 "
% "mod_range""size_of""uidt""check_bounds_spec "
% "er_plus_ax""er_minus_ax ""er_div_ax""er_times_ax""er_neg_ax"

% "extended_real_superset_of_number_fields ")
% Rewrite: Expressions
% (auto−rewrite
% "literal""id""member""postinc""postdec""deref""arrow"
% "unary_minus""unary_minus_unsigned ""unary_not""unary_bitnot"
% "preinc""predec""UnaryExpressions .sizeof""ptm_member""ptm_arrow"
% "arrow""times""div""div_float""mod""plus""plus_ptr"
% "postinc_ptr""preinc_ptr""subscript""minus""minus_ptr"
% "postdec_ptr""predec_ptr""minus_ptr_ptr ""cmp""lt""gt""le""ge"
% "lt_ptr""gt_ptr""le_ptr""ge_ptr"
% "cmp_pointer""eq_bool""eq""not_equal""not_equal_bool""eq_ptr"
% "not_equal_ptr""bitand""bitxor""bitor""and_exp""or_exp"
% "conditional_expr ""assign""assign_times""assign_div""assign_mod"
% "assign_div_float ""assign_plus""assign_plus_ptr ""assign_minus"
% "assign_minus_ptr ""assign_bitand""assign_bitxor""assign_bitor"
% "comma")
% Rewrites: PlainMemory
% (auto−rewrite
% "plain_memory_write_ok_single "
% "plain_memory_read_data_ok "
% "plain_memory_write_ok_q_expr "
% "plain_memory_write_ok_q_stmt "
% "in_blessed_memory_rw_ro "
% "pm_q_prop_ok "
% "pm_q_prop_single_read "
% "pm_q_prop_single_write "
% "pm_q_prop_read_write_single "
% "pm_q_prop_read_write_other_single "
% "pm_q_prop_read_read_single "
% "plain_memory_read_write_other_single_data "
% "plain_memory_read_read "
% "plain_memory_read_write_res "
% "pm_q_prop_read_ok_expr "
% "pm_q_prop_read_ok_stmt "
% "pm_q_prop_read_pm_q_prop_expr "
% "pm_q_prop_read_pm_q_prop_stmt "
% "pm_q_prop_read_write_q_expr "
% "pm_q_prop_read_write_q_stmt "
% "plain_memory_read_write_q_data_expr "
% "plain_memory_read_write_q_data_stmt "
% "pm_q_prop_read_write_other_q_expr "
% "pm_q_prop_read_write_other_q_stmt "
% "pm_q_prop_read_read_q_expr "
% "pm_q_prop_read_read_q_stmt "
% "plain_memory_read_write_other_q_data_expr "
% "plain_memory_read_write_other_q_data_stmt "
% "plain_memory_read_read_q_data_expr "
% "plain_memory_read_read_q_data_stmt "
% "pm_q_prop_ok_result_single "
% "pm_q_prop_ok_result_q_expr "

% "pm_q_prop_ok_result_q_stmt "
% "pm_q_prop_read_ok_result_single "
% "pm_q_prop_read_ok_result_q_expr "
% "pm_q_prop_read_ok_result_q_stmt "
% "pm_q_prop_e2s "
% "pm_q_prop_stmt_e2s "
% "pm_q_prop_read_e2s "
% "pm_q_prop_read_stmt_e2s "
% "pm_q_prop_read_ok__pm_q_prop_read_expr "
% "pm_q_prop_read_ok__pm_q_prop_read_stmt "
% )
% Rewrite: Switch
% (auto−rewrite
% "if_else"
% "switch"
% "member"
% "break_catch_break "
% "break_break_stmt "
% "break_break_catch_continue "
% "break_break_catch_default "
% "break_break_lift_stmt "
% "break_break_case "
% "break_break_default "
% "break_break"
% "stmt_break_break "
% "break_stmt_break "
% "break_stmt_catch_continue "
% "break_stmt_catch_default "
% "break_stmt_lift "
% "break_stmt_case"
% "break_stmt_default "
% "continue_catch_continue "
% "continue_break_stmt "
% "continue_break_catch_continue "
% "continue_break_catch_default "
% "continue_break_lift_stmt "
% "continue_break_case "
% "continue_break_default "
% "continue_continue"
% "stmt_continue_continue "
% "continue_stmt_continue "
% "continue_stmt_catch_continue "
% "continue_stmt_catch_default "
% "continue_stmt_lift "
% "continue_stmt_case "
% "continue_stmt_default "
% "switch_stmt"
% "stmt_switch_stmt "
% "switch_case_taken "
% "stmt_switch_case_taken "
% "switch_case_not_taken "

% "stmt_switch_case_not_taken "
% "switch_default"
% "stmt_switch_default "
% "switch_catch_break "
% "stmt_switch_catch_break "
% "switch_catch_continue "
% "stmt_switch_catch_continue "
% "switch_catch_default "
% "stmt_switch_catch_default "
% "default_stmt"
% "stmt_default_stmt "
% "default_case"
% "stmt_default_case "
% "default_default"
% "stmt_default_default "
% "default_catch_break "
% "stmt_default_catch_break "
% "default_catch_continue "
% "stmt_default_catch_continue "
% "default_catch_default "
% "stmt_default_catch_default "
% "return_void_result "
% "return_ex_result "
% "stmt_remove_catch_default "
% "stmt_remove_case"
% "stmt_remove_default "
% "stmt_remove_catch_continue "
% "stmt_remove_catch_break "
% "break_break_stmt_expr "
% "break_break_catch_continue_expr "
% "break_break_catch_default_expr "
% "break_break_lift_stmt_expr "
% "break_break_case_expr "
% "break_break_default_expr "
% "continue_break_stmt_expr "
% "continue_break_catch_continue_expr "
% "continue_break_catch_default_expr "
% "continue_break_lift_stmt_expr "
% "continue_break_case_expr "
% "continue_break_default_expr "
% )
% Rewrite: Skip / E2S
% (auto−rewrite
% "skip_ok"
% "skip_state"
% "skip_elemination "
% "stmt_skip_elemination "
% "stmt_ok_lift"
% "stmt_ok_lift_expr "
% "e2s_ok"
% "stmt_e2s_ok"

% "e2s_state"
% "stmt_e2s_state"
% "ok_result_fexpr "
% "ok_result_fstmt "
% "e2s_merge"
% "stmt_e2s_merge"
% "e2s_expr"
% "stmt_e2s_expr"
% )

% Rewrite: Loopsby unrolling
% (auto−rewrite
% "while_unroll"
% "stmt_while_unroll "
% "iterate_while_ok "
% "while_hang"
% "while_unroll_expr "
% "while_unroll_lexpr "
% "stmt_while_unroll_expr "
% "stmt_while_unroll_lexpr "
% "while_unroll_0 "
% "do_while_unroll "
% "do_while_inv_unroll "
% "for_unroll"
% "for_inv_unroll "
% "while_to_while_no_cb "
% "while_invariant ?!"
% "while_variant ?!"
% "while_inv_rewrite_termination_result !"
% "while_inv_rewrite_data_ok !"
% "while_inv_rewrite_data_break !"
% "while_inv_rewrite_data_return !"
% "stmt_while_inv_rewrite_termination_result !"
% "stmt_while_inv_rewrite_data_ok !"
% "stmt_while_inv_rewrite_data_break !"
% "stmt_while_inv_rewrite_data_return !"
% "pm_q_prop_while !"
% "pm_q_prop_stmt_while !"
% )
% Rewrite: Composition
% (auto−rewrite
% "composition_assoc_rewrite_stmt_ok "
% "forward_s_c_s_of_s_expr "
% "comp_eval_if_ok_fstmt "
% "stmt_eval_if_ok_fstmt "
% "comp_eval_if_ok_fstmt_cstmt "
% "stmt_eval_if_ok_fstmt_cstmt "
% "composition_assoc_rewrite_1 "
% "composition_assoc_rewrite_2 "

% "composition_assoc_rewrite_3 "
% "composition_assoc_rewrite_4 "
% "composition_assoc_rewrite_5 "
% "composition_assoc_rewrite_6 "
% "composition_assoc_rewrite_7 "
% "composition_assoc_rewrite_8 "
% "composition_assoc_rewrite_expr_1 "
% "composition_assoc_rewrite_expr_2 "
% "composition_assoc_rewrite_expr_3 "
% "composition_assoc_rewrite_expr_4 "
% "composition_assoc_rewrite_expr_5 "
% "composition_assoc_rewrite_expr_6 "
% "composition_assoc_rewrite_stmt_ok "
% "composition_assoc_rewrite_stmt_ok_expr "
% "composition_assoc_rewrite_stmt_ok_expr_lexpr "
% "comp_eval_if_ok_fstmt "
% "comp_eval_if_ok_fstmt_expr "
% "comp_eval_if_ok_fstmt_cstmt_expr "
% "stmt_eval_if_ok_fstmt_expr "
% "stmt_eval_if_ok_fstmt_cstmt_expr "
% "comp_eval_if_ok_fexpr_expr "
% "comp_eval_if_ok_fexpr "
% "stmt_eval_if_ok_fexpr "
% "expr_eval_if_ok_fexpr "
% "composition_assoc_expression_rewrite "
% "composition_assoc_expression_rewrite_stmt "
% "stmt_eval_if_ok_fexpr_expr "
% "expr_eval_if_ok_fexpr_expr "
% "ok_result_fexpr "
% "ok_result_fstmt "
% "composition_assoc_rewrite_stmt_ok_cstmt "
% )
% Rewrite: Allocation
% (auto−rewrite
% "allocate_stack""deallocate_stack""with_new_stackvar "
% )
% Rewrite: Ok Result
% (auto−rewrite
% "ok_result_ok"
% "ok_result_data "
% "ok_result_q_ok "
% "ok_result_q_state "
% "ok_result_q_data "
% "ok_result_elemination_1 "
% "ok_result_elemination_2 "
% "ok_result_state"
% )
% Rewrite: Conversions
% (auto−rewrite

% "l2r""integral_to_bool ""pointer_to_bool ""bool2int"
% )
% Rewrite: Precondrules
% (auto−rewrite
% "comp_simple_expr_simple_expr_ok "
% "comp_simple_expr_simple_expr_data "
% "comp_simple_expr_simple_expr_state "
% "comp_simple_stmt_simple_expr_ok "
% "comp_simple_stmt_simple_expr_data "
% "comp_simple_stmt_simple_expr_state "
% )

B.10 cpp-verification.pvs

% $Id: cpp−verification.pvs,v 1.2.6.1.4.1 2008/05/13 14:47:26 tews Exp$

%

% Author: TjarkWeber
% (c) 2007 RadboudUniversity

%

% Verificationenvironmentfor C++. Maintheory, importsall other theories
% that are needed to verifyC++ programsin PVS.
Cpp_Verification[State : Type] : THEORY

BEGIN

Importing Expressions, Conversions, Hoare, Statement_Rewrites
pm : Plain_Memory[State]
END Cpp_Verification

B.11 datatype_model.pvs

% $Id: datatype_model.pvs,v 1.1.6.2.4.2 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber
% (c) 2007 RadboudUniversity

%

% A definitionof two PODswithdifferent"typetags",where
% read_data(pm, pod_2)(addr) after write_data(pm, pod_1)(addr) fails.

%

% Thisis merelyan example.

%

% The contentsof this file shouldprobablybe movedto "builtin_models.pvs"
% when the lattertypechecksagain.
% Note that there is (yet another) problemwiththe currentPOD formalization:
% it does not guaranteethat PODscan be copied via char arrays.
% Two trivialPODs, both withunitsemantics.

B.11 datatype_model.pvs

Datatype_Model: THEORY

BEGIN

IMPORTING Unit, Interpreted_Data[Unit]
% proof status:−)
% uidt_1_TCC1: TCCObligation
uidt_1: (uninterpreted_data_type ?) =
(# size := 1,
valid? := LAMBDA (bl: list[Byte], a : Address):
bl = (: 0 :)

#)

% proof status:−)
% pod_1_TCC1: TCCObligation
% proof status:−)
% pod_1_TCC2: TCCObligation
% proof status:−)
% pod_1_TCC3: TCCObligation
% proof status:−)
% pod_1_TCC4: TCCObligation
pod_1: (pod_data_type ?) =
(# uidt := uidt_1,
to_byte:= LAMBDA (d: Unit, a : Address):
(: 0 :),
to_mask:= Lambda (d : Unit, a : Address) :
zero_mask?(size(uidt_1)),
from_byte:= LAMBDA (bl: list[Byte], a : Address):
if bl = (: 0 :) then up(unit) else bottom endif

#)

% proof status:−)
% uidt_2_TCC1: TCCObligation
uidt_2: (uninterpreted_data_type ?) =
(# size := 1,
valid? := LAMBDA (bl: list[Byte], a : Address):
bl = (: 1 :)

#)

% proof status:−)
% pod_2_TCC1: TCCObligation
% proof status:−)
% pod_2_TCC2: TCCObligation

% proof status:−)
% pod_2_TCC3: TCCObligation
pod_2: (pod_data_type ?) =
(# uidt := uidt_2,
to_byte:= LAMBDA (d: Unit, a : Address):
(: 1 :),
to_mask:= Lambda (d : Unit, a : Address) :
zero_mask?(size(uidt_2)),
from_byte:= LAMBDA (bl: list[Byte], a : Address):
if bl = (: 1 :) then up(unit) else bottom endif

#)

END Datatype_Model
Read_After_Write_Fails [State : Type] : THEORY

BEGIN

IMPORTING Datatype_Model, Statements, Plain_Mem_Properties [State]
pm : VAR Plain_Memory[State]
s : VAR State
a : VAR Address
% proof status:−)
% plain_mem_write_list_states_TCC1 : TCCObligation
% proof status:−)
plain_mem_write_list_states : LEMMA
Forall(size : nat, bl : list[Byte]) :
size = length(bl) and
plain_memory?(pm) and
pm‘states(s) and
subset?(address_block(a, size), pm‘rw_addr) and
OK?(memory_write_list (pm‘mem)(a, bl)(s)) implies
pm‘states(state(memory_write_list (pm‘mem)(a, bl)(s)))
% proof status:−)
plain_mem_write_list_read_list_ok : LEMMA
Forall(size : nat, bl : list[Byte]) :
size = length(bl) and
plain_memory?(pm) and
pm‘states(s) and
subset?(address_block(a, size), pm‘rw_addr) and
OK?(memory_write_list (pm‘mem)(a, bl)(s)) implies
OK?(memory_read_list (pm‘mem)(a, size)
(state(memory_write_list (pm‘mem) (a, bl)(s))))
% proof status:−)
Fatal_Result: LEMMA
plain_memory?(pm) and
pm‘states(s) and

B.11 datatype_model.pvs

in_blessed_memory ?(pod_1, a, pm‘rw_addr) implies
Fatal?( (write_data(pm, pod_1)(a, unit) ##
read_data(pm, pod_2)(a))(s) )
END Read_After_Write_Fails
% The same for two perhapsmore interestingPODs: bool and Byte.
Datatype_Model_2: THEORY

BEGIN

IMPORTING Interpreted_Data[bool]
% proof status:−)
% uidt_bool_TCC1: TCCObligation
uidt_bool: (uninterpreted_data_type ?) =
(# size := 2,
valid? := LAMBDA (bl: list[Byte], a : Address):
bl = (: 0, 0 :) or bl = (: 0, 1 :)

#)

% proof status:−)
% pod_bool_TCC1: TCCObligation
% proof status:−)
% pod_bool_TCC2: TCCObligation
% proof status:−)
% pod_bool_TCC3: TCCObligation
% proof status:−)
% pod_bool_TCC4: TCCObligation
% proof status:−)
% pod_bool_TCC5: TCCObligation
% proof status:−)
% pod_bool_TCC6: TCCObligation
pod_bool: (pod_data_type ?) =
(# uidt := uidt_bool,
to_byte:= LAMBDA (d: bool, a : Address):
if d then (: 0, 1 :) else (: 0, 0 :) endif,
to_mask:= Lambda (d : bool, a : Address) :
zero_mask?(size(uidt_bool)),
from_byte:= LAMBDA (bl: list[Byte], a : Address):
if bl = (: 0, 1 :) then up(true)
else if bl = (: 0, 0 :) then up(false)
else bottom endif endif

#)

IMPORTING Interpreted_Data[Byte]
% proof status:−)
% uidt_Byte_TCC1: TCCObligation
% proof status:−)
% uidt_Byte_TCC2: TCCObligation
uidt_Byte: (uninterpreted_data_type ?) =
(# size := 2,
valid? := LAMBDA (bl: list[Byte], a : Address):
length(bl) = 2 and car(bl) = 1

#)

% proof status:−)
% pod_Byte_TCC1: TCCObligation
% proof status:−)
% pod_Byte_TCC2: TCCObligation
% proof status:−)
% pod_Byte_TCC3: TCCObligation
% proof status:−)
% pod_Byte_TCC4: TCCObligation
% proof status:−)
% pod_Byte_TCC5: TCCObligation
pod_Byte: (pod_data_type ?[Byte]) =
(# uidt := uidt_Byte,
to_byte:= LAMBDA (d: Byte, a : Address):
(: 1, d :),
to_mask:= Lambda (d : Byte, a : Address) :
zero_mask?(size(uidt_Byte)),
from_byte:= LAMBDA (bl: list[Byte], a : Address):
if length(bl) = 2 and car(bl) = 1 then up(car(cdr(bl))) else bottom endif

#)

END Datatype_Model_2

Read_After_Write_Fails_2 [State : Type] : THEORY

BEGIN

IMPORTING Datatype_Model_2 , Statements, Plain_Mem_Properties [State]
pm : VAR Plain_Memory[State]
s : VAR State
a : VAR Address

B.12 device_memory.pvs

% proof status:−)
plain_mem_write_list_states : LEMMA
Forall(size : nat, bl : list[Byte]) :
size = length(bl) and
plain_memory?(pm) and
pm‘states(s) and
subset?(address_block(a, size), pm‘rw_addr) and
OK?(memory_write_list (pm‘mem)(a, bl)(s)) implies
pm‘states(state(memory_write_list (pm‘mem)(a, bl)(s)))
% proof status:−)
plain_mem_write_list_read_list_ok : LEMMA
Forall(size : nat, bl : list[Byte]) :
size = length(bl) and
plain_memory?(pm) and
pm‘states(s) and
subset?(address_block(a, size), pm‘rw_addr) and
OK?(memory_write_list (pm‘mem)(a, bl)(s)) implies
OK?(memory_read_list (pm‘mem)(a, size)
(state(memory_write_list (pm‘mem) (a, bl)(s))))
% proof status:−)
Fatal_Result: LEMMA
plain_memory?(pm) and
pm‘states(s) and
in_blessed_memory ?(pod_bool, a, pm‘rw_addr) implies
Fatal?( (write_data(pm, pod_bool)(a, true) ##
read_data(pm, pod_Byte)(a))(s) )
END Read_After_Write_Fails_2

B.12 device_memory.pvs

Expand_State[State, T : Type] : Theory

Begin

Importing State_Transformer
Expand_state: Type = [#
state : State,
expansion : T

#]

em_lift(stf : [State −> SuperResult[State]]) :
[Expand_state−> SuperResult[Expand_state]] =
Lambda (s : Expand_state) :
Let res = stf(s‘state) In
Cases res Of
OK(state) : OK(s With [(state) := state]),
Abnormal(state) : Abnormal(s With [(state) := state]),
Bottom : Bottom

B PVS Theory Sources

EndCases

em_lift(P : PRED[State]) : PRED[Expand_state] =
Lambda (em : Expand_state) : P(em‘state)
em_lift(P : PRED[[State −> SuperResult[State]]])
(q : [Expand_state−> SuperResult[Expand_state]]) : bool =
Exists (p : (P)) : q = em_lift(p)
states : Var PRED[State]
transformers : Var PRED[[State −> SuperResult[State]]]
% proof status:−)
em_transformers_ok: Lemma
transformers_ok?(states, transformers) Implies
transformers_ok?(em_lift(states), em_lift(transformers))
% proof status:−)
em_transformer_invariant: Lemma
transformer_invariant?(states, transformers) Implies
transformer_invariant?(em_lift(states), em_lift(transformers))
% proof status:−)
em_lift_singleton: Lemma
Forall (q : [State −> SuperResult[State]]) :
singleton(em_lift(q)) = em_lift(singleton(q))
End Expand_State
Expand_State2[State, T, Data : Type] : Theory

Begin

Importing Expand_State[State, T]
em_lift(stf : [State −> ExprResult[State, Data]]) :
[Expand_state−> ExprResult[Expand_state, Data]] =
Lambda (s : Expand_state) :
Let res = stf(s‘state) In
Cases res Of
OK(state, data) : OK(s With [(state) := state], data),
Exception(ex_type, state) : Exception(ex_type, s With [(state) := state]),
Fatal : Fatal,
Hang : Hang

EndCases

% proof status:−)
em_lift_expr_2_super : Lemma
Forall (stf : [State −> ExprResult[State, Data]]) :
expr_2_super (em_lift(stf)) = em_lift(expr_2_super (stf))
End Expand_State2

Expand_State3[State, T : Type] : Theory

Begin

Importing Expand_State2, Plain_Memory
pm : Var Memory_struct[State]
em_pm: Var Memory_struct[Expand_state[State, T]]
states : Var PRED[State]
addresses : Var PRED[Address]
transformers : Var PRED[[State −> SuperResult[State]]]
% proof status:−)
em_memory_read_transformers : Lemma
(em_pm‘memory_read=
Lambda (a : Address) : em_lift[State, T, Byte](pm‘memory_read(a)))

Implies

memory_read_transformers (em_pm, addresses) =
em_lift(memory_read_transformers (pm, addresses))
% proof status:−)
em_memory_write_transformers : Lemma
(em_pm‘memory_write=
Lambda (a : Address, b : Byte) :
em_lift[State, T, Unit](pm‘memory_write(a, b)))

Implies

memory_write_transformers (em_pm, addresses) =
em_lift(memory_write_transformers (pm, addresses))
% proof status:−)
em_unchanged_memory_invariant : Lemma
(em_pm‘memory_read= Lambda (a : Address) : em_lift[State, T, Byte](pm‘memory_read(a))) And
unchanged_memory_invariant ?(pm, states, transformers, addresses)

Implies

unchanged_memory_invariant ?(em_pm, em_lift(states),
em_lift(transformers), addresses)
% proof status:−)
em_changed_memory_invariant : Lemma
(em_pm‘memory_read=
Lambda (a : Address) : em_lift[State, T, Byte](pm‘memory_read(a))) And
(em_pm‘memory_write=
Lambda (a : Address, b : Byte) :
em_lift[State, T, Unit](pm‘memory_write(a, b))) And
changed_memory_invariant ?(pm, states, addresses)

Implies

changed_memory_invariant ?(em_pm, em_lift(states), addresses)
% proof status:−)
% em_const_unchanged_memory_invariant_TCC1 : TCCObligation
% proof status:−)

em_const_unchanged_memory_invariant : Lemma
Forall (q : [Expand_state[State, T] −> SuperResult[Expand_state[State, T]]]) :
(em_pm‘memory_read= Lambda (a : Address) : em_lift[State, T, Byte](pm‘memory_read(a))) And
(Forall (s : Expand_state[State, T]) : has_next_state (q(s)) Implies state(q(s))‘state = s‘state)

Implies

unchanged_memory_invariant ?(em_pm, em_lift(states), singleton(q), addresses)
se_transformer: Var
[Address, list[Byte], bool −> [State −> ExprResult[State, list[Byte]]]]
% proof status:−)
em_side_effect_content_unchanged : Lemma
side_effect_content_unchanged (addresses, states, se_transformer)

Implies

side_effect_content_unchanged (addresses, em_lift(states),
Lambda (a : Address, bl : list[Byte], cp : bool) :
em_lift[State, T, list[Byte]](se_transformer(a, bl, cp)))
End Expand_State3

Device_Memory[Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm : Plain_Memory,
Device_state: Type] : Theory

Begin

Importing Expand_State3
Device_memory: Type = Expand_state[Physical_memory, Device_state]
s : Var Device_memory
a : Var Address
b : Var Byte
size : Var nat
device_read_side_effect : Var
[Address, list[Byte], bool −>
[Device_memory−> ExprResult[Device_memory, list[Byte]]]]
device_write_side_effect : Var
[Address, list[Byte], bool −>
[Device_memory−> ExprResult[Device_memory, list[Byte]]]]
device_pm(device_read_side_effect ,
device_write_side_effect ) : Memory_struct[Device_memory] =

(#

memory_read:= Lambda (a : Address) :
em_lift[Physical_memory, Device_state, Byte](memory_read(pm‘mem)(a)),
memory_write:= Lambda (a : Address, b : Byte) :
em_lift[Physical_memory, Device_state, Unit](memory_write(pm‘mem)(a, b)),

memory_read_side_effect

:=

Lambda (a : Address, bl : list[Byte], cp : bool) :

em_lift[Physical_memory, Device_state, list[Byte]](
memory_read_side_effect (pm‘mem)(a, bl, cp)) ## Lambda (bl1 : list[Byte]) :
device_read_side_effect (a, bl1, cp),

memory_write_side_effect

:=

Lambda (a : Address, bl : list[Byte], cp : bool) :
em_lift[Physical_memory, Device_state, list[Byte]](
memory_write_side_effect (pm‘mem)(a, bl, cp)) ## Lambda (bl1 : list[Byte]) :
device_write_side_effect (a, bl1, cp)

#)

End Device_Memory
Challenge_Device_Memory[Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm_phy: Plain_Memory,
Device_state: Type] : Theory

Begin

Importing Device_Memory[Physical_memory, pm_phy, Device_state],

Plain_Mem_Rewrites

device_read_side_effect : Var
[Address, list[Byte], bool −>
[Device_memory−> ExprResult[Device_memory, list[Byte]]]]
device_write_side_effect : Var
[Address, list[Byte], bool −>
[Device_memory−> ExprResult[Device_memory, list[Byte]]]]
addresses : Var PRED[Address]
pm : Var Plain_Memory[Device_memory]
drse_super_transformers (addresses, device_read_side_effect ) :
PRED[[Device_memory−> SuperResult[Device_memory]]] =
Lambda (q : [Device_memory−> SuperResult[Device_memory]]) :
Exists (a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) And
q = expr_2_super (device_read_side_effect (a, bl, cp))
dwse_super_transformers (addresses, device_write_side_effect ) :
PRED[[Device_memory−> SuperResult[Device_memory]]] =
Lambda (q : [Device_memory−> SuperResult[Device_memory]]) :
Exists (a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) And
q = expr_2_super (device_write_side_effect (a, bl, cp))

is_device_plain_memory ?(device_read_side_effect , device_write_side_effect )
(pm) : bool =
% plainmemory
pm‘mem = device_pm(device_read_side_effect , device_write_side_effect ) And
plain_memory?(pm_phy) And

pm‘states = em_lift(pm_phy‘states) And
subset?(pm‘other_actions, em_lift(pm_phy‘other_actions)) And
subset?(pm‘rw_addr, pm_phy‘rw_addr) And
subset?(pm‘ro_addr, union(pm_phy‘ro_addr, difference(pm_phy‘rw_addr, pm‘rw_addr))) And
% side effect properties
transformers_ok?(pm‘states, union(
drse_super_transformers (union(pm‘ro_addr, pm‘rw_addr),

device_read_side_effect

),

dwse_super_transformers (pm‘rw_addr, device_write_side_effect ))) And
unchanged_memory_invariant ?(pm‘mem, pm‘states, union(
drse_super_transformers (union(pm‘ro_addr, pm‘rw_addr),

device_read_side_effect

),

dwse_super_transformers (pm‘rw_addr, device_write_side_effect )),
union(pm‘ro_addr, pm‘rw_addr)) And
side_effect_content_unchanged (union(pm‘ro_addr, pm‘rw_addr), pm‘states,
device_read_side_effect ) And
side_effect_content_unchanged (pm‘rw_addr, pm‘states,

device_write_side_effect

)

% HelperLemmas
% −−−−−−−−−−−−−−−
% proof status:−)
pm_dev_plain: Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

plain_memory?(pm_phy)
% proof status:−)
pm_dev_states: Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

pm‘states = em_lift(pm_phy‘states)
% proof status:−)
pm_dev_read: Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

memory_read(pm‘mem) =
Lambda (a : Address) :
em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy‘mem)(a))
% proof status:−)
pm_dev_write: Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

memory_write(pm‘mem) =
Lambda (a : Address, b : Byte) :
em_lift[Physical_memory, Device_state, Unit](memory_write(pm_phy‘mem)(a, b))

% proof status:−)
pm_dev_read_side_effect : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

memory_read_side_effect (pm‘mem) =
Lambda (a : Address, bl : list[Byte], cp : bool) :
em_lift[Physical_memory, Device_state, list[Byte]](
memory_read_side_effect (pm_phy‘mem)(a, bl, cp)) ## lambda (bl1 : list[Byte]) :
device_read_side_effect (a, bl1, cp)
% proof status:−)
pm_dev_write_side_effect : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

memory_write_side_effect (pm‘mem) =
Lambda (a : Address, bl : list[Byte], cp : bool) :
em_lift[Physical_memory, Device_state, list[Byte]](
memory_write_side_effect (pm_phy‘mem)(a, bl, cp)) ## lambda (bl1 : list[Byte]) :
device_write_side_effect (a, bl1, cp)
% proof status:−)
pm_dev_ro_rw_addr : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

subset?(union(pm‘ro_addr, pm‘rw_addr), union(pm_phy‘ro_addr, pm_phy‘rw_addr))
% PlainMemoryProperties
% −−−−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
device_plain_transformers_ok : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

transformers_ok?(pm‘states, union(
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)),
memory_write_transformers (pm‘mem, pm‘rw_addr)))
% proof status:−)
device_plain_unchanged_memory_invariant : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states, union(union(pm‘other_actions,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr))),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))),

union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
device_plain_unchanged_memory_invariant_write : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_transformers (pm‘mem, pm‘rw_addr), pm‘ro_addr)
% proof status:−)
device_plain_unchanged_memory_write_invariant : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

unchanged_memory_write_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% proof status:−)
device_plain_changed_memory_invariant : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

changed_memory_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% proof status:−)
device_plain_read_side_effect_unchanged : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

side_effect_content_unchanged (union(pm‘ro_addr, pm‘rw_addr), pm‘states,
memory_read_side_effect (pm‘mem))
% proof status:−)
device_plain_write_side_effect_unchanged : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

side_effect_content_unchanged (pm‘rw_addr, pm‘states,
memory_write_side_effect (pm‘mem))
% proof status:−)
device_plain_transformers_ok2 : Lemma
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)

Implies

transformers_ok?(pm‘states, union(
memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr)))
% MainBlessingResult
% ======================

B.13 everything.pvs

% proof status:−)
device_memory_plain_memory : Lemma
Forall (pm) :
is_device_plain_memory ?(device_read_side_effect ,
device_write_side_effect )(pm)
Implies plain_memory?(pm)
End Challenge_Device_Memory

B.13 everything.pvs

Import_All: Theory
% Thistheoryimports(directlyor indirectly) ∗every∗ theory
% of the project. Thisway one can convenientlyrerunall proofs
% withprove−importchain(C−c C−p i) on this theory.

Begin

% Please add all new theorieshere !!
Importing Phy_Mem_Challenge_Read_Same , Phy_Mem_Challenge_Read_Other ,

Linear_Memory_Blessing_Properties

,

Statement_Rewrites

,

Allocation_Table, Challenge_Random_Device , Expressions
% data typemodels
Importing PDBR_Data_Model , PDE_Model, PTE_Model, PF_EC_Model , Address_Model
% test theories
Importing Rewrite_Test, Search_Example, Cpp_Examples
Importing Read_After_Write_Fails , Read_After_Write_Fails_2
% intermediatestuff, that willdisappearlater
Importing PDBR_Datatype, PDE_Datatype, PTE_Datatype,
Physical_Memory_Corollaries , Block_Disjoint_Rewrites ,
Posnat_induction, Set_Lift

End Import_All

B.14 expressions.pvs

% $Id: expressions.pvs,v 1.34.2.2.2.5.2.4 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber(based on lecturematerialby HendrikTews)
% (c) 2007 RadboudUniversity

%

% A shallowembeddingof (some) C++ expressionsas state transformers.
% Section numbersin commentsthroughoutthis file refer to
% "Programminglanguages− C++", ISO/IEC14882:1998(E)

% Deviationsfrom the C++ standard:
% ===================================

%

% EvaluationOrder
% −−−−−−−−−−−−−−−−−−
% Note that the C++ standardleavesthe evaluationorderof subexpressions
% mostlyunspecified. The behavioris undefinedunlesseach expression
% satisfiesa (somewhatobscure) side condition(cf. 5.4). We do not model
% this here; the followingdefinitionsinsteaduse some fixedevaluationorder.
% MichaelNorrishin his paper
% "Deterministicexpressionsin C",8th EuropeanSymposiumon Programming
% (ETAPS), Amsterdam. 1999. LNCS1576, pp147−161
% shows that the evaluationorderis actuallyirrelevantfor expressionsthat
% satisfythe side conditionof 5.4. At the source code level, the evaluation
% ordercan be made deterministicby disallowingoperandswithside effects,
% storingtheirvaluesin temporaryvariablesinstead: e.g.
% x = f() + g();
% could be replacedby
% t1 = f(); t2 = g(); x = t1 + t2;

%

% ModuloArithmetic
% −−−−−−−−−−−−−−−−−−−
% C++ definessome typesand theircorrespondingoperationsto follow
% arithmeticmodulo2^n where n is the numberof bits in the value
% representation. To be able detect integeroverflowswe do not model modulo
% arithmeticdirectlybut insteadwe add the functionmod whichis definedto
% be the identityfunctionfor the valuerange of the respectivedatatypebut
% whichis otherwiseundefined.

%

% Integerdivision"/"and remainder"%" (5.6.4) behavedifferently, see below.

%

% Bit−shift operators"<<" and ">>" (5.8.1) behavedifferently; see below.
% Open Issues:
% =============
% − CallingConvention(5.2 functions)
% I don’t thinkthe C++ standardspecifiesjust how exactlyfunction
% argumentsare stored on the stack (or even if there is a stack, for.that
% matter.) "call_f"obviouslydefinesa certain(hopefullyreasonable)
% behavior.

%

% Thisis definedin the ABIdocuments. (e.g., cdecl is definedin
% the callingconventionis definedin 3.9 in the "SystemV ABIIntel386
% ArchitectureProcessorSupplement")

%

% − passingvaluesto functionsratherthan addresses(5.2 functions)
% Forspecification/verification, it mightbe useful to have yet anotherPVS
% functionfor f whichtakes values(ratherthan expressionsor addresses) as
% arguments. Thishasn’t been implementedyet.

%

% − entrypoints+ addressranges for functions(5.2 functions)
% We shouldprobablydefine for each functionthe range of addresseswhere

B.14 expressions.pvs

% the code of this functionresidesand the addressof the entrypoint

%

% − shouldwe implementexceptionvalues; some FPUops and div0 generatea
% well−definedhardwareexception(e.g., Exception0: divideerror). Using
% Extended_Realssuch an implementationcould specifyexceptionvalues(e.g.,
% x / 0 = div_0), check for these valuesand insteadof exitingwithFatal
% returnwiththe appropriateexception.
% To do:
% ========
% − define expressionsfor bitfieldtypes
% − with_new_refvar (ref, init)(Lambda(ref : (range(ref))) : xxx)
% − define << and >> operator
% − addressof operator(&)
% − pointerassignment
% on assignmentwe have to adjustthe pointeraddressto refer to the
% base class subobjectof a derivedobject.
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.1: Primaryexpressions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
PrimaryExpressions[State, Data : Type] : THEORY

BEGIN

IMPORTING State_Transformer_Lift
x : VAR Data
% 5.1.2
% >> MV: use Cpptype; define literalsfor int, char, float, bool // string
literal(x) : [State −> ExprResult[State, Data]] = ok_result(x)
% 5.1.7
% >> MV: x is alwaysan address(??)
id(x) : [State −> ExprResult[State, Data]] = ok_result(x)
END PrimaryExpressions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.2: Postfixexpressions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% A C++ function"ret_dataf(arg_dataa)"currentlycorrespondsto two PVS
% functions

%

% f(a : Address) : [State −> StmtResult[State, Semantics_< ret_data>]] =

% body

%

% (where each branchin the bodymust be terminatedby a "return"statement)
% and

%

% call_f(a : [State −> ExprResult[State, Semantics_< arg_data>]]) :
% [State −> ExprResult[State, Semantics_< ret_data>]] =
% with_new_stackvar ( lambda(a_addr: Address):
% assign(a_addr, a) ##
% f(a_addr)) ##
% catch_return
PostfixExpressions[State : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain , Cpp_Types
pm : VAR Plain_Memory[State]
a_ex: VAR ET[State, Address]
% 5.2.5: Classmemberaccess
member(a_ex, (offset : nat)) : [State −> ExprResult[State, Address]] =

(

a_ex## lambda (a : Address):
ok_result(a + offset)

)

% 5.2.1: Subscripting
% "The expressionE1[E2] is identical(by definitionto ∗((E1) + (E2))
% see subscriptin arithmeticexpressions
% 5.2.5 pt 3: −> operator
% "the expressionE1−> E2 is convertedto the equivalentfrom (∗(E1)).E2
% see arrowin unaryexpressions

% proof status:−)
% postinc_TCC1: TCCObligation
% 5.2.6 pt 1: C++’ s .++ operator
postinc(pm, (typ : Cpp_Subtype(v(non_bool_integral ?))))(a_ex) :
ET[State, (range(typ))] =

(

a_ex## lambda (a : Address):
read_data(pm, dt(typ))(a) ## lambda (n : (range(typ))):
If range(typ)(mod(typ)(n + 1)) Then
write_data(pm, dt(typ))(a, mod(typ)(n + 1)) ##
ok_result(n)

Else

fatal_result Endif )

% proof status:−)
% postinc_float_TCC1: TCCObligation
% proof status:−)
% postinc_float_TCC2: TCCObligation
% proof status:−)
% postinc_float_TCC3: TCCObligation
% >> exampleof floatingpointoperation
postinc_float(pm, (typ : Cpp_Subtype(v(floating_point?))))(a_ex) :
ET[State, (range_floating_point (cv_base(typ)))] =

(

a_ex## lambda (a : Address):
read_data(pm, dt_cv_float (typ))(a) ##
lambda (n : (range_floating_point (cv_base(typ)))):
If range_floating_point (cv_base(typ))(mod_float(cv_base(typ))(er_plus(n, 1))) Then
write_data(pm, dt_cv_float (typ))(a, mod_float(cv_base(typ))(er_plus(n, 1))) ##
ok_result(n)

Else

fatal_result Endif

)

% 5.2.6 pt 1: C++‘ s ++ operatorfor pointersto completeobject
% deferredto arithmeticexpressions
% 5.2.6 pt 1
% .++ for argumenttypebool (deprecated)
% 5.2.6 pt 2: C++’ s .−− operator
% .−− is not definedfor argumenttypebool
postdec(pm, (typ : Cpp_Subtype(v(non_bool_integral ?))))(a_ex) :
ET[State, (range(typ))] =

(

a_ex## lambda (a : Address):
read_data(pm, dt(typ))(a) ## lambda (n : (range(typ))):
If range(typ)(mod(typ)(n − 1)) Then
write_data(pm, dt(typ))(a, mod(typ)(n − 1)) ##
ok_result(n)

Else

fatal_result Endif

)

% To do: postdec_float
% 5.2.6 pt 2: C++’ s .−− operatorfor pointersto completeobject
% deferredto arithmeticexpressions

% 5.2.7 dynamic_cast
% TODO: definitionof dynamic_cast(5.2.7)
% 5.2.8 typeid
% TODO: definitionof typeid(5.2.8)
% 5.2.9 static_cast
% TODO: definitionof static_cast(5.2.9)
% − static_cast< reference_type>( v) = lvalueotherwise= rvalue5.2.9.1
% − static_castcan onlyincreasequalifiedness(+ volatile/ + const)
% 5.2.10 reinterpret_cast
% TODO: define reinterpret_cast(5.2.10)
% − reinterpret_cast< reference_type>( v) = lvalueotherwise= rvalue5.2.10.1
% − reinterpret_cast<>( const v) = const 5.2.10.2
% − mappingis implementationdefined
% MV: we cannot define reinterpretcast in a generic way using
% from_byte(T2)(to_byte(T1)); (5.2.10.3) the representationmay or may
% not change !!!
% 5.2.11 const_cast
% TODO: define const_cast(5.2.11)
END PostfixExpressions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.3: Unaryexpressions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
UnaryExpressions[State : Type] : Theory

BEGIN

IMPORTING PostfixExpressions
pm : VAR Plain_Memory[State]
a_ex: Var ET[State, Address]
% proof status:−)
% deref_TCC1: TCCObligation
% 5.3.1: C++’ s ∗ operator
deref(pm, (p_typ: Cpp_Subtype(cv(pointer?))))
(p_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, Memory_Address] =

(

p_ex## lambda (ptr_val: (range_pointer(cv_base(p_typ)))) :
If not_null?(p_typ)(ptr_val) And
check_bounds(p_typ)(ptr_val) And

up?(address_of(p_typ)(ptr_val))

Then

ok_result(down(address_of(p_typ)(ptr_val)))

Else

fatal_result Endif

)

% To do: ∗ for pointerto function
% proof status:−)
% arrow_TCC1: TCCObligation
% proof status:−)
% arrow_TCC2: TCCObligation
% 5.2.5 pt 3: −> operator
% "the expressionE1−> E2 is convertedto the equivalentfrom (∗(E1)).E2
arrow(pm, (p_typ: Cpp_Subtype(cv(Lambda (t : Cpp_Type) : pointer?(t) And
(class?(typ(t)) Or union?(typ(t)))))))
(p_ex: ET[State, (range_pointer(cv_base(p_typ)))], offset : nat) :
ET[State, Address] =

(

deref(pm, p_typ)(p_ex) ## Lambda (a : Address) :
member(ok_result(a), offset)

)

% 5.3.1 pt 2 C++’ s & operator
% not needed for variables; = member() for class members
% 5.3.1 pt 6 unary+ operator
% (not needed as it returnsthe valueof the argument)
% proof status:−)
% unary_minus_TCC1: TCCObligation
% proof status:−)
% unary_minus_TCC2: TCCObligation
% 5.3.1 pt 7 unary− operator
unary_minus(typ : Cpp_Subtype(cv({t : Cpp_Type|
(char?(t) Or wchar_t?(t) Or signed_integer?(t))})))
(n_ex: ET[State, (range(typ))]) : ET[State, (range(typ))] =

(

n_ex## lambda (n : (range(typ))) :
If range(typ)(mod(typ)(−n)) Then
ok_result(mod(typ)(−n))

Else

fatal_result Endif

)

% To do: unary_minus_float
% proof status:−)
% unary_minus_unsigned_TCC1 : TCCObligation
% proof status:−)
% unary_minus_unsigned_TCC2 : TCCObligation
% 5.3.1 pt 7 "the negativeof an unsignedquantityis computedby
% substractingits valuefrom 2^n"
unary_minus_unsigned (typ : Cpp_Subtype(cv(unsigned_integer?)))
(n_ex: ET[State, (range(typ))]) : ET[State, (range(typ))] =

(

n_ex## lambda (n : (range(typ))) :
If range(typ)(mod(typ)(2^max_value_bits (typ) − n)) Then
ok_result(mod(typ)(2^max_value_bits (typ) − n))

Else

fatal_result Endif

)

% 5.3.1 pt 8: C++’ s ! operator
unary_not(typ : Cpp_Subtype(cv(bool?)))
(b_ex: ET[State, bool]) : ET[State, bool] =

(

b_ex## lambda (b : bool) :
ok_result(Not b)

)

% To do
% 5.3.1 pt 9 C++’ s ~ operator
% "The resultis the one’s complementof its operand."

%

% >> MV and Tjarkthink(hope) that this means we applyone’s complement
% to the binaryrepresentationand see whethera validvalue
% comes out of it.
unary_bitnot(typ : Cpp_Subtype(cv(non_bool_integral_enum ?)))
(n_ex: ET[State, (range(typ))]) : ET[State, (range(typ))] =

(

n_ex## lambda (n : (range(typ))) :
% Because dt(typ) is a pod for all of these typeswe can take any address:
% Mem(0)
Let a = Mem(0),
bitnot_value=
from_byte(dt(typ))(
apply_bitop_valuefield (value_bitmask(typ), binary_not)
(to_byte(dt(typ))(n, a)), a)

In

If up?(bitnot_value) And range(typ)(down(bitnot_value)) Then
ok_result(down(bitnot_value))

Else fatal_result

Endif )

% proof status:−)
% preinc_TCC1: TCCObligation
% 5.3.2 pt 1: C++’ s ++. operator
% Note that the prefixincrement/decrementoperatorsreturnan lvalue(i.e.
% an address).
preinc(pm, (typ : Cpp_Subtype(v(non_bool_integral ?))))(a_ex) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
read_data(pm, dt(typ))(a) ## lambda (n : (range(typ))):
If range(typ)(mod(typ)(n + 1)) Then
write_data(pm, dt(typ))(a, mod(typ)(n + 1)) ##
ok_result(a)

Else

fatal_result Endif

)

% To do: preinc_float
% 5.3.2 pt 1: C++’ s ++. operatorfor pointers
% deferredto arithmeticexpressions
% 5.3.2 pt 2: C++’ s −−. operator
% −−. is not definedfor argumenttypebool
predec(pm, (typ : Cpp_Subtype(v(non_bool_integral ?))))(a_ex) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
read_data(pm, dt(typ))(a) ## lambda (n : (range(typ))):
If range(typ)(mod(typ)(n − 1)) Then
write_data(pm, dt(typ))(a, mod(typ)(n − 1)) ##
ok_result(a)

Else

fatal_result Endif

)

% To do: predec_float
% 5.3.2 pt 1: C++’ s −−. operatorfor pointers
% deferredto arithmeticexpressions
% proof status:−)
% sizeof_TCC1: TCCObligation
% 5.3.3 sizeof operator(onlythe typeparameterform is implemented)

% TODO: define the typestd::size_tand returnthis typein sizeof
% this is elsa’s size_of_typeexpression

%

% 7.17 pt 2 C − Standard: size_tis an unsignedintegertype
sizeof(typ : Cpp_Type) : ET[State, (range(uint))] =
If range(uint)(size_of(typ)) Then
ok_result(size_of(typ))

Else

fatal_result Endif

% 5.3.4 C++ new operator
% TODO
% 5.3.5 C++ delete operator
% TODO
END UnaryExpressions
% 5.4 definitionof cast (T)exp
% TODO
PointerToMemberExpressions[State : Type] : THEORY

BEGIN

Importing UnaryExpressions
pm : VAR Plain_Memory[State]
a_ex: Var ET[State, Address]
% 10 pt 5 "A base class subobjectmighthave a layoutdifferentfrom the
% layoutof the most derivedobject of the same type."
% 9.2 pt 17 "A pointerto a pod−structobject, suitablyconvertedusing a
% reinterpret_cast, pointsto its initialmember[...]and vice
% versa."
% GCCseems to adjustthe addressesof a pointerupon pointerassignment. For
% example, in the assignmentB∗ bp = & a where class A : C, B {}; bp willbe
% set to pointto the B subobjectin A. Thisgoes as far as that a vtableis
% alloatedfor B. However, the vtablevalueis not identicalto a
% freestandingB.
% >> Könnenwir zeigen, das ein anderesVorgehenTypinformationin Pointernoder
% in Pointerauf Klassenmemberbraucht?
% >> Ich würdedaherpointerto memberexpressionswie folgt formalisieren:
% We assume that membersof a subobjectare not reorderedwithmembersof
% other subobjectsor withmembersof the derivedobject. We can therefore
% adjustthe pointerto pointto a base class. Thisbase class may possibly
% have a layoutdifferentfrom a standaloneobject.

B.14 expressions.pvs

%

% However, to detect this, typeinformationmust be stored withthe object.
% (??)

%

% We thus requirethe pointerto whichpointerto memberexpressionsare
% boundto have the same class as the pointerto member.
% proof status:−)
% ptm_member_TCC1: TCCObligation
% 5.5 pt 2 C++’ s .∗ operatorfor pointerto member
% To do:
% 5.5 pt 4 "If the dynamictypeof the object does not containthe member
% to whichthe pointerrefers, the behaviouris undefined."
% range(typ) onlycontainsoffsets that are validfor the possiblyderived
% class typ(typ).
ptm_member(typ : Cpp_Subtype(cv(pointer_to_member ?)))
(a_ex, (ptm_ex: ET[State, (range_ptm(cv_base(typ)))])) :
ET[State, Address] =

(

ptm_ex## Lambda (ofs : (range_ptm(cv_base(typ)))) :
% the offset of the member
member(a_ex, ofs)

)

% proof status:−)
% ptm_arrow_TCC1: TCCObligation
% 5.5 pt 3 C++‘ s −>∗ operatorfor pointerto member
% To do:
% check typ(ptr_typ) is a unambiguousaccessiblebase class of typ(ptm_typ).
ptm_arrow(pm, (ptm_typ: Cpp_Subtype(cv(pointer_to_member ?))))
(p_ex: ET[State, (range_pointer(cv_base(
pointer(typ(cv_base(ptm_typ))))))],
ptm_ex: ET[State, (range_ptm(cv_base(ptm_typ)))]) :
ET[State, Address] =

(

ptm_ex## Lambda (ofs : (range_ptm(cv_base(ptm_typ)))) :
arrow(pm, pointer(typ(cv_base(ptm_typ))))(p_ex, ofs)

)

END PointerToMemberExpressions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.6: Multiplicativeoperators
% 5.7: Additiveoperators
% 5.8: Shift operators
% 5.9: Relationaloperators

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

ArithmeticExpressions[State : Type] : THEORY

BEGIN

IMPORTING UnaryExpressions
pm : Var Plain_Memory[State]
a_ex: Var ET[State, Address]
i_typ: Var Cpp_Subtype(cv(non_bool_integral_enum ?))
% The standarddefinesthat bool valuesare subjectto integralpromotions:
% 5 pt 9 "Thispatternis calledthe ’usualarithmeticconversions’ ...
% Otherwise, the integralpromotion(4.5) shallbe performed."
% MultiplicativeOperators
% ==========================
% 5.6: C++’ s ∗ operator(multiplication)
times(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))) :
n2_ex## lambda (n2 : (range(i_typ))) :
If range(i_typ)(mod(i_typ)(n1 ∗ n2)) Then
ok_result(mod(i_typ)(n1 ∗ n2))

Else

fatal_result Endif

)

% To do: times_float
% 5.6.4: "If the second operandof / or % is zero the behavioris undefined;
% otherwise(a/b)∗b + a% b is equal to a. If both operandsare nonnegative
% then the remainderis nonegative; if not, the sign of the remainderis
% implementation−defined."
% C99 requirestruncationtowardszero
% proof status:−)
% mod_impl_TCC1: TCCObligation
% 5.6: C++’ s % operator(i % j resp. i / j)
mod_impl(i : int, j : {k : int | k /= 0}) : {r : int | abs(r) < abs(j)}
div_impl(i : int, j : {k : int | k /= 0}) : int
mod_impl_pos_range : Axiom
Forall (i, j : nat) : j /= 0 Implies
mod_impl(i, j) = mod(i, j)
% proof status:−)

% div_impl_pos_range_TCC1 : TCCObligation
div_impl_pos_range : Axiom
Forall (i, j : nat) : j /= 0 Implies
div_impl(i, j) = ndiv(i, j)
mod_impl_sign: Axiom
Forall (i : int, j : int) : j /= 0 And (i < 0 Or j < 0) Implies
mod_impl(i, j) <= 0 Or mod_impl(i, j) >= 0
div_impl_mod_impl_result : Axiom
Forall (i : int, j : int) : j /= 0 And (i < 0 Or j < 0) Implies
div_impl(i, j) ∗ j + mod_impl(i, j) = i
mod(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):
if n2 /= 0 and range(i_typ)(mod(i_typ)(mod_impl(n1, n2))) then
ok_result(mod(i_typ)(mod_impl(n1, n2)))

else

fatal_result endif

)

% 5.6: C++’ s / operator
div(i_typ)
(n1_ex, n2_ex: ET[State, (range(i_typ))]) : ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):
if n2 /= 0 And range(i_typ)(mod(i_typ)(div_impl(n1, n2))) then
ok_result(mod(i_typ)(div_impl(n1, n2)))

else

fatal_result endif

)

% Floatingpointdivisionmust be handledseparately.
% We use extendedreals, after checkingfor x / 0
% To do:
% div_float(typ: Cpp_Subtype(cv(floating_point?)))
% (n1_ex, n2_ex: ET[State, (range(typ))]) : ET[State, (range(typ))] =
% (
% n1_ex## lambda(n1 : (range(typ))):
% n2_ex## lambda(n2 : (range(typ))):
% If n2 /= 0 Andrange(typ)(mod(typ)(n1 / n2)) Then
% ok_result(mod(typ)(n1 / n2))
% Else
% fatal_result

% Endif
% )
% Additiveoperators
% ====================
% 5.7
plus(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):
If range(i_typ)(mod(i_typ)(n1 + n2)) Then
ok_result(mod(i_typ)(n1 + n2))

Else

fatal_result Endif

);

% To do: plus_float
% proof status:−)
% plus_ptr_TCC1: TCCObligation
% proof status:−)
% plus_ptr_TCC2: TCCObligation
% proof status:−)
% plus_ptr_TCC3: TCCObligation
% proof status:−)
% plus_ptr_TCC4: TCCObligation
% proof status:−)
% plus_ptr_TCC5: TCCObligation
% proof status:−)
% plus_ptr_TCC6: TCCObligation
% 5.7 pt 4 ff C++’ s + operatorfor pointers
plus_ptr(typ : Cpp_Subtype(cv(pointer?)), i_typ)
(p_ex: ET[State, (range_pointer(cv_base(typ)))],
n_ex: ET[State, (range(i_typ))]) :
ET[State, (range_pointer(cv_base(typ)))] =

(

p_ex## lambda (ptr_val: (range_pointer(cv_base(typ)))) :
n_ex## lambda (n : (range(i_typ))) :
If not_null?(typ)(ptr_val) And
range_pointer(cv_base(typ))
(add(typ)(ptr_val, n ∗ size_of(typ(cv_base(typ))))) And
check_bounds(typ)
(add(typ)(ptr_val, n ∗ size_of(typ(cv_base(typ)))))

Then

ok_result(add(typ)(ptr_val, n ∗ size_of(typ(cv_base(typ)))))

Else

fatal_result Endif

)

% proof status:−)
% postinc_ptr_TCC1: TCCObligation
% proof status:−)
% postinc_ptr_TCC2: TCCObligation
% proof status:−)
% postinc_ptr_TCC3: TCCObligation
% proof status:−)
% postinc_ptr_TCC4: TCCObligation
% 5.2.6 pt 1: C++‘ s ++ operatorfor pointersto completeobject
% (equivalentto p = p + 1)
postinc_ptr(pm, (typ : Cpp_Subtype(v(pointer?))))(a_ex) :
ET[State, (range_pointer(cv_base(typ)))] =

(

a_ex## lambda (a : Address):
plus_ptr(typ, uchar)(read_data(pm, dt_cv_pointer (typ))(a), ok_result(1)) ##
lambda (ptr_val: (range_pointer(cv_base(typ)))):
write_data(pm, dt_cv_pointer (typ))(a, ptr_val) ##
ok_result(ptr_val)

)

% 5.3.2 pt 1: C++’ s ++. operatorfor pointers
% deferredto arithmeticexpressions
preinc_ptr(pm, (typ : Cpp_Subtype(v(pointer?))))(a_ex) : ET[State, Address] =

(

a_ex## lambda (a : Address) :
plus_ptr(typ, uchar)(
read_data(pm, dt_cv_pointer (typ))(a),
ok_result(1)) ##
lambda (ptr_val: (range_pointer(cv_base(typ)))) :
write_data(pm, dt_cv_pointer (typ))(a, ptr_val) ##
ok_result(a)

)

% proof status:−)
% subscript_TCC1: TCCObligation
% proof status:−)
% subscript_TCC2: TCCObligation
% proof status:−)
% subscript_TCC3: TCCObligation

% proof status:−)
% subscript_TCC4: TCCObligation
% 5.2.1: Subscripting
% "The expressionE1[E2] is identical(by definitionto ∗((E1) + (E2))
% The check_boundsfunctionin plus and minusenforces the conditionsof
% clause 5.7 pt 5
% providedthe bounds−checkingpointermodel is implemented
subscript(pm, (typ : Cpp_Subtype(array?)), i_typ)
(a_ex, (n_ex: ET[State, (range(i_typ))])) : ET[State, Memory_Address] =

(

a_ex## Lambda (a : Address) :
deref(pm, pointer(typ(typ)))(
plus_ptr(pointer(typ(typ)), i_typ)(
read_data(pm, dt_cv_pointer (pointer(typ(typ))))(a),

n_ex) )

)

% 5.7 C++’ s − operator
minus(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, (range(i_typ))] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):
If range(i_typ)(mod(i_typ)(n1 − n2)) Then
ok_result(mod(i_typ)(n1 − n2))

Else

fatal_result Endif

)

% To do: minus_float
% 5.7 pt 4 ff C++’ s − operatorfor pointer− integral
minus_ptr(typ : Cpp_Subtype(cv(pointer?)), i_typ)
(p_ex: ET[State, (range_pointer(cv_base(typ)))],
n_ex: ET[State, (range(i_typ))]) :
ET[State, (range_pointer(cv_base(typ)))] =

(

p_ex## lambda (ptr_val: (range_pointer(cv_base(typ)))) :
n_ex## lambda (n : (range(i_typ))) :
If not_null?(typ)(ptr_val) And
range_pointer(cv_base(typ))
(add(typ)(ptr_val, −n ∗ size_of(typ(cv_base(typ))))) And
check_bounds(typ)
(add(typ)(ptr_val, −n ∗ size_of(typ(cv_base(typ)))))

Then

ok_result(add(typ)(ptr_val, −n ∗ size_of(typ(cv_base(typ)))))

Else fatal_result

B.14 expressions.pvs

Endif )

% 5.2.6 pt 2: C++’ s .−− operatorfor pointersto completeobject
postdec_ptr(pm, (typ : Cpp_Subtype(v(pointer?))))(a_ex) :
ET[State, (range_pointer(cv_base(typ)))] =

(

a_ex## lambda (a : Address):
minus_ptr(typ, uchar)(read_data(pm, dt_cv_pointer (typ))(a),
ok_result(1)) ##
lambda (ptr_val: (range_pointer(cv_base(typ)))):
write_data(pm, dt_cv_pointer (typ))(a, ptr_val) ##
ok_result(ptr_val)

)

% 5.3.2 pt 1: C++’ s −−. operatorfor pointers
predec_ptr(pm, (typ : Cpp_Subtype(v(pointer?))))(a_ex) :
ET[State, Address] =

(

a_ex## lambda (a : Address) :
minus_ptr(typ, uchar)(read_data(pm, dt_cv_pointer (typ))(a),
ok_result(1)) ##
lambda (ptr_val: (range_pointer(cv_base(typ)))):
write_data(pm, dt_cv_pointer (typ))(a, ptr_val) ##
ok_result(a)

)

% proof status:−)
% ptr_to_nonzero_object_TCC1 : TCCObligation
% proof status:−)
% ptr_to_nonzero_object_TCC2 : TCCObligation
% proof status:−)
% ptr_to_nonzero_object_TCC3 : TCCObligation
% proof status:−)
ptr_to_nonzero_object : Lemma
Forall (typ : Cpp_Subtype(Lambda (p : (pointer?)) : Not void?(typ(p)) And
Not function?(typ(p)))) :
(array?(typ(cv_base(typ))) Implies size_of(typ(cv_base(typ))) > 0)

Implies

size_of(typ(cv_base(typ))) > 0
% 5.7 pt 6 ff C++’ s − operatorfor pointer− pointer
% "Whentwo pointersto elementsof the same arrayobject are substracted,
% ..."
% Thus, the pointershave to have the same type.
% proof status:−)
% minus_ptr_typ_is_Cpp_Type_TCC1 : TCCObligation

% proof status:−)
minus_ptr_typ_is_Cpp_Type : Lemma
Forall (typ : Cpp_Subtype(cv(
Lambda (p : (pointer?)) : Not void?(typ(p)) And
Not function?(typ(p))))) :
Cpp_Type?(typ(cv_base(typ)))
% proof status:−)
% minus_ptr_ptr_TCC1 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC2 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC3 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC4 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC5 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC6 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC7 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC8 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC9 : TCCObligation
% proof status:−)
% minus_ptr_ptr_TCC10 : TCCObligation
minus_ptr_ptr (typ : Cpp_Subtype(cv(
Lambda (p : (pointer?)) : Not void?(typ(p)) And
Not function?(typ(p)))))
(p_ex1, p_ex2: ET[State, (range_pointer(cv_base(typ)))]) :
ET[State, (range(int))] =

(

p_ex1## lambda (ptr_val1: (range_pointer(cv_base(typ)))) :
p_ex2## lambda (ptr_val2: (range_pointer(cv_base(typ)))) :
If (array?(typ(cv_base(typ))) Implies size_of(typ(cv_base(typ))) > 0) And
% otherwisewe substractpointerto incompletearrays
not_null?(typ)(ptr_val1) And
not_null?(typ)(ptr_val2) And
same_array(typ)(ptr_val1, ptr_val2) And
up?(address_of(typ)(ptr_val1)) And
up?(address_of(typ)(ptr_val2))

Then

Let difference = ndiv(offset(down(address_of(typ)(ptr_val1))) −
offset(down(address_of(typ)(ptr_val2))),
size_of(typ(cv_base(typ)))) In
If range(int)(difference) Then
ok_result(difference)

Else

fatal_result Endif

Else

fatal_result Endif

)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Shift Operators
% =================
% 5.8 pt 1: "The behavioris undefinedif the rightoperandis negative, or
% greaterthan or equal to the lengthin bits of the promotedleft operand."
% We do not (yet) model the latter.

%

% We do not model that the resultis implementation−definedif the first
% operandhas a signed type(for <<). The resultof >> is
% implementation−definedif the firstoperandhas a signed typeand a
% negativevalue; below we requirethe firstoperandto be nonnegative.
% 5.8 pt 1
% typeof result= typeof promotedleft operand(i.e., int, uint, long,
% ulong, longlong, ulonglong)
% undefinedif E2 < 0 or E2 > lengthin bits (max_value_bits )

% 5.8 pt 2
% E1 unsigned: mod(typ(E1))(E1 << n) otherwisefrom_byte(to_byte(E1) << n)

% 5.8 pt 3
% E1 unsigned: mod(typ(E1))(E1 >> n) if E1 >= 0 ; E1 < 0 => implementation
% definedvalue
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Rationaloperators
% ====================
cmp(i_typ, (R : PRED[[real, real]]))
(n1_ex, n2_ex: ET[State, (range(i_typ))]) : ET[State, bool] =

(

n1_ex## lambda (n1 : (range(i_typ))):
n2_ex## lambda (n2 : (range(i_typ))):

ok_result(R(n1, n2))

)

% To do: cmp ops for float
% 5.9 <
lt(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, bool] =
cmp(i_typ, <)(n1_ex, n2_ex)
% 5.9 >
gt(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, bool] =
cmp(i_typ, >)(n1_ex, n2_ex)
% 5.9 <=
le(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, bool] =
cmp(i_typ, <=)(n1_ex, n2_ex)
% 5.9 >=
ge(i_typ)(n1_ex, n2_ex: ET[State, (range(i_typ))]) :
ET[State, bool] =
cmp(i_typ, >=)(n1_ex, n2_ex)
% proof status:−)
% cmp_pointer_TCC1: TCCObligation
% proof status:−)
% cmp_pointer_TCC2: TCCObligation
% Rationaloperatorsfor pointers
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
% 5.9
cmp_pointer(p_typ: Cpp_Subtype(cv(pointer?)), R : PRED[[real, real]],
cmp_null: bool)
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =

(

p1_ex## lambda (ptr_val1: (range_pointer(cv_base(p_typ)))) :
p2_ex## lambda (ptr_val2: (range_pointer(cv_base(p_typ)))) :
If not_null?(p_typ)(ptr_val1) And
not_null?(p_typ)(ptr_val2) Then
If same_array(p_typ)(ptr_val1, ptr_val2) And
up?(address_of(p_typ)(ptr_val1)) And
up?(address_of(p_typ)(ptr_val2))

Then

ok_result(R(offset(down(address_of(p_typ)(ptr_val1))),
offset(down(address_of(p_typ)(ptr_val2)))))

Else

fatal_result Endif

B.14 expressions.pvs

Else

ok_result(cmp_null)

Endif )

lt_ptr(p_typ: Cpp_Subtype(cv(pointer?)))
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =
cmp_pointer(p_typ, <, false)(p1_ex, p2_ex)
gt_ptr(p_typ: Cpp_Subtype(cv(pointer?)))
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =
cmp_pointer(p_typ, >, false)(p1_ex, p2_ex)
le_ptr(p_typ: Cpp_Subtype(cv(pointer?)))
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =
cmp_pointer(p_typ, <=, true)(p1_ex, p2_ex)
ge_ptr(p_typ: Cpp_Subtype(cv(pointer?)))
(p1_ex, p2_ex: ET[State, (range_pointer(cv_base(p_typ)))]) :
ET[State, bool] =
cmp_pointer(p_typ, >=, true)(p1_ex, p2_ex)
% Rationaloperatorsfor pointersto members
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
% 5.9 pt 2
% "If two pointerspointto nonstaticdata membersof the same
% object, or to subobjectsor arrayelementsof such members,
% recursively, the pointerto the laterdeclaredmembercompares
% greaterprovidedthe two membersare not separatedby an
% access−specifierlabeland providedtheirclass is not a union."
END ArithmeticExpressions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.10: Equalityoperators

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
EqualityExpressions[State, Data : Type] : THEORY

BEGIN

IMPORTING ArithmeticExpressions
% C++’ s == operator
eq(l_ex, r_ex: ET[State, Data]) :
ET[State, bool] =

(

l_ex## lambda (l : Data) :

B PVS Theory Sources

r_ex## lambda (r : Data) :
ok_result((l = r))

);

% C++’ s != operator
not_equal(l_ex, r_ex: ET[State, Data]) :
ET[State, bool] =

(

l_ex## lambda (l : Data) :
r_ex## lambda (r : Data) :
ok_result((l /= r))

);

% to do: pointersto the same function
% to do: 5.10 pt 2 pointersto members
END EqualityExpressions
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.11: BitwiseANDoperator
% 5.12: BitwiseexclusiveORoperator
% 5.13: BitwiseinclusiveORoperator

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
BitwiseExpressions[State : Type] : THEORY

BEGIN

Importing Ok_Result_Rewrite , Cpp_Types
typ : Var Cpp_Subtype(cv(non_bool_integral_enum ?))
% 5.11. bit and &
bitand(typ)(n1_ex, n2_ex: ET[State, (range(typ))]) :
ET[State, (range(typ))] =

(

n1_ex## lambda (n1 : (range(typ))) :
n2_ex## lambda (n2 : (range(typ))) :
% Because dt(typ) is a pod for all of these typeswe can take any address:
% Mem(0)
Let a = Mem(0),
bitand_value=
from_byte(dt(typ))(
apply_bitop_valuefield (value_bitmask(typ), Lambda (l : list[Byte]):
binary_and(l, to_byte(dt(typ))(n2, a)))
(to_byte(dt(typ))(n1, a)), a)

In

If up?(bitand_value) And range(typ)(down(bitand_value)) Then
ok_result(down(bitand_value))

Else

fatal_result Endif

)

% 5.12. bit xor ^
bitxor(typ)(n1_ex, n2_ex: ET[State, (range(typ))]) :
ET[State, (range(typ))] =

(

n1_ex## lambda (n1 : (range(typ))) :
n2_ex## lambda (n2 : (range(typ))) :
% Because dt(typ) is a pod for all of these typeswe can take any address:
% Mem(0)
Let a = Mem(0),
bitxor_value=
from_byte(dt(typ))(
apply_bitop_valuefield (value_bitmask(typ), Lambda (l : list[Byte]):
binary_xor(l, to_byte(dt(typ))(n2, a)))
(to_byte(dt(typ))(n1, a)), a)

In

If up?(bitxor_value) And range(typ)(down(bitxor_value)) Then
ok_result(down(bitxor_value))

Else

fatal_result Endif

)

% 5.13. bit or |
bitor(typ)(n1_ex, n2_ex: ET[State, (range(typ))]) :
ET[State, (range(typ))] =

(

n1_ex## lambda (n1 : (range(typ))) :
n2_ex## lambda (n2 : (range(typ))) :
% Because dt(typ) is a pod for all of these typeswe can take any address:
% Mem(0)
Let a = Mem(0),
bitor_value=
from_byte(dt(typ))(
apply_bitop_valuefield (value_bitmask(typ), Lambda (l : list[Byte]):
binary_or(l, to_byte(dt(typ))(n2, a)))
(to_byte(dt(typ))(n1, a)), a)

In

If up?(bitor_value) And range(typ)(down(bitor_value)) Then
ok_result(down(bitor_value))

Else

fatal_result Endif

)

END BitwiseExpressions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.14: LogicalANDoperator
% 5.15: LogicalORoperator

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% !! left−to−rightevaluationis guaranteedonlyfor base types!!
LogicalExpressions[State : Type] : THEORY

BEGIN

IMPORTING Ok_Result_Rewrite , Cpp_Types
l_ex, r_ex, ex : VAR [State −> ExprResult[State, bool]]
% 5.14
% C++’ s && operator
and_exp(l_ex, r_ex) : [State −> ExprResult[State, bool]] =

(

l_ex## lambda (l : bool):
if l then
r_ex## lambda (r : bool):
ok_result(l and r)

else

% 5.14.1: "Unlike&, && guaranteesleft−to−rightevaluation: the second
% operandis not evaluatedif the firstoperandis false."
ok_result(false)

endif )

% 5.15
% C++’ s || operator
or_exp(l_ex, r_ex) : [State −> ExprResult[State, bool]] =

(

l_ex## lambda (l : bool):
if l then
% 5.15.1: "Unlike|, || guaranteesleft−to−rightevaluation; moreover,
% the second operandis not evaluatedif the firstoperandevaluatesto
% true."
ok_result(true)

else

r_ex## lambda (r : bool):
ok_result(l or r)

endif )

END LogicalExpressions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.16: Conditionaloperator

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ConditionalExpression[State, Data : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain , Cpp_Types
pm : VAR Plain_Memory[State]
d_ex1: VAR [State −> ExprResult[State, Data]]
d_ex2: VAR [State −> ExprResult[State, Data]]
b_ex: VAR [State −> ExprResult[State, bool]]
% C++’ s b_ex? d_ex1: d_ex2
conditional_expr(b_ex, d_ex1, d_ex2) : [State −> ExprResult[State, Data]] =

(

b_ex## lambda (b : bool) :
If b Then

d_ex1 Else

d_ex2 Endif

);

% Not modelled:
% 5.16 pt 2: one but not both expressionsis voidand is a throwexpression
% 5.16 pt 2 − pt 6: restrictionson conversionsand restrictionson these.
End ConditionalExpression

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.17: Assignmentoperators

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
AssignmentExpressions[State : Type] : THEORY

BEGIN

IMPORTING ArithmeticExpressions, BitwiseExpressions
pm : VAR Plain_Memory[State]
AET : Type = [State −> ExprResult[State, Address]]
a_ex: Var AET
p_typ: Var Cpp_Subtype(v(pointer?))
i_typ: Var Cpp_Subtype(v(non_bool_integral_enum ?))
ci_typ: Var Cpp_Subtype(cv(non_bool_integral_enum ?))

% 5.17.7: "The behaviorof an expressionof the form E1 op= E2 is equivalent
% to E1 = E1 op E2 exceptthat E1 is evaluatedonlyonce."
% the resultof the second expressioncan be of const(a_typ)
% proof status:−)
% assign_times_TCC1: TCCObligation
% C++’ s ∗= operator
assign_times(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
times(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% To do: assign_times_float
% C++’ s /= operator
assign_div(pm, i_typ)
(a_ex: AET, n_ex: ET[State, (range(i_typ))]) : ET[State, Address] =

(

a_ex## lambda (a : Address):
div(i_typ)
(read_data(pm, dt(i_typ))(a), n_ex) ## lambda (n : (range(i_typ))) :
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% To do:
% assign_div_float (pm, f_typ)
% (a_ex: AET, n_ex: ET[State, (range(f_typ))]) : ET[State, Address] =
% (
% a_ex## lambda(a : Address):
% div_float(f_typ)
% (read_data(pm, dt(f_typ))(a), n_ex) ## lambda(n : (range(f_typ))) :
% write_data(pm, dt(f_typ))(a, n) ##
% ok_result(a)
% )
% C++’ s %= operator
assign_mod(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
mod(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##

ok_result(a)

)

% C++’ s += operator
assign_plus(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
plus(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% To do: assign_plus_float
% proof status:−)
% assign_plus_ptr_TCC1 : TCCObligation
% proof status:−)
% assign_plus_ptr_TCC2 : TCCObligation
assign_plus_ptr (pm, p_typ, ci_typ)(a_ex: AET,
n_ex: ET[State, (range(ci_typ))]) : ET[State, Address] =

(

a_ex##
lambda (a : Address):
plus_ptr(p_typ, ci_typ)(read_data(pm, dt_cv_pointer (p_typ))(a), n_ex) ##
lambda (n : (range_pointer(cv_base(p_typ)))):
write_data(pm, dt_cv_pointer (p_typ))(a, n) ##
ok_result(a)

)

% C++’ s −= operator
assign_minus(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
minus(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% To do: assign_minus_float
assign_minus_ptr (pm, p_typ, ci_typ)(a_ex: AET,
n_ex: ET[State, (range(ci_typ))]) : ET[State, Address] =

(

a_ex## lambda (a : Address):
minus_ptr(p_typ, ci_typ)(read_data(pm, dt_cv_pointer (p_typ))(a), n_ex) ##
lambda (n : (range_pointer(cv_base(p_typ)))) :

write_data(pm, dt_cv_pointer (p_typ))(a, n) ##
ok_result(a)

)

% C++’ s &= operator
assign_bitand(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
bitand(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))) :
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% C++’ s ^= operator
assign_bitxor(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
bitxor(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

% C++’ s |= operator
assign_bitor(pm, i_typ)(a_ex: AET, n_ex: ET[State, (range(i_typ))]) :
ET[State, Address] =

(

a_ex## lambda (a : Address):
bitor(i_typ)(read_data(pm, dt(i_typ))(a), n_ex) ##
lambda (n : (range(i_typ))):
write_data(pm, dt(i_typ))(a, n) ##
ok_result(a)

)

END AssignmentExpressions
AssignmentExpressions2[State, Data : Type] : Theory

Begin

Importing AssignmentExpressions
% Note that the assignmentoperatorsreturnan lvalue(i.e. an address).
% We define assignmentoperatorsonlyfor non class types.
% 5.17 pt 4 "Assignmentto objects of a class is definedby the copy
% assignmentoperator".
% Not modelled: 5.17 pt 8 restrictionson overlappingobjects

pm : VAR Plain_Memory[State]
AET : Type = [State −> ExprResult[State, Address]]
a_ex: Var AET
% C++’ s = operator
assign(pm, (idt : (interpreted_data_type ?[Data])))
(a_ex: AET, d_ex: ET[State, Data]) : ET[State, Address] =

(

a_ex## lambda (a : Address):
d_ex## lambda (d : Data) :
write_data(pm, idt)(a, d) ##
ok_result(a)

)

END AssignmentExpressions2

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 5.18: Commaoperator

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
CommaExpressions[State, Data1, Data2 : Type] : THEORY

BEGIN

IMPORTING Ok_Result_Rewrite
l_ex: VAR [State −> ExprResult[State, Data1]]
r_ex: VAR [State −> ExprResult[State, Data2]]
% C++’ s , operator
comma(l_ex, r_ex) : [State −> ExprResult[State, Data2]] =
(l_ex## r_ex)
END CommaExpressions

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Expressions: importseverything

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Expressions[State : Type] : THEORY

BEGIN

IMPORTING PrimaryExpressions,
% PostfixExpressions ,
% UnaryExpressions ,
PointerToMemberExpressions,

% ArithmeticExpressions ,
EqualityExpressions,
% BitwiseExpressions ,
LogicalExpressions,
ConditionalExpression,
% AssignmentExpressions ,
AssignmentExpressions2,

CommaExpressions

END Expressions

B.15 graph.pvs

Graph_Util[T : Type] : Theory
% variousgeneralstuff needed for graphs

Begin

Importing More_List_Props , More_Function
% proof status:−)
every_nth: Lemma Forall(P : PRED[T], l : list[T]) :
every(P)(l) IFF (Forall(i : below(length(l))) : P(nth(l, i)))

% proof status:−)
% nth_append_left_TCC1 : TCCObligation
% proof status:−)
nth_append_left: Lemma
Forall(l1, l2 : list[T], n : nat) :
n < length(l1) Implies
nth(append(l1, l2), n) = nth(l1, n)
% proof status:−)
% nth_append_right_TCC1 : TCCObligation
% proof status:−)
nth_append_right: Lemma
Forall(l1, l2 : list[T], n : nat) :
n >= length(l1) And n < length(append(l1, l2)) Implies
nth(append(l1, l2), n) = nth(l2, n − length(l1))

% proof status:−)
list_pred_card: Lemma
Forall(l : list[T], P : PRED[T]) :
is_finite(P) And every(P)(l) And length(l) > card(P) Implies
Exists(n1, n2 : below(length(l))) :
Not n1 = n2 And
nth(l, n1) = nth(l, n2)

B.15 graph.pvs

% A path_listis a list withat least one element. A one
% elementpath is an (pointed) emptypath.
% Forthe transitiveclosurewe have of course to take path
% withat least two elements.
path_list?(l : list[T]) : bool = length(l) >= 1
% proof status:−)
% path_start_TCC1: TCCObligation
path_start(l : (path_list?)) : T = car(l)
% proof status:−)
% path_end_TCC1: TCCObligation
path_end(l : (path_list?)) : T = nth(l, length(l) −1)
% proof status:−)
% path_list_induction_TCC1 : TCCObligation
% proof status:−)
% path_list_induction_TCC2 : TCCObligation
% proof status:−)
path_list_induction : Lemma
Forall(p: [(path_list?) −> boolean]):
(Forall(t : T) : p(cons(t, null))) And
(Forall(t : T, tail : (path_list?)): p(tail) Implies p(cons(t, tail)))

Implies

Forall (l : (path_list?)): p(l)

concatable?(left, right : list[T]) : bool =
path_list?(left) And path_list?(right) And
path_end(left) = path_start(right)
% proof status:−)
% concat_path_TCC1: TCCObligation
% proof status:−)
% concat_path_TCC2: TCCObligation
concat_path(lr : (concatable?)) : (path_list?) =
append(Proj_1(lr), cdr(Proj_2(lr)))
% proof status:−)
length_concat_path: Lemma
Forall(l, r : list[T]) : concatable?(l, r) Implies
length(concat_path(l, r)) = length(l) + length(r) −1
End Graph_Util

Subtype_stable[T : Type] : Theory

Begin

l : Var list[T]
P : Var PRED[T]
% proof status:−)
length_stable: Lemma
every(P)(l) Implies length[(P)](l) = length[T](l)
% proof status:−)
% nth_stable_TCC1: TCCObligation
% proof status:−)
nth_stable: Lemma Forall(n : below(length(l))) :
every(P)(l) Implies
nth[(P)](l, n) = nth[T](l,n)
End Subtype_stable

Graph_Relations[T : Type] : Theory

Begin

Importing Graph_Util
R : Var PRED[[T,T]]
transitive_closure(R) : PRED[[T, T]] = Lambda(x, y : T) :
Forall(Q : PRED[[T, T]]) : subset?(R, Q) And transitive?(Q) Implies
Q(x,y)
% proof status:−)
% trans_closure_char_TCC1 : TCCObligation
% proof status:−)
% trans_closure_char_TCC2 : TCCObligation
% proof status:−)
% trans_closure_char_TCC3 : TCCObligation
% proof status:−)
trans_closure_char: Lemma
Forall(x, y : T) :
transitive_closure(R)(x,y) IFF
Exists(l : list[T]) :
length(l) >= 2 And
path_start(l) = x And path_end(l) = y and
Forall(i : below(length(l) −1)) : R(nth(l, i), nth(l, i+1))
End Graph_Relations

Graph[T : Type] : Theory

B.15 graph.pvs

Begin

Importing Graph_Relations, Subtype_stable
graph_type: Type = [#
nodes : PRED[T],
edges : PRED[[(nodes), (nodes)]]

#]

g : Var graph_type
% proof status:−)
% path?_TCC1: TCCObligation
% proof status:−)
% path?_TCC2: TCCObligation
% proof status:−)
% path?_TCC3: TCCObligation
% proof status:−)
% path?_TCC4: TCCObligation
path?(g)(l : (path_list?[T])) : bool =
(Forall(i : below(length(l))) : g‘nodes(nth(l, i))) And
(Forall(i : below(length(l) −1)) : g‘edges(nth(l,i), nth(l, i+1)))
% proof status:−)
nodes_path_start: Lemma
Forall(p : (path?(g))) : g‘nodes(path_start(p))
% proof status:−)
nodes_path_end: Lemma
Forall(p : (path?(g))) : g‘nodes(path_end(p))
% proof status:−)
% path_head_TCC1: TCCObligation
% proof status:−)
path_head: Lemma
Forall(p : (path?(g)), n : upto(length(p))) :
n >= 1 Implies
path?(g)(head(p, n))
% proof status:−)
% path_tail_TCC1: TCCObligation
% proof status:−)
path_tail: Lemma
Forall(p : (path?(g)), n : upto(length(p))) :
length(p) − n >= 1 Implies
path?(g)(tail(p, n))

% proof status:−)
% path_cdr_TCC1: TCCObligation
% proof status:−)
path_cdr: Lemma
Forall(p : (path?(g))) :
path_list?[T](cdr(p)) Implies path?(g)(cdr(p))

% proof status:−)
path_concat_path: Lemma
Forall(p1, p2 : (path?(g))) : concatable?(p1, p2) Implies
path?(g)(concat_path(p1, p2))

cycle_free?(g) : bool =
Forall(x : T) : g‘nodes(x) Implies
Not transitive_closure(g‘edges)(x, x)

% proof status:−)
trans_closure_char_graph : Lemma
Forall(x, y : (g‘nodes)) :
transitive_closure(g‘edges)(x,y) IFF
Exists(l : (path?(g))) :
length(l) >= 2 And
path_start(l) = x And path_end(l) = y

% proof status:−)
path_cycle_free: Lemma
cycle_free?(g) IFF
Forall(l : (path?(g)), i1, i2 : below(length(l))) :
nth(l, i1) = nth(l, i2) Implies i1 = i2
% proof status:−)
different_nodes_on_edge : Lemma
Forall(x, y : (g‘nodes)) :
cycle_free?(g) And
g‘edges(x, y) Implies
Not x = y
% set of roots of a graph
roots(g) : PRED[(g‘nodes)] =
{y : (g‘nodes) | Forall(x : (g‘nodes)) : Not g‘edges(x,y) }

% A tree is cycle free and each node has at most one predecessor.
tree?(g) : bool =
cycle_free?(g) And
Forall(x, y, z : (g‘nodes)) :
g‘edges(x,z) And g‘edges(y,z) Implies x = y

% In a tree there is onlyone path going up from a certainnode.
% So any two path endingin the same node onlydifferin theirlength.
% proof status:−)
tree_path: Lemma
Forall(p1, p2 : (path?(g))) :
tree?(g) And
path_end(p1) = path_end(p2) And
length(p1) = length(p2) Implies
p1 = p2
% a graphis finiteif its set of nodes is
finite?(g) : bool = is_finite(g‘nodes)
finite_tree?(g) : bool = finite?(g) and tree?(g)
% proof status:−)
% root_path_TCC1: TCCObligation
root_path(g : graph_type, n : (g‘nodes)) : PRED[(path?(g))] =
Lambda(p : (path?(g))) :
roots(g)(path_start(p)) And path_end(p) = n
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% singletonroot_path

%

% In finitetrees there is for everynode preciselyone
% path upwardsto a root (root_path). Thisis provedin the following
% and then the functionpath_to_rootis defined(via selectionout of
% a singleton).

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% path_length_bound_TCC1 : TCCObligation
% proof status:−)
path_length_bound: Lemma
finite?(g) and cycle_free?(g) Implies
Forall(p : (path?(g))) : length(p) <= card(g‘nodes)
% proof status:−)
non_root_path: Lemma
Forall(n : (g‘nodes)) : roots(g)(n) OR
Exists(p : (path?(g))) : length(p) = 2 And path_end(p) = n
% proof status:−)
% non_root_path_extend_TCC1 : TCCObligation
% proof status:−)
non_root_path_extend : Lemma

Forall(p : (path?(g))) : roots(g)(path_start(p)) OR
Exists(q : (path?(g))) :
length(q) = length(p) + 1 And
path_end(q) = path_end(p)
% proof status:−)
tree_path_to_root : Lemma
finite_tree?(g) Implies
Forall(n : (g‘nodes)) :
Exists(p : (path?(g))) : root_path(g, n)(p)
% proof status:−)
tree_unique_path_to_root : Lemma
Forall(n : (g‘nodes), p1, p2 : (path?(g))) :
tree?(g) And root_path(g, n)(p1) And root_path(g, n)(p2)

Implies

p1 = p2
% proof status:−)
root_path_singleton: Lemma Forall(n: (g‘nodes)) :
finite_tree?(g) Implies
singleton?(root_path(g, n));
% proof status:−)
% path_to_root_TCC1: TCCObligation
path_to_root (g : (finite_tree?), n : (g‘nodes)) : (root_path(g, n)) =
the(root_path(g, n))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Path factoring. Everytwo path that startwiththe same node
% have the same initialsequence.

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% path_factor_TCC1: TCCObligation
% proof status:−)
% path_factor_TCC2: TCCObligation
% proof status:−)
% path_factor_TCC3: TCCObligation
% proof status:−)
% path_factor_TCC4: TCCObligation
% proof status:−)
path_factor: Lemma Forall (p1, p2 : (path?(g))) :
path_start(p1) = path_start(p2) And

(Exists(n : nat) : n < length(p1) And n < length(p2) And
NOT nth(p1, n) = nth(p2, n))

Implies

Exists(q, p1t, p2t : (path?(g))) :
concatable?(q, p1t) And concatable?(q, p2t) And
length(p1t) >= 2 And length(p2t) >= 2 And
p1 = concat_path(q, p1t) And
p2 = concat_path(q, p2t) And
nth(p1t, 0) = nth(p2t, 0) And
NOT nth(p1t, 1) = nth(p2t, 1)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Node case distinction. Two nodes n1 and n2 can be relatedin the
% followingway:

%

% − theyare equal
% − n1 layson the root path of n2
% − n2 layson the root path of n1
% − the two root path lead to differentroots
% (in this case the two root path are totallydistinct)
% − the two root path meet at some node n3
% (in this case the two root path go to the same root)

%

% Thisdistinctionis completeand can be used to provean arbitrary
% predicatefor all pairsof nodes.

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% node_pair_distinction_TCC1 : TCCObligation
% proof status:−)
node_pair_distinction: Lemma
Forall(P : PRED[[(g‘nodes), (g‘nodes)]]) :
finite_tree?(g) And
(Forall(n : (g‘nodes)) : P(n, n))

And

(Forall(n1, n2 : (g‘nodes), p : (path?(g))) :
NOT n1 = n2 And
path_start(p) = n2 And path_end(p) = n1 And length(p) >= 2 Implies
P(n1, n2))

And

(Forall(n1, n2 : (g‘nodes), p : (path?(g))) :
NOT n1 = n2 And
path_start(p) = n1 And path_end(p) = n2 And length(p) >= 2 Implies
P(n1, n2))

And

(Forall(n1, n2 : (g‘nodes), p1, p2 : (path?(g))):
NOT n1 = n2 And root_path(g, n1)(p1) And root_path(g, n2)(p2) And
NOT path_start(p1) = path_start(p2) Implies

P(n1, n2))

And

(Forall(n1, n2, n3 : (g‘nodes), p1, p2 : (path?(g))):
NOT n1 = n2 And NOT n1 = n3 And NOT n2 = n3 And
g‘edges(n3, path_start(p1)) And g‘edges(n3, path_start(p2)) And
path_end(p1) = n1 And path_end(p2) = n2 And
NOT path_start(p1) = path_start(p2) Implies
P(n1, n2))

Implies

Forall(n1, n2 : (g‘nodes)) : P(n1, n2)

% Variantfor symmetricP, whichleavesout the case of
% − n2 layson the root path of n1
% proof status:−)
% symmetric_node_pair_distinction_TCC1 : TCCObligation
% proof status:−)
symmetric_node_pair_distinction : Lemma
Forall(P : PRED[[(g‘nodes), (g‘nodes)]]) :
finite_tree?(g) And
symmetric?(P) And
(Forall(n : (g‘nodes)) : P(n, n))

And

(Forall(n1, n2 : (g‘nodes), p : (path?(g))) :
NOT n1 = n2 And
path_start(p) = n2 And path_end(p) = n1 And length(p) >= 2 Implies
P(n1, n2))

And

(Forall(n1, n2 : (g‘nodes), p1, p2 : (path?(g))):
NOT n1 = n2 And root_path(g, n1)(p1) And root_path(g, n2)(p2) And
NOT path_start(p1) = path_start(p2) Implies
P(n1, n2))

And

(Forall(n1, n2, n3 : (g‘nodes), p1, p2 : (path?(g))):
NOT n1 = n2 And NOT n1 = n3 And NOT n2 = n3 And
g‘edges(n3, path_start(p1)) And g‘edges(n3, path_start(p2)) And
path_end(p1) = n1 And path_end(p2) = n2 And
NOT path_start(p1) = path_start(p2) Implies
P(n1, n2))

Implies

Forall(n1, n2 : (g‘nodes)) : P(n1, n2)
End Graph

B.16 hoare.pvs

% $Id: hoare.pvs,v 1.8.8.1.2.2 2008/05/14 14:24:58 tews Exp$

%

% Author: TjarkWeber
% (c) 2007 RadboudUniversity

B.16 hoare.pvs

%

% Hoare logics for our shallowC++ embedding.
Hoare[State: Type] : THEORY

BEGIN

IMPORTING State_Transformer
P : VAR PRED[State]
c : VAR [State −> StmtResult[State]]
C : VAR [StmtResult[State] −> StmtResult[State]]
Q : VAR PRED[State]
R : Var PRED[State]
% CurrentlyHoare tripleswithliftedstatements
% {P} C {Q}
% are not used. Theymay be useful to considerpartialprogramson
% intermediatestates (i.e. to verifyprogramscompositionally), but
% otherwise, since programsare simplestatementsoperatingon states
% (ratherthan on StmtResults), onlyHoare triples
% {P} c {Q}
% are needed.
s : VAR State
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Partialcorrectness: if the resultis OK, it must satisfythe postcondition

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% valid_TCC1: TCCObligation
% proof status:−)
% valid_TCC2: TCCObligation
valid(P, c, Q) : bool =
forall s: P(s) and OK?(c(s)) implies Q(state(c(s)))
% proved− complete
% valid_TCC1
valid(P, C, Q) : bool =
forall s: P(s) and OK?(C(OK(s))) implies Q(state(C(OK(s))))
% proved− complete
% valid_TCC2
% proof status:−)
valid_and: Lemma
valid(P, c, Q) And valid(P, c, R)

B PVS Theory Sources

Implies

valid(P, c, Lambda (s : State) : Q(s) And R(s))
% proof status:−)
valid_implied: Lemma
valid(P, c, Q) And valid(P, c, Lambda (s : State) : Q(s) Implies R(s))

Implies

valid(P, c, Lambda (s : State) : Q(s) And R(s))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Total correctness: resultmust be OK and satisfythe postcondition

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Valid(P, c, Q) : bool =
forall s: P(s) implies OK?(c(s)) and Q(state(c(s)))
Valid(P, C, Q) : bool =
forall s: P(s) implies OK?(C(OK(s))) and Q(state(C(OK(s))))
% proof status:−)
Valid_and: Lemma
Valid(P, c, Q) And Valid(P, c, R)

Implies

Valid(P, c, Lambda (s : State) : Q(s) And R(s))
END Hoare

B.17 linear_memory.pvs

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Splitrange into list of alignedchunks

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% To do: move to prelude
List_Split: Theory

Begin

Importing IA32, More_List_Props , Alignment
% split
% −−−−−−−
% | a a1 a2 a3 |
% | −−|−−−−−−|−−−−−−|−−− |
% =>
% (a, −−), (a1, −−−−−−), (a2, −−−−−−), (a3, −−−), null

B.17 linear_memory.pvs

% proof status:−)
% split_TCC1: TCCObligation
% proof status:−)
% split_TCC2: TCCObligation
split(size : nat, a : Address, bl : list[Byte]) :
Recursive list[[Address, list[Byte]]] =
Let e2size = expt(2, size) In
If null?(bl) Then null Else
If a + length(bl) <= floor(e2size)(a) + e2size Then
cons( (a, bl), null)

Else

Let delta = rem(e2size)(offset(a)) In
cons( (a, head(bl, e2size − delta)),
split(size, floor(e2size)(a) + e2size, tail(bl, e2size − delta)))

Endif Endif

Measure length(bl)
% some correctnesslemmas
% proof status:−)
split_pair_cross_size : Lemma
Forall (size : nat, a1 : Address, bl1 : list[Byte], n : nat) :
Let e2size = expt(2, size) In
n = length(bl1) Implies
every(Lambda(a2 : Address, bl2 : list[Byte]) :
rem(e2size)(offset(a2)) + length(bl2) <= e2size
)(split(size, a1, bl1))
% proof status:−)
split_pair_concat: Lemma
Forall (size : nat, a : Address, bl : list[Byte], n : nat) :
Let e2size = expt(2, size) In
n = length(bl) Implies
reduce(null,
Lambda (e : [Address, list[Byte]], tail : list[Byte]) :
Let head = e‘2 In
append(head, tail))(split(size, a, bl)) = bl
% proof status:−)
split_range: Lemma
Forall (size : nat, a : Address, bl : list[Byte], n : nat) :
Let e2size = expt(2, size) In
n = length(bl) Implies
every(Lambda (a2 : Address, bl2 : list[Byte]) :
a <= a2 And a2 + length(bl2) <= a + n)(split(size, a, bl))
% proof status:−)
split_no_null: Lemma
Forall (size : nat, a : Address, bl : list[Byte], n : nat) :

Let e2size = expt(2, size) In
n = length(bl) And cons?(bl) Implies
every(Lambda (a2 : Address, bl2 : list[Byte]) : cons?(bl2))
(split(size, a, bl))
% proof status:−)
split_null: Lemma
Forall (size : nat, a : Address) : split(size, a, null) = null
% proof status:−)
% split_type_TCC1: TCCObligation
% proof status:−)
% split_type_TCC2: TCCObligation
% proof status:−)
split_type: Lemma
Forall (size : nat, a : Address, bl : list[Byte], n : nat) :
reg_base(min_linear)(type_of(a)) <= a And
a + length(bl) <= reg_size(max_linear)(type_of(a))

Implies

every(LAMBDA (t: [Address, list[Byte]]):
type_of(t‘1) = type_of(a) And
reg_base(min_linear)(type_of(a)) <= t‘1 And
t‘1 < reg_size(max_linear)(type_of(a)))
(split(min_page, a, bl))
End List_Split
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% LinearMemory

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% to do: avoidpaging_data_type
Linear_Memory[Physical_memory: Type,
(Importing Plain_Memory[Physical_memory])
pm : Plain_Memory] : Theory

Begin

Importing Paging_Datatype,

PDBR_Datatype

,

Segment_Reg_Datatype

,

Address_Datatype

Importing Abstract_Read_Write_Plain ,

List_Split

Linear_memory: Type = Physical_memory

s : Var Linear_memory
a : Var Address
access : Var Memory_access
b : Var Byte
size : Var nat
% ProtectedInterface
% =====================
bits_per_level: nat = 10
pdir_lvl: nat = 0
ptab_lvl: nat = 1
% proof status:−)
% xlat_idx_TCC1: TCCObligation
% proof status:−)
% xlat_idx_TCC2: TCCObligation
% computepe address/ offset
xlat_idx(lvl : Level, base, addr : Memory_Address_4G ) : Address =
base + shift_bits_left (cut_bits(offset(addr), bus_width− (lvl + 1) ∗
bits_per_level , bits_per_level ), pe_size)
% proof status:−)
% xlat_idx_pe_aligned_TCC1 : TCCObligation
% proof status:−)
% xlat_idx_pe_aligned_TCC2 : TCCObligation
% proof status:−)
xlat_idx_pe_aligned : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bits_per_level+ pe_size)(offset(base))

Implies

aligned?(pe_size)(offset(xlat_idx(lvl, base, addr)))
% proof status:−)
xlat_idx_memory_address : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bits_per_level+ pe_size)(offset(base))

Implies

xlat_idx(lvl, base, addr) < max_linear
% proof status:−)
xlat_idx_memory_address2 : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bits_per_level+ pe_size)(offset(base))

Implies

0 <= offset(xlat_idx(lvl, base, addr))

B PVS Theory Sources

xlat_ofs(lvl : Level, base, addr : Memory_Address_4G ) : Address =
base + cut_bits(offset(addr), 0, bus_width− (lvl + 1) ∗ bits_per_level )
% proof status:−)
xlat_ofs_memory_address : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bus_width− (lvl + 1) ∗ bits_per_level )(offset(base))

Implies

xlat_ofs(lvl, base, addr) < max_linear
% proof status:−)
xlat_ofs_memory_address2 : Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ) :
aligned?(bus_width− (lvl + 1) ∗ bits_per_level )(offset(base))

Implies

0 <= offset(xlat_ofs(lvl, base, addr))
% proof status:−)
% raise_fault_TCC1: TCCObligation
% raise fault
raise_fault(priv : Memory_privilege, access : Memory_access, present : bool,
pfa : Memory_Address_4G ) :
[Physical_memory−> ExprResult[Physical_memory, [bool, Address]]] =
write_data(pm, address_data_type )(CR2, pfa) ##
exception_result(Page_fault(
(# reserved_bit_violation:= false, % writingreservedbits is fatal
privilege := priv,
access := add(Read, access),
present := present

#)))

% proof status:−)
% translate_TCC1: TCCObligation
% single levelof the translation
translate(lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access, priv : Memory_privilege)
: [Physical_memory−> ExprResult[Physical_memory, [bool, Address]]] =
Let pe_addr= xlat_idx(lvl, base, addr) In
(read_data(pm, paging_data_type (lvl))(pe_addr) ##
Lambda (pe : (range_pt(lvl))) :
If paging_type?(lvl, pe) Then
If present?(pe) Then
If accessible?(pe, access) And privileged?(pe, priv) Then
write_data(pm, paging_data_type (lvl))(pe_addr,
set_reference(pe, access)) ##
ok_result( (is_leaf?(pe), base(pe)) )

Else

raise_fault(priv, access, true, addr)

Endif Else

raise_fault(priv, access, false, addr)

Endif Else

fatal_result

Endif)
% proof status:−)
translate_memory_address: Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access,
priv : Memory_privilege, s : Linear_memory) :
aligned?(bits_per_level+ pe_size)(offset(base)) And
OK?(translate(lvl, base, addr, access, priv)(s))

Implies

data(translate(lvl, base, addr, access, priv)(s))‘2 < max_linear
% proof status:−)
translate_memory_address2: Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access,
priv : Memory_privilege, s : Linear_memory) :
aligned?(bits_per_level+ pe_size)(offset(base)) And
OK?(translate(lvl, base, addr, access, priv)(s))

Implies

0 <= offset(data(translate(lvl, base, addr, access, priv)(s))‘2)

% proof status:−)
% translate_result_leaf_TCC1 : TCCObligation
% proof status:−)
% translate_result_leaf_TCC2 : TCCObligation
% !!! translate_result_leaf_TCC1 : originallong runningproof is nondefault!!
% proof status:−)
translate_result_leaf: Lemma
Forall (lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access,
priv : Memory_privilege, s : Linear_memory) :
aligned?(bits_per_level+ pe_size)(offset(base)) And
OK?(translate(lvl, base, addr, access, priv)(s)) And
data(translate(lvl, base, addr, access, priv)(s))‘1

Implies

aligned?(bus_width− bits_per_level∗ (lvl + 1))
(offset(data(translate(lvl, base, addr, access, priv)(s))‘2))
% proof status:−)
% translate_result_no_leaf_TCC1 : TCCObligation
% proof status:−)
translate_result_no_leaf : Lemma

Forall (lvl : Level, base, addr : Memory_Address_4G ,
access : Memory_access,
priv : Memory_privilege, s : Linear_memory) :
aligned?(bits_per_level+ pe_size)(offset(base)) And
OK?(translate(lvl, base, addr, access, priv)(s)) And
Not data(translate(lvl, base, addr, access, priv)(s))‘1

Implies

aligned?(bits_per_level+ pe_size)
(offset(data(translate(lvl, base, addr, access, priv)(s))‘2))

% proof status:−)
% linear_resolve_TCC1: TCCObligation
% proof status:−)
% linear_resolve_TCC2: TCCObligation
% proof status:−)
% linear_resolve_TCC3: TCCObligation
% proof status:−)
% linear_resolve_TCC4: TCCObligation
% proof status:−)
% linear_resolve_TCC5: TCCObligation
% proof status:−)
% linear_resolve_TCC6: TCCObligation
% proof status:−)
% linear_resolve_TCC7: TCCObligation
% proof status:−)
% linear_resolve_TCC8: TCCObligation
% translate
linear_resolve(addr : Memory_Address_4G , access : Memory_access)
: [Linear_memory−> ExprResult[Linear_memory, Address]] =
% 1. get currentprivilegelevelfrom cs
(read_data(pm, segment_reg_data_type )(CS) ##
Lambda (cs : Segment_Reg_type ) :
Let priv = segment_to_priv (cs) In
% 2. read PDBR
(read_data(pm, pdbr_data_type )(PDBR) ##
Lambda (pdbr : Pdbr_type) :
% 3. PDElookup
Let lvl = pdir_lvlIn
(translate(lvl, pdbr‘base_addr, addr, access, priv) ##
Lambda (leaf : bool,
base : {b : Memory_Address_4G|
If leaf Then
aligned?(bus_width− bits_per_level∗ (lvl + 1))(offset(b))

B.17 linear_memory.pvs

Else

aligned?(bits_per_level+ pe_size)(offset(b))
Endif}) :
If leaf Then
ok_result(xlat_ofs(lvl, base, addr))

Else

Let lvl = ptab_lvlIn
(translate(lvl, base, addr, access, priv) ##
Lambda (leaf : bool,
base : Memory_Address_4G ) :
ok_result(xlat_ofs(lvl, base, addr)))
Endif)))
% proof status:−)
linear_resolve_memory_address : Judgement
linear_resolve(addr : Memory_Address_4G , access : Memory_access) Has_Type
[Linear_memory−> ExprResult[Linear_memory, Memory_Address_4G ]]
% side effect helpers
linear_read_side_effect_in_page (a : Memory_Address_4G , bl : list[Byte])(s) :
ExprResult[Linear_memory, list[Byte]] =
(linear_resolve(a, Read) ##
Lambda(pa : Memory_Address_4G )(ns : Linear_memory) :
memory_read_side_effect (pm‘mem)(pa, bl, true)(s))(s)
linear_write_side_effect_in_page (a : Memory_Address_4G , bl : list[Byte])(s) :
ExprResult[Linear_memory, list[Byte]] =
(linear_resolve(a, Write) ##
Lambda(pa : Memory_Address_4G )(ns : Linear_memory) :
memory_write_side_effect (pm‘mem)(pa, bl, true)(s))(s)
apply_side_effects (l : list[[Memory_Address_4G , list[Byte]]],
f : [Memory_Address_4G , list[Byte] −>
[Linear_memory−> ExprResult[Linear_memory, list[Byte]]]])(s) :
ExprResult[Linear_memory, list[Byte]] =
reduce(ok_result(null),
Lambda (e : [Memory_Address_4G , list[Byte]],
r : [Linear_memory−> ExprResult[Linear_memory, list[Byte]]]) :
(r ##
Lambda (tail : list[Byte]) :
(f(e) ##
Lambda (head : list[Byte]) : ok_result(append(head, tail))))
)(l)(s)
% Note that the elementwiththe highestaddressis evaluatedfirst
% PublicInterface
% ==================
% proof status:−)
% linear_read_TCC1: TCCObligation
% proof status:−)

% linear_read_TCC2: TCCObligation
% proof status:−)
% linear_read_TCC3: TCCObligation
% read & write
linear_read(a) : [Linear_memory−> ExprResult[Linear_memory, Byte]] =
If in_memory(min_linear, max_linear)(a) Then
If Mem?(type_of(a)) Then
linear_resolve(a, Read) ##
Lambda (pa : Address) :
memory_read(pm‘mem)(pa)

Else

memory_read(pm‘mem)(a)

Endif Else

fatal_result Endif

linear_write(a, b) : [Linear_memory−> ExprResult[Linear_memory, Unit]] =
If in_memory(min_linear, max_linear)(a) Then
If Mem?(type_of(a)) Then
linear_resolve(a, Write) ##
Lambda (pa : Address) :
memory_write(pm‘mem)(pa, b)

Else

memory_write(pm‘mem)(a, b)

Endif Else

fatal_result Endif

% proof status:−)
% linear_read_side_effect_TCC1 : TCCObligation
% LinearSide Effects
linear_read_side_effect (a : Address, bl : list[Byte], cp : bool)(s)
: ExprResult[Linear_memory, list[Byte]] =
If null?(bl) Or
(reg_base(min_linear)(type_of(a)) <= a And
a + length(bl) <= reg_size(max_linear)(type_of(a))) Then
If Mem?(type_of(a)) Then
% splitlist in page containedlists
apply_side_effects (split(min_page, a, bl),
linear_read_side_effect_in_page )(s)

Else

memory_read_side_effect (pm‘mem)(a, bl, cp)(s)

Endif Else

Fatal Endif

B.18 memory.pvs

linear_write_side_effect (a : Address, bl : list[Byte], cp : bool)(s)
: ExprResult[Linear_memory, list[Byte]] =
If null?(bl) Or
(reg_base(min_linear)(type_of(a)) <= a And
a + length(bl) <= reg_size(max_linear)(type_of(a))) Then
If Mem?(type_of(a)) Then
% splitlist in page containedlists
apply_side_effects (split(min_page, a, bl),
linear_write_side_effect_in_page )(s)

Else

memory_write_side_effect (pm‘mem)(a, bl, cp)(s)

Endif Else

Fatal Endif

% The memorystruct
linear_pm: Memory_struct[Linear_memory] = (#
memory_read:= linear_read,
memory_write:= linear_write,
memory_read_side_effect := linear_read_side_effect ,
memory_write_side_effect := linear_write_side_effect

#)

END Linear_Memory

B.18 memory.pvs

% $Id: memory.pvs,v 1.55.6.1.4.3 2008/05/14 14:24:59 tews Exp$
Address_Util: Theory

Begin

IMPORTING IA32
IMPORTING More_Sets_Lemmas% for disjoint_mono
Importing More_List_Props
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% addressblocks

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% the set of addressesaddr<= a < addr+ size
address_block(addr : Address, size : nat) : PRED[Address] =
Lambda(a : Address) :
type_of(addr) = type_of(a) And
offset(addr) <= offset(a) AND
offset(a) < offset(addr) + size
% a lemmaneeded in the inductionbelow

% proof status:−)
address_block_subset_1 : Lemma Forall(addr : Address, size : nat) :
subset?(address_block(addr + 1, size),
address_block(addr, 1 + size))
% proof status:−)
address_block_subset_2 : Lemma
Forall(addresses : PRED[Address], addr : Address, size : nat) :
subset?(address_block(addr, size + 1), addresses) Implies
subset?(address_block(addr + 1, size), addresses)
blocks_disjoint?(addr1 : Address, size1 : nat,
addr2 : Address, size2 : nat) : bool =
type_of(addr1) /= type_of(addr2) Or
addr1 + size1 <= addr2 OR
addr2 + size2 <= addr1
% proof status:−)
blocks_disjoint_disjoint: Lemma
Forall (addr1, addr2 : Address, size1, size2 : nat) :
size1 > 0 And size2 > 0 Implies
blocks_disjoint?(addr1, size1, addr2, size2) =
disjoint?(address_block(addr1, size1), address_block(addr2, size2))
% proof status:−)
blocks_disjoint_symmetric: Lemma
Forall (addr1, addr2 : Address, size1, size2 : nat) :
blocks_disjoint?(addr1, size1, addr2, size2) =
blocks_disjoint?(addr2, size2, addr1, size1)

% proof status:−)
blocks_in_larger_set : Lemma
Forall (addr1, addr2 : Address, size1, size2 : nat,
addresses : PRED[Address]) :
subset?(address_block(addr1, size1), addresses) And
subset?(address_block(addr2, size2), addresses) And
blocks_disjoint?(addr1, size1, addr2, size2)

Implies

subset?(address_block(addr2, size2),
difference(addresses, address_block(addr1, size1)))

blocks_pairwise_disjoint (blocks : list[[Address, posnat]]) : bool =
Forall(addr_1, addr_2: Address, size_1, size_2: posnat) :
member((addr_1, size_1), blocks) And
member((addr_2, size_2), list_remove((addr_1, size_1), blocks))

Implies

blocks_disjoint?(addr_1, size_1, addr_2, size_2)
% proof status:−)
blocks_pairwise_disjoint_add : Lemma

Forall(addr : Address, size : posnat, blocks : list[[Address, posnat]]) :
blocks_pairwise_disjoint (blocks) And
(Forall(oaddr : Address, osize : posnat) :
member((oaddr, osize), blocks) Implies
blocks_disjoint?(addr, size, oaddr, osize))

Implies

blocks_pairwise_disjoint (cons((addr, size), blocks))
% proof status:−)
blocks_pairwise_disjoint_remove : Lemma
Forall(addr : Address, size : posnat, blocks : list[[Address, posnat]]) :
blocks_pairwise_disjoint (blocks) Implies
blocks_pairwise_disjoint (list_remove((addr, size), blocks))
block_is_free (block : PRED[Address],
alloc_points: list[[Address, posnat]]) : bool =
Forall(addr : Address, size : posnat) :
member((addr, size), alloc_points) Implies
disjoint?(block, address_block(addr, size))
% proof status:−)
subset_block_is_free : Lemma
Forall(b1, b2 : PRED[Address], alloc_points: list[[Address, posnat]]) :
subset?(b1, b2) And
block_is_free (b2, alloc_points) Implies
block_is_free (b1, alloc_points)
% proof status:−)
block_is_free_add : Lemma
Forall(block : PRED[Address], alloc_points: list[[Address, posnat]],
addr : Address, size : posnat) :
block_is_free (block, alloc_points) And
disjoint?(block, address_block(addr, size))

Implies

block_is_free (block, cons((addr, size), alloc_points))
End Address_Util

Memory[State : Type] : Theory

%

% memoryis a common memoryabstraction
% it comes withread and writefunctions

%

% this theorydefinesthe notionof memoryand
% some utilityfunctions/lemmas

% Begin

IMPORTING Unit, Address_Util, State_Transformer
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

B PVS Theory Sources

%

% memorydefinition

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Memory_struct: Type =

[#

memory_read: [Address −>
[State −> ExprResult[State, Byte]]],
memory_write: [Address, Byte −>
[State −> ExprResult[State, Unit]]],
memory_read_side_effect : [Address, list[Byte], bool −>
[State −> ExprResult[State, list[Byte]]]],
memory_write_side_effect : [Address, list[Byte], bool −>
[State −> ExprResult[State, list[Byte]]]]

#]

s : Var State
pm : Var Memory_struct
bl : Var list[Byte]
addr : Var Address
size : Var nat
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% write_list

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% memory_write_list_nse_TCC1 : TCCObligation
% proof status:−)
% memory_write_list_nse_TCC2 : TCCObligation
% side effect free list write
memory_write_list_nse (pm)(addr, bl) : Recursive
[State −> ExprResult[State, Unit]] =
Cases bl of
null : ok_result(unit),
cons(b, rl) :
(memory_write(pm)(addr, b) ##
memory_write_list_nse (pm)(addr + 1, cdr(bl)))

EndCases

Measure length(bl)
% applywriteside effect before registeris modified
memory_write_list (pm)(addr, bl) : [State −> ExprResult[State, Unit]] =
memory_write_side_effect (pm)(addr, bl, false) ##
Lambda (bl1 : list[Byte]) :

memory_write_list_nse (pm)(addr, bl1)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% read_list

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% memory_read_list_nse_TCC1 : TCCObligation
% proof status:−)
% memory_read_list_nse_TCC2 : TCCObligation
% side effect free list read
memory_read_list_nse (pm)(addr, size) : Recursive
[State −> ExprResult[State, list[Byte]]] =
If size > 0 Then
memory_read(pm)(addr) ##
Lambda (b : Byte) :
(memory_read_list_nse (pm)(addr + 1, size − 1) ##
Lambda (res_list: list[Byte]) :
ok_result(cons(b, res_list)))

Else

ok_result(null)

Endif

Measure size
% applyside effect on read content
memory_read_list (pm)(addr, size) : [State −> ExprResult[State, list[Byte]]] =
memory_read_list_nse (pm)(addr, size) ##
Lambda (bl1 : list[Byte]) :
memory_read_side_effect (pm)(addr, bl1, false)
% proof status:−)
memory_read_list_ok_length : Lemma
OK?(memory_read_list_nse (pm)(addr, size)(s))

IMPLIES

length(data(memory_read_list_nse (pm)(addr, size)(s))) = size

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% memory_readtransformers(sets of memory_read’s)

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
addresses : Var PRED[Address]
% the set of state transformersthat read at addresses

memory_read_transformers (pm, addresses) :
PRED[[State −> SuperResult[State]]] =
Lambda(q : [State −> SuperResult[State]]) :
Exists(a : Address) : addresses(a) AND
q = expr_2_super (memory_read(pm)(a))

% the obviousrewritelemma
% proof status:−)
memory_read_transformers_memory_read : Lemma Forall(addr : Address) :
addresses(addr)

IMPLIES

memory_read_transformers (pm, addresses)
(expr_2_super (memory_read(pm)(addr)))

% Monotonicity
% proof status:−)
memory_read_transformers_mono : Lemma
Forall(addresses_1, addresses_2: PRED[Address]) :
subset?(addresses_1, addresses_2) IMPLIES
subset?(memory_read_transformers (pm, addresses_1),
memory_read_transformers (pm, addresses_2))
% proof status:−)
memory_read_transformers_union : Lemma
Forall(addresses_1, addresses_2: PRED[Address]):
union(memory_read_transformers (pm, addresses_1),
memory_read_transformers (pm, addresses_2))

=

memory_read_transformers (pm, union(addresses_1, addresses_2))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% memory_writetransformers(sets of memory_write’s)

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% the set of state transformersthat read at addresses
memory_write_transformers (pm, addresses) :
PRED[[State −> SuperResult[State]]] =
Lambda(q : [State −> SuperResult[State]]) :
Exists(a : Address, b : Byte) :
addresses(a) AND q = expr_2_super (memory_write(pm)(a,b))

% the obviousrewritelemma
% proof status:−)
memory_write_transformers_memory_write : Lemma
Forall(addr : Address, b : Byte) :
addresses(addr)

B.18 memory.pvs

IMPLIES

memory_write_transformers (pm, addresses)
(expr_2_super (memory_write(pm)(addr, b)))
% Monotonicity
% proof status:−)
memory_write_transformers_mono : Lemma
Forall(addresses_1, addresses_2: PRED[Address]) :
subset?(addresses_1, addresses_2) IMPLIES
subset?(memory_write_transformers (pm, addresses_1),
memory_write_transformers (pm, addresses_2))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% side effect transformers
% (sets of memory_read_side_effectand memory_write_side_effect

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
states : Var PRED[State]
transformers : Var PRED[[State −> ExprResult[State, list[Byte]]]]
memory_read_side_effect_super_transformers (pm, addresses) :
PRED[[State −> SuperResult[State]]] =
Lambda(q : [State −> SuperResult[State]]) :
Exists(a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) And
q = expr_2_super (memory_read_side_effect (pm)(a, bl, cp))
% proof status:−)
memory_read_side_effect_super_transformers_memory_read_side_effect : Lemma
Forall(a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) Implies
memory_read_side_effect_super_transformers (pm, addresses)
(expr_2_super (memory_read_side_effect (pm)(a, bl, cp)))
% proof status:−)
memory_read_side_effect_super_transformers_mono : Lemma
Forall(addresses_1, addresses_2: PRED[Address]) :
subset?(addresses_1, addresses_2) IMPLIES
subset?(memory_read_side_effect_super_transformers (pm, addresses_1),
memory_read_side_effect_super_transformers (pm, addresses_2))
memory_write_side_effect_super_transformers (pm, addresses) :
PRED[[State −> SuperResult[State]]] =
Lambda(q : [State −> SuperResult[State]]) :
Exists(a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) And
q = expr_2_super (memory_write_side_effect (pm)(a, bl, cp))

% proof status:−)
memory_write_side_effect_super_transformers_memory_write_side_effect : Lemma
Forall(a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) Implies
memory_write_side_effect_super_transformers (pm, addresses)
(expr_2_super (memory_write_side_effect (pm)(a, bl, cp)))
% proof status:−)
memory_write_side_effect_super_transformers_mono : Lemma
Forall(addresses_1, addresses_2: PRED[Address]) :
subset?(addresses_1, addresses_2) IMPLIES
subset?(memory_write_side_effect_super_transformers (pm, addresses_1),
memory_write_side_effect_super_transformers (pm, addresses_2))

se_transformer: Var
[Address, list[Byte], bool −> [State −> ExprResult[State, list[Byte]]]]
se_transformer1: Var
[Address, list[Byte], bool −> [State −> ExprResult[State, list[Byte]]]]
se_transformer2: Var
[Address, list[Byte], bool −> [State −> ExprResult[State, list[Byte]]]]
se_super_transformers (addresses : PRED[Address],
se_transformer: [Address, list[Byte], bool −>
[State −> ExprResult[State, list[Byte]]]]) :
PRED[[State −> SuperResult[State]]] =
Lambda (q : [State −> SuperResult[State]]) :
Exists(a : Address, bl : list[Byte], cp : bool) :
subset?(address_block(a, length(bl)), addresses) And
q = expr_2_super (se_transformer(a, bl, cp))
% side effect transformersdo not change the data read or to be written
side_effect_content_unchanged (addresses : PRED[Address], states,
se_transformer) : bool =
Forall(s : State, a : Address, bl : list[Byte], cp : bool) :
states(s) And
subset?(address_block(a, length(bl)), addresses) And
OK?(se_transformer(a, bl, cp)(s)) Implies
data(se_transformer(a, bl, cp)(s)) = bl
% simpleaccess lemma
% proof status:−)
side_effect_content_unchanged_content : Lemma
Forall(addresses : PRED[Address],
s : State, a : Address, bl : list[Byte], cp : bool) :
side_effect_content_unchanged (addresses, states, se_transformer) And
states(s) And
subset?(address_block(a, length(bl)), addresses) And
OK?(se_transformer(a, bl, cp)(s)) Implies
data(se_transformer(a, bl, cp)(s)) = bl

% proof status:−)
side_effect_content_unchanged_mono : Lemma
Forall (addresses_1, addresses_2: PRED[Address]) :
subset?(addresses_1, addresses_2) And
side_effect_content_unchanged (addresses_2, states, se_transformer)

Implies

side_effect_content_unchanged (addresses_1, states, se_transformer)
% proof status:−)
side_effect_content_unchanged_composition : Lemma
transformer_invariant?(states,
se_super_transformers (addresses, se_transformer1)) And
side_effect_content_unchanged (addresses, states, se_transformer1) And
side_effect_content_unchanged (addresses, states, se_transformer2)

Implies

side_effect_content_unchanged (addresses, states,
Lambda(a : Address, bl : list[Byte], cp : bool) :
se_transformer1(a, bl, cp) ## Lambda (bl1 : list[Byte]) :
se_transformer2(a, bl1, cp))
end Memory

Memory_Change[State : Type] : Theory

%

% this theorydefinesthe unchangedabstraction

% Begin

IMPORTING Memory
pm : Var Memory_struct[State]
states : VAR PRED[State]
transformers : Var PRED[[State −> SuperResult[State]]]
addresses : Var PRED[Address]
% proof status:−)
% unchanged_memory_invariant ?_TCC1: TCCObligation
% Unchangedabstraction: For
% − an arbitrarymemory,
% − a set of states
% − a set of state transformersand
% − a set of addresses
% unchanged_memory_invariant ? holds if
% − states form an invariantwrt. all elementsof transformers
% − all transformersleave the valuesat all addressesunchanged
unchanged_memory_invariant ?(pm, states, transformers, addresses) : bool =
transformer_invariant?(states, transformers) AND
Forall(s : State, q : [State −> SuperResult[State]], a : Address) :
states(s) AND transformers(q) AND addresses(a) AND
OK?(q(s)) AND

OK?(memory_read(pm)(a)(s)) AND
OK?(memory_read(pm)(a)(state(q(s))))

IMPLIES

data(memory_read(pm)(a)(state(q(s)))) =
data(memory_read(pm)(a)(s))

% proof status:−)
% unchanged_memory_invariant_unchanged_TCC1 : TCCObligation
% access lemma
% proof status:−)
unchanged_memory_invariant_unchanged : Lemma
Forall(s : State, q : [State −> SuperResult[State]], a : Address) :
unchanged_memory_invariant ?(pm, states, transformers, addresses) AND
states(s) AND transformers(q) AND addresses(a) AND
OK?(q(s)) AND
OK?(memory_read(pm)(a)(s)) AND
OK?(memory_read(pm)(a)(state(q(s))))

IMPLIES

data(memory_read(pm)(a)(state(q(s)))) =
data(memory_read(pm)(a)(s))
% proof status:−)
unchanged_memory_invariant_invariant : Lemma
unchanged_memory_invariant ?(pm, states, transformers, addresses) Implies
transformer_invariant?(states, transformers)
% Monotonicitylemma
% proof status:−)
unchanged_memory_invariant_mono : Lemma
Forall(transformers_1, transformers_2: PRED[[State −> SuperResult[State]]],
addresses_1, addresses_2: PRED[Address]) :
subset?(transformers_1, transformers_2) AND
subset?(addresses_1, addresses_2) AND
unchanged_memory_invariant ?(pm, states, transformers_2, addresses_2)

IMPLIES

unchanged_memory_invariant ?(pm, states, transformers_1, addresses_1)

% proof status:−)
% unchanged_memory_invariant_next_ok_TCC1 : TCCObligation
% invariantlemma
% proof status:−)
unchanged_memory_invariant_next_ok : LEMMA
FORALL(s: State, q: [State −> SuperResult[State]]):
unchanged_memory_invariant ?(pm, states, transformers, addresses) AND
states(s) AND transformers(q) AND has_next_state (q(s))
IMPLIES states(state(q(s)))
% lemmafor unionof transformers

% proof status:−)
unchanged_memory_invariant_union_transformers : Lemma
Forall(transformers_1, transformers_2:
PRED[[State −> SuperResult[State]]]) :
unchanged_memory_invariant ?(pm, states, transformers_1, addresses) AND
unchanged_memory_invariant ?(pm, states, transformers_2, addresses)

IMPLIES

unchanged_memory_invariant ?(pm, states,
union(transformers_1, transformers_2), addresses)
% lemmafor unionof addresssets
% proof status:−)
unchanged_memory_invariant_union_addresses : Lemma
Forall(addresses_1, addresses_2: PRED[Address]) :
unchanged_memory_invariant ?(pm, states, transformers, addresses_1) AND
unchanged_memory_invariant ?(pm, states, transformers, addresses_2)

IMPLIES

unchanged_memory_invariant ?(pm, states, transformers,
union(addresses_1, addresses_2))
% An emptyaddressset does not automaticallyimplyan
% unchanged_memory_invariant , because states and transformersmust
% form a transformerinvariant(independentof any address).
% proof status:−)
unchanged_memory_invariant_empty : Lemma
empty?(states) OR empty?(transformers) Implies
unchanged_memory_invariant ?(pm, states, transformers, addresses)
% proof status:−)
unchanged_memory_invariant_all_transformers : Lemma
(Forall (q : [State −> SuperResult[State]]) : transformers(q) Implies
unchanged_memory_invariant ?(pm, states, singleton(q), addresses))

Implies

unchanged_memory_invariant ?(pm, states, transformers, addresses)
End Memory_Change

Memory_Change_3 [State : Type, Data : Type] : Theory
% repeata few lemmasfrom above for non−supertransformers

Begin

Importing Memory_Change
pm : Var Memory_struct[State]
states : VAR PRED[State]
transformers : Var PRED[[State −> SuperResult[State]]]
addresses : Var PRED[Address]
% proof status:−)
% expr_unchanged_memory_invariant_unchanged_TCC1 : TCCObligation

% proof status:−)
expr_unchanged_memory_invariant_unchanged : Lemma
Forall(s : State, q : [State −> ExprResult[State, Data]], a : Address) :
unchanged_memory_invariant ?(pm, states, transformers, addresses) AND
states(s) AND transformers(expr_2_super (q)) AND addresses(a) AND
OK?(q(s)) AND
OK?(memory_read(pm)(a)(s)) AND
OK?(memory_read(pm)(a)(state(q(s))))

IMPLIES

data(memory_read(pm)(a)(state(q(s)))) =
data(memory_read(pm)(a)(s))
% proof status:−)
% expr_unchanged_memory_invariant_next_ok_TCC1 : TCCObligation
% proof status:−)
expr_unchanged_memory_invariant_next_ok : LEMMA
FORALL(s: State, q: [State −> ExprResult[State, Data]]):
unchanged_memory_invariant ?(pm, states, transformers, addresses) AND
states(s) AND transformers(expr_2_super (q)) AND has_next_state (q(s))
IMPLIES states(state(q(s)))

End Memory_Change_3
Memory_Change_4 [State : Type, Data1, Data2 : Type] : Theory

Begin

Importing Memory_Change_3
pm : Var Memory_struct[State]
states : Var PRED[State]
transformers_1: Var PRED[[State −> SuperResult[State]]]
transformers_2: Var PRED[[State −> SuperResult[State]]]
addresses : Var PRED[Address]
% proof status:−)
expr_unchanged_memory_invariant_composition : Lemma
Forall (q1 : [State −> ExprResult[State, Data1]],
q2 : [State −> ExprResult[State, Data2]]) :
transformers_1(expr_2_super (q1)) And transformers_2(expr_2_super (q2)) And
transformers_ok?(states, memory_read_transformers (pm, addresses)) And
unchanged_memory_invariant ?(pm, states, transformers_1, addresses) And
unchanged_memory_invariant ?(pm, states, transformers_2, addresses)

Implies

unchanged_memory_invariant ?(pm, states, singleton(expr_2_super (q1 ## q2)), addresses)
% proof status:−)
fexpr_unchanged_memory_invariant_composition : Lemma
Forall (q1 : [State −> ExprResult[State, Data1]],
q2 : [Data1 −> [State −> ExprResult[State, Data2]]],
P : PRED[Data1]) :

transformers_1(expr_2_super (q1)) And
transformers_ok?(states, memory_read_transformers (pm, addresses)) And
unchanged_memory_invariant ?(pm, states, transformers_1, addresses) And
(Forall (s : (states)) : OK?(q1(s)) Implies P(data(q1(s)))) And
(Forall (d : (P)) : unchanged_memory_invariant ?(pm, states,
singleton(expr_2_super (q2(d))), addresses))

Implies

unchanged_memory_invariant ?(pm, states, singleton(expr_2_super (q1 ## q2)), addresses)
End Memory_Change_4
Memory_Change_2 [State : Type] : Theory

%

% Here the unchangedabstractionis furtherspecialized.
% Thereis also a changedabstraction(for memorywrites)
% (all this cannot go in the previoustheorybecause of
% the typeparameterData there)

%

% in the end all this is used to proveresultsabout
% memory_read_listafter memory_write_list
% and
% memory_read_listafter memory_read_list

% Begin

IMPORTING Memory_Change_3
pm : Var Memory_struct[State]
states : VAR PRED[State]
addresses : Var PRED[Address]

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% specialunchangedfor memory_write

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% The followingis a variationof

%

% unchanged_memory_invariant ?(pm, states,
% memory_write_transformers (pm, addresses),
% addresses)

%

% The variationis that it excludesthe obviouslywrong cases:
% writingat a _changes_addressa.
unchanged_memory_write_invariant ?(pm, states, addresses) : bool =
Forall(waddr : Address, b : Byte) :
addresses(waddr) IMPLIES
unchanged_memory_invariant ?(pm, states,
singleton(expr_2_super (memory_write(pm)(waddr,b))),

remove(waddr, addresses))
% Monotonicity
% proof status:−)
unchanged_memory_write_invariant_mono_addresses : Lemma
Forall(addresses_1, addresses_2: PRED[Address]) :
subset?(addresses_1, addresses_2) AND
unchanged_memory_write_invariant ?(pm, states, addresses_2)

IMPLIES

unchanged_memory_write_invariant ?(pm, states, addresses_1)
% connect unchanged_memory_write_invariant ? withtransformer_invariant ?
% proof status:−)
unchanged_memory_write_invariant_transformer_invariant : Lemma
unchanged_memory_write_invariant ?(pm, states, addresses)

IMPLIES

transformer_invariant?(states, memory_write_transformers (pm,addresses))

% connect unchanged_memory_write_invariant withunchanged_memory_invariant ?
% for a subset of unchangedaddresses
% proof status:−)
unchanged_memory_write_invariant_unchanged_memory_invariant : Lemma
Forall(all_addresses, unchanged_addresses,
changed_addresses: PRED[Address]) :
unchanged_memory_write_invariant ?(pm, states, all_addresses) AND
subset?(unchanged_addresses, all_addresses) AND
subset?(changed_addresses, all_addresses) AND
disjoint?(unchanged_addresses, changed_addresses)

IMPLIES

unchanged_memory_invariant ?(pm, states,
memory_write_transformers (pm, changed_addresses),

unchanged_addresses

)

% connect unchanged_memory_invariant and unchanged_memory_write_invariant
% to a largerunchanged_memory_invariant
% proof status:−)
unchanged_memory_invariant_union : Lemma
Forall (ro_addr, rw_addr, mod_addr: PRED[Address]) :
unchanged_memory_invariant ?(pm, states,
memory_write_transformers (pm, rw_addr), ro_addr) And
unchanged_memory_write_invariant ?(pm, states, rw_addr) And
subset?(mod_addr, rw_addr)

Implies

unchanged_memory_invariant ?(pm, states,
memory_write_transformers (pm, mod_addr),
difference(union(ro_addr, rw_addr), mod_addr))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% some invariantlemmasfor write_list

B.18 memory.pvs

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% wrt transformer_invariant
% proof status:−)
transformer_invariant_write_list_nse : Lemma
Forall(waddr : Address, bl : list[Byte], s : State) :
transformer_invariant?(states,
memory_write_transformers (pm, address_block(waddr, length(bl))))

AND

states(s)

IMPLIES

result_pred(states)
(expr_2_super (memory_write_list_nse (pm)(waddr, bl))(s))
% proof status:−)
transformer_invariant_write_list : Lemma
Forall(waddr : Address, bl : list[Byte], s : State) :
transformer_invariant?(states,
add(
expr_2_super (memory_write_side_effect (pm)(waddr, bl, false)),
memory_write_transformers (pm, address_block(waddr, length(bl)))))

And

side_effect_content_unchanged (address_block(waddr, length(bl)), states,
memory_write_side_effect (pm))

And

states(s)

Implies

result_pred(states)(expr_2_super (memory_write_list (pm)(waddr, bl))(s))
% wrt unchanged_memory_invariant ? and read_memory
% see below
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% changedabstractionfor memory_read/memory_write

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% changed_memory_invariant ?_TCC1: TCCObligation
changed_memory_invariant ?(pm, states, addresses) : bool =
transformer_invariant?(states, memory_read_transformers (pm, addresses))

AND

transformer_invariant?(states, memory_write_transformers (pm, addresses))

AND

Forall(s : State, a : Address, b : Byte) :
states(s) AND addresses(a) AND
OK?(memory_write(pm)(a,b)(s)) AND
OK?(memory_read(pm)(a)(state(memory_write(pm)(a,b)(s))))

B PVS Theory Sources

IMPLIES

data(memory_read(pm)(a)(state(memory_write(pm)(a,b)(s)))) = b
% proof status:−)
changed_memory_invariant_mono : Lemma
Forall(addresses_1, addresses_2: PRED[Address]) :
subset?(addresses_1, addresses_2) AND
changed_memory_invariant ?(pm, states, addresses_2)

IMPLIES

changed_memory_invariant ?(pm, states, addresses_1)
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% unchangedresults: memory_read_list

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
memory_read_list_nse_ok : Lemma
Forall(raddr : Address, size : nat, s : State) :
transformer_invariant?(states,
memory_read_transformers (pm, address_block(raddr, size)))

And

transformers_ok?(states,
memory_read_transformers (pm, address_block(raddr, size)))

And

states(s)

Implies

OK?(memory_read_list_nse (pm)(raddr, size)(s))
% proof status:−)
% memory_read_list_nse_next_length_TCC1 : TCCObligation
% proof status:−)
% memory_read_list_nse_next_length_TCC2 : TCCObligation
% proof status:−)
memory_read_list_nse_next_length : Lemma
Forall(raddr : Address, size : nat, s : State) :
transformer_invariant?(states,
memory_read_transformers (pm, address_block(raddr, size)))

AND

transformers_ok?(states,
memory_read_transformers (pm, address_block(raddr, size))) AND
states(s)

Implies

states(state(memory_read_list_nse (pm)(raddr, size)(s)))

And

length(data(memory_read_list_nse (pm)(raddr, size)(s))) = size

% if read_memoryis ok then read_listis ok
% proof status:−)
memory_read_list_ok : Lemma
Forall(raddr : Address, size : nat, s : State) :
transformer_invariant?(states,
union(
memory_read_transformers (pm, address_block(raddr, size)),
memory_read_side_effect_super_transformers (pm,
address_block(raddr, size))))

And

transformers_ok?(states,
union(
memory_read_transformers (pm, address_block(raddr, size)),
memory_read_side_effect_super_transformers (pm,
address_block(raddr, size))))

And

states(s)

Implies

OK?(memory_read_list (pm)(raddr, size)(s))
% proof status:−)
% memory_read_list_next_ok_TCC1 : TCCObligation
% if read_memoryis ok then nextstate of read_listis in states
% proof status:−)
memory_read_list_next_ok : Lemma
Forall(raddr : Address, size : nat, s : State) :
transformer_invariant?(states,
union(
memory_read_transformers (pm, address_block(raddr, size)),
memory_read_side_effect_super_transformers (pm,
address_block(raddr, size))))

AND

transformers_ok?(states,
union(
memory_read_transformers (pm, address_block(raddr, size)),
memory_read_side_effect_super_transformers (pm,
address_block(raddr, size))))

And

states(s)

Implies

states(state(memory_read_list (pm)(raddr, size)(s)))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% memory_read_list## q

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% unchanged_memory_read_list_nse_TCC1 : TCCObligation

% proof status:−)
% unchanged_memory_read_list_nse_TCC2 : TCCObligation
% proof status:−)
% unchanged_memory_read_list_nse_TCC3 : TCCObligation
% The obviousunchangedlemmafor memory_read_list
% proof status:−)
unchanged_memory_read_list_nse : Lemma
Forall(raddr : Address, size : nat, s : State,
q : [State −> SuperResult[State]]) :
unchanged_memory_invariant ?(pm, states,
union(memory_read_transformers (pm, address_block(raddr, size)),
singleton(q)),
addresses)

AND

transformers_ok?(states,
memory_read_transformers (pm, address_block(raddr, size)))

AND

subset?(address_block(raddr, size), addresses) AND
states(s) AND
OK?(q(s))

IMPLIES

data(memory_read_list_nse (pm)(raddr, size)(state(q(s)))) =
data(memory_read_list_nse (pm)(raddr, size)(s))
% proof status:−)
% unchanged_memory_read_list_TCC1 : TCCObligation
% proof status:−)
% unchanged_memory_read_list_TCC2 : TCCObligation
% proof status:−)
% unchanged_memory_read_list_TCC3 : TCCObligation
% proof status:−)
unchanged_memory_read_list : Lemma
Forall(raddr : Address, size : nat, s : State,
q : [State −> SuperResult[State]]) :
unchanged_memory_invariant ?(pm, states,
union(
union(memory_read_transformers (pm, address_block(raddr, size)),
memory_read_side_effect_super_transformers (pm,
address_block(raddr, size))),
singleton(q)),
addresses)

AND

transformers_ok?(states,
union(
memory_read_transformers (pm, address_block(raddr, size)),
memory_read_side_effect_super_transformers (pm,

address_block(raddr, size))))

AND

side_effect_content_unchanged (address_block(raddr, size), states,
memory_read_side_effect (pm))

And

subset?(address_block(raddr, size), addresses) AND
states(s) AND
OK?(q(s))

IMPLIES

data(memory_read_list (pm)(raddr, size)(state(q(s)))) =
data(memory_read_list (pm)(raddr, size)(s))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% memory_read## memory_read_list

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% unchanged_memory_invariant_unchanged_read_list_nse_TCC1 : TCCObligation
% proof status:−)
% unchanged_memory_invariant_unchanged_read_list_nse_TCC2 : TCCObligation
% proof status:−)
% unchanged_memory_invariant_unchanged_read_list_nse_TCC3 : TCCObligation
% proof status:−)
unchanged_memory_invariant_unchanged_read_list_nse : Lemma
Forall(s : State, addr_1, addr_2: Address, size : nat) :
unchanged_memory_invariant ?(pm, states,
memory_read_transformers (pm, address_block(addr_2, size)),
addresses)

AND

transformers_ok?(states, memory_read_transformers (pm, addresses))

AND

subset?(address_block(addr_2, size), addresses)

And

addresses(addr_1)

And

states(s)

IMPLIES

data(memory_read(pm)(addr_1)(
state(memory_read_list_nse (pm)(addr_2, size)(s)))) =
data(memory_read(pm)(addr_1)(s))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% normalterminationof memory_write_list

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% if write_memoryis ok then write_listis ok
% proof status:−)
memory_write_list_ok_nse : Lemma
Forall(waddr : Address, s : State, bl : list[Byte]) :
transformer_invariant?(states,
memory_write_transformers (pm, address_block(waddr, length(bl))))

AND

transformers_ok?(states,
memory_write_transformers (pm, address_block(waddr, length(bl))))

AND

states(s)

IMPLIES

OK?(memory_write_list_nse (pm)(waddr, bl)(s))

% proof status:−)
memory_write_list_ok : Lemma
Forall(waddr : Address, s : State, bl : list[Byte]) :
transformer_invariant?(states,
union(memory_write_transformers (pm, address_block(waddr, length(bl))),
memory_write_side_effect_super_transformers (pm,
address_block(waddr, length(bl)))))

AND

transformers_ok?(states,
union(memory_write_transformers (pm, address_block(waddr, length(bl))),
memory_write_side_effect_super_transformers (pm,
address_block(waddr, length(bl)))))

AND

side_effect_content_unchanged (address_block(waddr, length(bl)), states,
memory_write_side_effect (pm))

And

states(s)

IMPLIES

OK?(memory_write_list (pm)(waddr, bl)(s))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% unchangedresults: memory_read_list## memory_write_list

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

% proof status:−)
% unchanged_memory_invariant_unchanged_write_list_nse_TCC1 : TCCObligation
% proof status:−)
% unchanged_memory_invariant_unchanged_write_list_nse_TCC2 : TCCObligation
% proof status:−)
% unchanged_memory_invariant_unchanged_write_list_nse_TCC3 : TCCObligation

% proof status:−)
unchanged_memory_invariant_unchanged_write_list_nse : Lemma
Forall(s : State, raddr, waddr : Address, bl : list[Byte]) :
unchanged_memory_invariant ?(pm, states,
memory_write_transformers (pm, address_block(waddr, length(bl))),
singleton(raddr))

AND

transformers_ok?(states,
memory_write_transformers (pm, address_block(waddr, length(bl))))

AND

transformers_ok?(states, singleton(expr_2_super (memory_read(pm)(raddr))))

AND

states(s)

IMPLIES

data(memory_read(pm)(raddr)(
state(memory_write_list_nse (pm)(waddr, bl)(s)))) =
data(memory_read(pm)(raddr)(s))

% proof status:−)
% unchanged_memory_invariant_unchanged_write_list_TCC1 : TCCObligation
% proof status:−)
% unchanged_memory_invariant_unchanged_write_list_TCC2 : TCCObligation
% proof status:−)
% unchanged_memory_invariant_unchanged_write_list_TCC3 : TCCObligation
% proof status:−)
unchanged_memory_invariant_unchanged_write_list : Lemma
Forall(s : State, raddr, waddr : Address, bl : list[Byte]) :
unchanged_memory_invariant ?(pm, states,
union(memory_write_transformers (pm, address_block(waddr, length(bl))),
memory_write_side_effect_super_transformers (pm,
address_block(waddr, length(bl)))),
singleton(raddr))

AND

transformers_ok?(states,
union(memory_write_transformers (pm, address_block(waddr, length(bl))),
memory_write_side_effect_super_transformers (pm,
address_block(waddr, length(bl)))))

AND

transformers_ok?(states, singleton(expr_2_super (memory_read(pm)(raddr))))

AND

side_effect_content_unchanged (address_block(waddr, length(bl)), states,
memory_write_side_effect (pm))

AND

states(s)

IMPLIES

data(memory_read(pm)(raddr)(
state(memory_write_list (pm)(waddr, bl)(s)))) =

data(memory_read(pm)(raddr)(s))
% unchangedmemoryis an invariantof read_list
% proof status:−)
unchanged_memory_invariant_read_list : Lemma
Forall(addr : Address, size : nat) :
unchanged_memory_invariant ?(pm, states, union(
memory_read_transformers (pm, address_block(addr, size)),
memory_read_side_effect_super_transformers (pm,
address_block(addr, size))),
addresses)

AND

transformers_ok?(states,
union(
memory_read_transformers (pm, addresses),
memory_read_side_effect_super_transformers (pm, addresses)))

And

subset?(address_block(addr, size), addresses)

IMPLIES

unchanged_memory_invariant ?(pm, states,
singleton(expr_2_super (memory_read_list (pm)(addr, size))),
addresses)
% proof status:−)
% unchanged_memory_read_list_write_list_nse_TCC1 : TCCObligation
% proof status:−)
% unchanged_memory_read_list_write_list_nse_TCC2 : TCCObligation
% proof status:−)
unchanged_memory_read_list_write_list_nse : Lemma
Forall(waddr : Address, bl : list[Byte], s : State) :
unchanged_memory_invariant ?(pm, states,
memory_read_transformers (pm, address_block(waddr, length(bl))),
address_block(waddr, length(bl)))

AND

unchanged_memory_write_invariant ?(pm, states,
address_block(waddr, length(bl)))

AND

changed_memory_invariant ?(pm, states, address_block(waddr, length(bl)))

AND

transformers_ok?(states,
memory_read_transformers (pm, address_block(waddr, length(bl))))

AND

transformers_ok?(states,
memory_write_transformers (pm, address_block(waddr, length(bl))))

AND

states(s)

IMPLIES

data(memory_read_list_nse (pm)(waddr, length(bl))(
state(memory_write_list_nse (pm)(waddr, bl)(s)))) = bl

B.19 paging-data-models.pvs

% proof status:−)
% unchanged_memory_read_list_write_list_TCC1 : TCCObligation
% proof status:−)
% unchanged_memory_read_list_write_list_TCC2 : TCCObligation
% proof status:−)
unchanged_memory_read_list_write_list : Lemma
Forall(waddr : Address, bl : list[Byte], s : State) :
unchanged_memory_invariant ?(pm, states, union(
memory_read_transformers (pm, address_block(waddr, length(bl))),
union(
memory_read_side_effect_super_transformers (pm,
address_block(waddr, length(bl))),
memory_write_side_effect_super_transformers (pm,
address_block(waddr, length(bl))))),
address_block(waddr, length(bl)))

AND

unchanged_memory_write_invariant ?(pm, states,
address_block(waddr, length(bl)))

AND

changed_memory_invariant ?(pm, states, address_block(waddr, length(bl)))

AND

transformers_ok?(states,
union(
memory_read_transformers (pm, address_block(waddr, length(bl))),
memory_read_side_effect_super_transformers (pm,
address_block(waddr, length(bl)))))

AND

transformers_ok?(states,
union(
memory_write_transformers (pm, address_block(waddr, length(bl))),
memory_write_side_effect_super_transformers (pm,
address_block(waddr, length(bl)))))

AND

side_effect_content_unchanged (address_block(waddr, length(bl)), states,
memory_read_side_effect (pm))

AND

side_effect_content_unchanged (address_block(waddr, length(bl)), states,
memory_write_side_effect (pm))

AND

states(s)

IMPLIES

data(memory_read_list (pm)(waddr, length(bl))(
state(memory_write_list (pm)(waddr, bl)(s)))) = bl
End Memory_Change_2

B.19 paging-data-models.pvs

PDBR_Data_Model: Theory

Begin

Importing Bits, PDBR_Type, Interpreted_Data[Pdbr_type]
% 31 12 5 4 3 2 0
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+
% | | |P|P| |
% | page dir base | empty|C|W| emp |
% | | |D|T| |
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+

% proof status:−)
% pdbr_valid?_TCC1: TCCObligation
% proof status:−)
% pdbr_valid?_TCC2: TCCObligation
pdbr_valid?(data : list[Byte], a : Address) : bool =
length(data) = 4 And
% upper20 bits are the base
% next7 bits are empty
cut_bits(nth(data, 1), 0, 4) = 0 And
cut_bits(nth(data, 0), 5, 3) = 0 And
% bit 4 is PCD
% bit 3 is PWT
% remainderis empty
cut_bits(nth(data, 0), 0, 3) = 0
% proof status:−)
% pdbr_to_byte_TCC1 : TCCObligation
% proof status:−)
% pdbr_to_byte_TCC2 : TCCObligation
% proof status:−)
% pdbr_to_byte_TCC3 : TCCObligation
pdbr_to_byte (pdbr : Pdbr_type, a : Address) : list[Byte] =
(: overwrite_bool_bit (
overwrite_bool_bit (0, pdbr‘pwt, 3),
pdbr‘pcd, 4),
cut_bits(offset(pdbr‘base_addr), 8, 8),
cut_bits(offset(pdbr‘base_addr), 16, 8),
cut_bits(offset(pdbr‘base_addr), 24, 8)

:)

% proof status:−)
% pdbr_from_byte_TCC1 : TCCObligation
% proof status:−)
% pdbr_from_byte_TCC2 : TCCObligation

B.19 paging-data-models.pvs

% proof status:−)
% pdbr_from_byte_TCC3 : TCCObligation
% proof status:−)
% pdbr_from_byte_TCC4 : TCCObligation
% proof status:−)
% pdbr_from_byte_TCC5 : TCCObligation
pdbr_from_byte (data : list[Byte], a : Address) : lift[Pdbr_type] =
IF pdbr_valid?(data, a) Then
up((# base_addr:=
Mem(

overwrite_shift_bits

(

overwrite_shift_bits

(

overwrite_shift_bits (0, nth(data, 1), 8, 8),
nth(data, 2), 16, 8),
nth(data, 3), 24, 8)

),

pcd := cut_bit(nth(data, 0), 4),
pwt := cut_bit(nth(data, 0), 3)

#))

Else bottom

Endif

% proof status:−)
% pdbr_model_TCC1: TCCObligation
pdbr_model: Interpreted_data_type [Pdbr_type] = (#
uidt := (#
size := 4,
valid? := pdbr_valid?

#),

to_byte:= pdbr_to_byte ,
to_mask:= Lambda (d : Pdbr_type, a : Address) :
(zero_mask?(4)),
from_byte:= pdbr_from_byte

#)

% proof status:−)
pdbr_valid_to_byte : Lemma Forall(d: Pdbr_type, a: Address):
valid?(uidt(pdbr_model))(to_byte(pdbr_model)(d, a), a)

% proof status:−)
pdbr_is_pod: Theorem pod_data_type ?(pdbr_model)
End PDBR_Data_Model

PDE_Model: Theory

Begin

% PDE4K

%

% 32 12 11 9 8 7 6 5 4 3 2 1 0
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+
% | | | | | R | | P | P | U | R | |
% | page table address| avail| G | P | E | A | C | W | / | / | P |
% | | | | S | S | | D | T | S | W | |
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+

%

% PDE4M

%

% 32 22 21 13 12 11 9 8 7 6 5 4 3 2 1 0
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+
% | | | P | | | | | | P | P | U | R | |
% | page address| reserved| A | avail| G | P | D | A | C | W | / | / | P |
% | | | T | | | S | | | D | T | S | W | |
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+

%

% G : globalpage (ignoredfor 4K PTE’s)
% PS : page size (1 for superpages)
% RES: reserved(0)
% A : accessed
% PCD: cache disabled
% PWT: cache writethrough
% U/S : user / supervisor
% R/W : read / write
% P : present
% PAT: page table attributeindex
% D : dirty
Importing Pde_type, Memory_privilege_util , Interpreted_Data
% proof status:−)
% pde_valid?_TCC1: TCCObligation
% proof status:−)
% pde_valid?_TCC2: TCCObligation
% proof status:−)
% pde_valid?_TCC3: TCCObligation
pde_valid?(data : list[Byte], a : Address) : bool =
length(data) = 4 And
IF cut_bit(nth(data, 0), 0)
Then % present
IF cut_bit(nth(data, 0), 7)
Then % superpageentry
cut_bits(nth(data, 1), 5, 3) = 0 And
cut_bits(nth(data, 2), 0, 6) = 0

Else % PTEentry
cut_bits(nth(data, 0), 6, 1) = 0

Endif

Else % not present

True Endif

% proof status:−)
% pde_pte_to_byte_TCC1 : TCCObligation
% proof status:−)
% pde_pte_to_byte_TCC2 : TCCObligation
% proof status:−)
% pde_pte_to_byte_TCC3 : TCCObligation
pde_pte_to_byte (pde : Pde_pt_type , a : Address) : list[Byte] =

(:

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit (0, true, 0),
memory_access_to_bools (pde‘access)‘1, 1),
memory_privilege_to_bool (pde‘privilege), 2),
pde‘write_through, 3),
pde‘cache_disabled, 4),
pde‘accessed, 5),

overwrite_shift_bits

(

overwrite_bool_bit (0, pde‘global_page, 0),
cut_bits(offset(pde‘page_table_base ), 12, 4),
4, 4),
cut_bits(offset(pde‘page_table_base ), 16, 8),
cut_bits(offset(pde‘page_table_base ), 24, 8)

:)

% proof status:−)
% pde_super_to_byte_TCC1 : TCCObligation
% proof status:−)
% pde_super_to_byte_TCC2 : TCCObligation
% proof status:−)
% pde_super_to_byte_TCC3 : TCCObligation
pde_super_to_byte (spage : Pde_4m_type , a : Address) : list[Byte] =

(:

overwrite_bool_bit ( overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit (0, true, 0),
memory_access_to_bools (spage‘access)‘1, 1),
memory_privilege_to_bool (spage‘privilege), 2),
spage‘write_through, 3),
spage‘cache_disabled, 4),
spage‘accessed, 5),
spage‘dirty, 6),
true, 7),

overwrite_bool_bit

(

overwrite_bool_bit (0, spage‘global_page, 0),
spage‘page_table_attribute_index , 4),
shift_bits_left (cut_bits(offset(spage‘page_base), 22, 2), 6),
cut_bits(offset(spage‘page_base), 24, 8)

:)

% proof status:−)
% pde_to_byte_TCC1: TCCObligation
% proof status:−)
% pde_to_byte_TCC2: TCCObligation
pde_to_byte (pde : Pde_type, a : Address) : list[Byte] =
Cases pde of
Not_present: (: 0, 0, 0, 0 :),
Pde_pt(pte) : pde_pte_to_byte (pte, a),
Pde_4m(spage) : pde_super_to_byte (spage, a)

EndCases

% proof status:−)
% pde_4m_from_byte_TCC1 : TCCObligation
% proof status:−)
% pde_4m_from_byte_TCC2 : TCCObligation
% proof status:−)
% pde_4m_from_byte_TCC3 : TCCObligation
% proof status:−)
% pde_4m_from_byte_TCC4 : TCCObligation
% proof status:−)
% pde_4m_from_byte_TCC5 : TCCObligation

B.19 paging-data-models.pvs

% proof status:−)
% pde_4m_from_byte_TCC6 : TCCObligation
pde_4m_from_byte (data : list[Byte], a : Address) : lift[Pde_4m_type ] =
% The firstif here seems redundant. However, we do
% down(x_pod‘from_byte...) whichonlyworkson validdata. The
% (worse) alternativeis to restrictthe inputto validdata−address
% pairs.
IF pde_valid?(data, a) And
cut_bit(nth(data, 0), 0) And
cut_bit(nth(data, 0), 7)

Then

up((#
page_base:=
Mem(

overwrite_shift_bits

(

overwrite_shift_bits (0, cut_bits(nth(data, 2), 6, 2), 22, 2),
nth(data, 3), 24, 8)

),

page_table_attribute_index := cut_bit(nth(data, 1), 4),
global_page:= cut_bit(nth(data, 1), 0),
dirty := cut_bit(nth(data, 0), 6),
accessed := cut_bit(nth(data, 0), 5),
cache_disabled:= cut_bit(nth(data, 0), 4),
write_through:= cut_bit(nth(data, 0), 3),
privilege := bool_to_memory_privilege (cut_bit(nth(data, 0), 2)),
access := bools_to_memory_access (cut_bit(nth(data, 0), 1), true)

#))

Else bottom

Endif

% proof status:−)
% pde_4k_from_byte_TCC1 : TCCObligation
% proof status:−)
% pde_4k_from_byte_TCC2 : TCCObligation
% proof status:−)
% pde_4k_from_byte_TCC3 : TCCObligation
% proof status:−)
% pde_4k_from_byte_TCC4 : TCCObligation
% proof status:−)
% pde_4k_from_byte_TCC5 : TCCObligation
pde_4k_from_byte (data : list[Byte], a : Address) : lift[Pde_pt_type ] =
% Againthe firstif seems redundant...
IF pde_valid?(data, a) And
cut_bit(nth(data, 0), 0) And
Not cut_bit(nth(data, 0), 7)

Then

up((#

page_table_base

:=

Mem(

overwrite_shift_bits

(

overwrite_shift_bits

(

overwrite_shift_bits (0, cut_bits(nth(data, 1), 4, 4),
12, 4),
nth(data, 2), 16, 8),
nth(data, 3), 24, 8)

),

global_page:= cut_bit(nth(data, 1), 0),
accessed := cut_bit(nth(data, 0), 5),
cache_disabled:= cut_bit(nth(data, 0), 4),
write_through:= cut_bit(nth(data, 0), 3),
privilege := bool_to_memory_privilege (cut_bit(nth(data, 0), 2)),
access := bools_to_memory_access (cut_bit(nth(data, 0), 1), true)

#))

Else bottom

Endif

% proof status:−)
% pde_from_byte_TCC1: TCCObligation
% proof status:−)
% pde_from_byte_TCC2: TCCObligation
pde_from_byte (data : list[Byte], a : Address) : lift[Pde_type] =
IF pde_valid?(data, a) Then
IF cut_bit(nth(data, 0), 0)
Then % present
IF cut_bit(nth(data, 0), 7)
Then % superpage entry
up(Pde_4m(down(pde_4m_from_byte (data, a))))
Else % page table entry
up(Pde_pt(down(pde_4k_from_byte (data, a))))

Endif

Else % not present
up(Not_present)

Endif

Else bottom

Endif

% proof status:−)
% pde_model_TCC1: TCCObligation
pde_model: Interpreted_data_type [Pde_type] = (#
uidt := (#
size := 4,
valid? := pde_valid?

#),

to_byte:= pde_to_byte ,
to_mask:= Lambda (d : Pde_type, a : Address) :

(zero_mask?(4)),
from_byte:= pde_from_byte

#)

% proof status:−)
pde_valid_to_byte : Lemma Forall(d: Pde_type, a: Address):
valid?(uidt(pde_model))(to_byte(pde_model)(d, a), a)
% proof status:−)
pde_is_pod: Theorem pod_data_type ?(pde_model)
End PDE_Model

PTE_Model: Theory

Begin

% PTE

%

% 32 12 11 9 8 7 6 5 4 3 2 1 0
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+
% | | | | P | | | P | P | U | R | |
% | page address| avail| G | A | D | A | C | W | / | / | P |
% | | | | T | | | D | T | S | W | |
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+
% G : globalpage
% PAT: page table attributeindex
% D : dirty
% A : accessed
% PCD: cache disabled
% PWT: cache writethrough
% U/S : user / supervisor
% R/W : read / write
% P : present
Importing Pte_type, Memory_privilege_util , Interpreted_Data
pte_valid?(data : list[Byte], a : Address) : bool =
length(data) = 4

% proof status:−)
% pte_page_to_byte_TCC1 : TCCObligation
% proof status:−)
% pte_page_to_byte_TCC2 : TCCObligation
% proof status:−)
% pte_page_to_byte_TCC3 : TCCObligation
pte_page_to_byte (pte : Pte_4k_type , a : Address) : list[Byte] =

(:

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit (0, true, 0),
memory_access_to_bools (pte‘access)‘1, 1),
memory_privilege_to_bool (pte‘privilege), 2),
pte‘write_through, 3),
pte‘cache_disabled, 4),
pte‘accessed, 5),
pte‘dirty, 6),
pte‘page_table_attribute_index , 7),

overwrite_shift_bits

(

overwrite_bool_bit (0, pte‘global_page, 0),
cut_bits(offset(pte‘page_base), 12, 4),
4, 4),
cut_bits(offset(pte‘page_base), 16, 8),
cut_bits(offset(pte‘page_base), 24, 8)

:)

% proof status:−)
% pte_to_byte_TCC1: TCCObligation
% proof status:−)
% pte_to_byte_TCC2: TCCObligation
pte_to_byte (pte : Pte_type, a : Address) : list[Byte] =
Cases pte of
Not_present: (: 0, 0, 0, 0 :),
Pte(pte) : pte_page_to_byte (pte, a)

EndCases

% proof status:−)
% pte_page_from_byte_TCC1 : TCCObligation
% proof status:−)
% pte_page_from_byte_TCC2 : TCCObligation
% proof status:−)
% pte_page_from_byte_TCC3 : TCCObligation
% proof status:−)
% pte_page_from_byte_TCC4 : TCCObligation

% proof status:−)
% pte_page_from_byte_TCC5 : TCCObligation
% proof status:−)
% pte_page_from_byte_TCC6 : TCCObligation
pte_page_from_byte (data : list[Byte], a : Address) : lift[Pte_4k_type ] =
% The firstif seems redundant... see earliercommentson this
IF pte_valid?(data, a) And cut_bit(nth(data, 0), 0)

Then

up((#
page_base:=
Mem(

overwrite_shift_bits

(

overwrite_shift_bits

(

overwrite_shift_bits (0, cut_bits(nth(data, 1), 4, 4),
12, 4),
nth(data, 2), 16, 8),
nth(data, 3), 24, 8)

),

global_page:= cut_bit(nth(data, 1), 0),
page_table_attribute_index := cut_bit(nth(data, 0), 7),
dirty := cut_bit(nth(data, 0), 6),
accessed := cut_bit(nth(data, 0), 5),
cache_disabled:= cut_bit(nth(data, 0), 4),
write_through:= cut_bit(nth(data, 0), 3),
privilege := bool_to_memory_privilege (cut_bit(nth(data, 0), 2)),
access := bools_to_memory_access (cut_bit(nth(data, 0), 1), true)

#))

Else bottom

Endif

% proof status:−)
% pte_from_byte_TCC1: TCCObligation
pte_from_byte (data : list[Byte], a : Address) : lift[Pte_type] =
IF pte_valid?(data, a) Then
IF cut_bit(nth(data, 0), 0)
Then % present
up(Pte(down(pte_page_from_byte (data, a))))
Else % not present
up(Not_present)

Endif

Else bottom

Endif

% proof status:−)
% pte_model_TCC1: TCCObligation
pte_model: Interpreted_data_type [Pte_type] = (#
uidt := (#

size := 4,
valid? := pte_valid?

#),

to_byte:= pte_to_byte ,
to_mask:= Lambda (d : Pte_type, a : Address) :
(zero_mask?(4)),
from_byte:= pte_from_byte

#)

% proof status:−)
pte_valid_to_byte : Lemma Forall(d : Pte_type, a : Address) :
pte_model‘uidt‘valid?(pte_model‘to_byte(d, a), a)
% proof status:−)
pte_is_pod: Theorem pod_data_type ?(pte_model)
End PTE_Model

PF_EC_Model: Theory

Begin

Importing PF_Error_Code_Type , Memory_privilege_util
% Page FaultErrorCode
% 31 5 4 3 2 1 0
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+
% | | I | R | U | W | |
% | Reserved| / | S | / | / | P |
% | | D | V | S | R | |
% +−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−+
% proof status:−)
% pf_ec_valid?_TCC1: TCCObligation
% proof status:−)
% pf_ec_valid?_TCC2: TCCObligation
% proof status:−)
% pf_ec_valid?_TCC3: TCCObligation
% proof status:−)
% pf_ec_valid?_TCC4: TCCObligation
pf_ec_valid ?(data : list[Byte], a : Address) : bool =
length(data) = 4 And
% upper27 bits are reserved
cut_bits(nth(data, 3), 0, 8) = 0 And
cut_bits(nth(data, 2), 0, 8) = 0 And
cut_bits(nth(data, 1), 0, 8) = 0 And
cut_bits(nth(data, 0), 5, 3) = 0

% bit 4 is instruction/ data
% bit 3 is reservedbit
% bit 2 is user supervisor
% bit 1 is write/ read
% bit 1 is present
% proof status:−)
% pf_ec_to_byte_TCC1: TCCObligation
% proof status:−)
% pf_ec_to_byte_TCC2: TCCObligation
pf_ec_to_byte (pf_ec: PF_error_code_type , a : Address) : list[Byte] =
(: overwrite_bool_bit (

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit

(

overwrite_bool_bit (0, pf_ec‘present, 0),
member(Write, pf_ec‘access), 1),
memory_privilege_to_bool (pf_ec‘privilege), 2),
pf_ec‘reserved_bit_violation , 3),
member(Execute, pf_ec‘access), 4),

0, 0, 0

:)

% proof status:−)
% pf_ec_from_byte_TCC1 : TCCObligation
% proof status:−)
% pf_ec_from_byte_TCC2 : TCCObligation
pf_ec_from_byte (data : list[Byte], a : Address) : lift[PF_error_code_type ] =
If pf_ec_valid ?(data, a) Then
up((# reserved_bit_violation:= cut_bit(nth(data, 0), 3),
privilege := bool_to_memory_privilege (cut_bit(nth(data, 0), 2)),
access := bools_to_memory_access (cut_bit(nth(data, 0), 1), cut_bit(nth(data, 0), 4)),
present := cut_bit(nth(data, 0), 0)

#)) Else

bottom Endif

% proof status:−)
% pf_ec_model_TCC1: TCCObligation
pf_ec_model: Interpreted_data_type [PF_error_code_type ] = (#
uidt := (#
size := 4,
valid? := pf_ec_valid ?

#),

to_byte:= pf_ec_to_byte ,
to_mask:= Lambda (d : PF_error_code_type , a : Address) :
(zero_mask?(4)),
from_byte:= pf_ec_from_byte

#)

% proof status:−)
pf_ec_valid_to_byte : Lemma Forall(d: PF_error_code_type , a: Address):
valid?(uidt(pf_ec_model ))(to_byte(pf_ec_model )(d, a), a)
% proof status:−)
pf_ec_is_pod : Theorem pod_data_type ?(pf_ec_model )
End PF_EC_Model

Address_Model: Theory

Begin

Importing Address_Datatype
address_valid?(data : list[Byte], a : Address) : bool =
length(data) = 4
% proof status:−)
% address_to_byte_TCC1 : TCCObligation
% proof status:−)
% address_to_byte_TCC2 : TCCObligation
% proof status:−)
% address_to_byte_TCC3 : TCCObligation
address_to_byte (addr : Memory_Address_4G , a : Address) : list[Byte] =
(: cut_bits(offset(addr), 0, 8),
cut_bits(offset(addr), 8, 8),
cut_bits(offset(addr), 16, 8),
cut_bits(offset(addr), 24, 8)

:)

% proof status:−)
% address_from_byte_TCC1 : TCCObligation
% proof status:−)
% address_from_byte_TCC2 : TCCObligation
% proof status:−)
% address_from_byte_TCC3 : TCCObligation
% proof status:−)
% address_from_byte_TCC4 : TCCObligation

B.20 paging-data.pvs

% proof status:−)
% address_from_byte_TCC5 : TCCObligation
address_from_byte (data : list[Byte], a : Address) : lift[Memory_Address_4G ] =
If address_valid?(data, a) Then
up(Mem(overwrite_shift_bits (

overwrite_shift_bits

(

overwrite_shift_bits

(

overwrite_shift_bits

(0,

nth(data, 0), 0, 8),
nth(data, 1), 8, 8),
nth(data, 2), 16, 8),
nth(data, 3), 24, 8)))

Else

bottom Endif

% proof status:−)
% address_model_TCC1: TCCObligation
address_model: Interpreted_data_type [Memory_Address_4G ] = (#
uidt := (#
size := 4,
valid? := address_valid?

#),

to_byte:= address_to_byte ,
to_mask:= Lambda (d : Memory_Address_4G , a : Address) :
(zero_mask?(4)),
from_byte:= address_from_byte

#)

% proof status:−)
address_valid_to_byte : Lemma Forall(d: Memory_Address_4G , a: Address):
valid?(uidt(address_model))(to_byte(address_model)(d, a), a)

% proof status:−)
address_is_pod: Theorem pod_data_type ?(address_model)
End Address_Model

B.20 paging-data.pvs

PDBR_Type: Theory

Begin

Importing IA32, Alignment
% proof status:−)
% Pdbr_type_TCC1: TCCObligation

Pdbr_type: Type = [#
base_addr: {a : Memory_Address_4G| aligned?(12)(offset(a))},
pcd : bool,
pwt : bool

#]

End PDBR_Type

PDBR_Datatype: Theory
% axiomsare discharchedin PDBR_Data_Model

Begin

Importing PDBR_Type, Interpreted_Data[Pdbr_type]
pdbr_data_type_exists : Axiom EXISTS(x: (pod_data_type ?[Pdbr_type])): TRUE
% proof status:−)
% pdbr_data_type_TCC1 : TCCObligation
pdbr_data_type: (pod_data_type ?[Pdbr_type])
End PDBR_Datatype

% Page_Directory_Types [T : Type] : Theory
% typedependencywaitsuntilavailablebits are used
Page_Directory_Types: Theory

Begin

Importing IA32, Memory_privilege, Memory_access_util , Alignment
% proof status:−)
% Pde_pt_type_TCC1: TCCObligation
Pde_pt_type: Type = [#
page_table_base: {a : Memory_Address_4G| aligned?(12)(offset(a))},
% pde_4k_avail: T,
global_page: bool,
accessed : bool,
cache_disabled: bool,
write_through: bool,
privilege : Memory_privilege,
access : RX_Memory_access

#]

Pde_4m_type: Type = [#
page_base: {a : Memory_Address_4G| aligned?(22)(offset(a))},
page_table_attribute_index : bool,
% pde_4m_avail: T,
global_page: bool,
dirty : bool,
accessed : bool,

B.20 paging-data.pvs

cache_disabled: bool,
write_through: bool,
privilege : Memory_privilege,
access : RX_Memory_access

#]

Pte_4k_type: Type = [#
page_base: {a : Memory_Address_4G| aligned?(12)(offset(a))},
% pte_avail: T,
global_page: bool,
page_table_attribute_index : bool,
dirty : bool,
accessed : bool,
cache_disabled: bool,
write_through: bool,
privilege : Memory_privilege,
access : RX_Memory_access

#]

End Page_Directory_Types
% Pde_type[X, Y : Type] : Datatype
% typedependencywaitsuntilavailablebits are used
Pde_type: Datatype

Begin

Importing Page_Directory_Types
% Not_present(data : Y) : not_present?
Not_present: not_present?
Pde_pt(pde_pt: Pde_pt_type ) : pde_pt?
Pde_4m(pde_4m: Pde_4m_type ) : pde_4m?
End Pde_type
PDE_Datatype: Theory

Begin

Importing Pde_type, Interpreted_Data
pde_data_type_exists : Axiom
Exists(x : (pod_data_type ?[Pde_type])) : True
% proof status:−)
% pde_data_type_TCC1 : TCCObligation
pde_data_type: (pod_data_type ?[Pde_type])
End PDE_Datatype
Pte_type: Datatype

Begin

B PVS Theory Sources

Importing Page_Directory_Types
Not_present: not_present?
Pte(pte : Pte_4k_type ) : pte?
End Pte_type
PTE_Datatype: Theory

Begin

Importing Pte_type, Interpreted_Data
pte_data_type_exists : Axiom
Exists(x : (pod_data_type ?[Pte_type])) : True
% proof status:−)
% pte_data_type_TCC1: TCCObligation
pte_data_type: (pod_data_type ?[Pte_type])
End PTE_Datatype
% %
% Use this typeonlyin linearresolveand onlyafter verifyingthe type

%

Paging_type: Datatype

Begin

Importing Pde_type, Pte_type
Ptab(ptab : Pte_type) : ptab?
Pdir(pdir : Pde_type) : pdir?
End Paging_type
Paging_type_helpers: Theory

Begin

Importing Paging_type
pt : Var Paging_type
max_level: nat = 2
Level : Type = below[max_level]
% proof status:−)
% range_pt_TCC1: TCCObligation
range_pt(lvl : Level) : PRED[Paging_type] =
Lambda (p : Paging_type) :

Cond

lvl = 0 −> pdir?(p),
lvl = 1 −> ptab?(p)

EndCond

set_accessed(pt) : Paging_type=
Cases pt Of
Ptab(ptab) :
Cases ptab Of
Not_present: Ptab(Not_present),
Pte(pe) : Ptab(Pte(pe With [accessed := true]))
EndCases,
Pdir(pdir) :
Cases pdir Of
Not_present: Pdir(Not_present),
Pde_pt(pe) : Pdir(Pde_pt(pe With [accessed := true])),
Pde_4m(pe) : Pdir(Pde_4m(pe With [accessed := true]))

EndCases EndCases

set_dirty(pt) : Paging_type=
Cases pt Of
Ptab(ptab) :
Cases ptab Of
Not_present: Ptab(Not_present),
Pte(pe) : Ptab(Pte(pe With [dirty := true]))
EndCases,
Pdir(pdir) :
Cases pdir Of
Not_present: Pdir(Not_present),
Pde_pt(pe) : Pdir(Pde_pt(pe)),
Pde_4m(pe) : Pdir(Pde_4m(pe With [dirty := true]))

EndCases EndCases

set_reference(pt : Paging_type, access : Memory_access) : Paging_type=
If Write?(access) Then
set_accessed(set_dirty(pt))

Else

set_accessed(pt)

Endif

present?(pt) : bool =
Cases pt Of
Ptab(ptab) : Not not_present?(ptab),
Pdir(pdir) : Not not_present?(pdir)

EndCases

% proof status:−)
% base_TCC1: TCCObligation
% proof status:−)
% base_TCC2: TCCObligation
base(pt : (present?)) : Memory_Address_4G=
Cases pt Of
Ptab(ptab) : page_base(pte(ptab)),

Pdir(pdir) :
Cases pdir Of
Pde_pt(pe) : page_table_base (pe),
Pde_4m(pe) : page_base(pe)

EndCases EndCases

accessible?(pt : (present?), access : Memory_access) : bool =
Cases pt Of
Ptab(ptab) : member(access, access(pte(ptab))),
Pdir(pdir) :
Cases pdir Of
Pde_pt(pe) : member(access, access(pe)),
Pde_4m(pe) : member(access, access(pe))

EndCases EndCases

privileged?(pt : (present?), priv : Memory_privilege) : bool =
Cases pt Of
Ptab(ptab) : Not Supervisor?(priv) And User?(privilege(pte(ptab))),
Pdir(pdir) :
Cases pdir Of
Pde_pt(pe) : Not Supervisor?(priv) And User?(privilege(pe)),
Pde_4m(pe) : Not Supervisor?(priv) And User?(privilege(pe))

EndCases EndCases

is_leaf?(pt : (present?)) : bool =
Not (pdir?(pt) And pde_pt?(pdir(pt)))
pdir_entry?(pt) : bool =
pdir?(pt)
ptab_entry?(pt) : bool =
ptab?(pt)
paging_type?(lvl : Level, pe : Paging_type) : bool =

Cond

lvl = 0 −> pdir_entry?(pe),
lvl = 1 −> ptab_entry?(pe)

EndCond

% proof status:−)
set_reference_range: Lemma Forall (lvl : Level, pt : (range_pt(lvl)), access : Memory_access) :
range_pt(lvl)(set_reference(pt, access))
% proof status:−)
set_reference_pdir_entry : Lemma Forall (pt1, pt2 : Paging_type, access : Memory_access) :
set_reference(pt1, access) = set_reference(pt2, access) Implies
pdir_entry?(pt1) = pdir_entry?(pt2)
% proof status:−)

set_reference_ptab_entry : Lemma Forall (pt1, pt2 : Paging_type, access : Memory_access) :
set_reference(pt1, access) = set_reference(pt2, access) Implies
ptab_entry?(pt1) = ptab_entry?(pt2)
% proof status:−)
set_reference_paging_type : Lemma Forall (pt1, pt2 : Paging_type, access : Memory_access, lvl : Level) :
set_reference(pt1, access) = set_reference(pt2, access) Implies
paging_type?(lvl, pt1) = paging_type?(lvl, pt2)
% proof status:−)
set_reference_present: Lemma Forall (pt1, pt2 : Paging_type, access : Memory_access) :
set_reference(pt1, access) = set_reference(pt2, access) Implies
present?(pt1) = present?(pt2)
% proof status:−)
% set_reference_base_TCC1: TCCObligation
% proof status:−)
set_reference_base: Lemma Forall (pt1, pt2 : Paging_type, access : Memory_access) :
set_reference(pt1, access) = set_reference(pt2, access) And present?(pt1) Implies
base(pt1) = base(pt2)
% proof status:−)
set_reference_accessible: Lemma Forall (pt1, pt2 : Paging_type, access, ac1 : Memory_access) :
set_reference(pt1, access) = set_reference(pt2, access) And present?(pt1) Implies
accessible?(pt1, ac1) = accessible?(pt2, ac1)
% proof status:−)
set_reference_privileged: Lemma
Forall (pt1, pt2 : Paging_type, access : Memory_access, priv : Memory_privilege) :
set_reference(pt1, access) = set_reference(pt2, access) And present?(pt1) Implies
privileged?(pt1, priv) = privileged?(pt2, priv)
% proof status:−)
set_reference_leaf: Lemma Forall (pt1, pt2 : Paging_type, access : Memory_access) :
set_reference(pt1, access) = set_reference(pt2, access) And present?(pt1) Implies
is_leaf?(pt1) = is_leaf?(pt2)
End Paging_type_helpers

% To do: removethis theory
Paging_Datatype: Theory

Begin

Importing Paging_type_helpers ,
PTE_Datatype, PDE_Datatype, Interpreted_Data_Lift
% proof status:−)
% paging_data_type_TCC1 : TCCObligation
% proof status:−)

B PVS Theory Sources

% paging_data_type_TCC2 : TCCObligation
% proof status:−)
% paging_data_type_TCC3 : TCCObligation
% proof status:−)
% paging_data_type_TCC4 : TCCObligation
% proof status:−)
% paging_data_type_TCC5 : TCCObligation
% proof status:−)
% paging_data_type_TCC6 : TCCObligation
% proof status:−)
% paging_data_type_TCC7 : TCCObligation
paging_data_type (lvl : Level) : (pod_data_type ?[(range_pt(lvl))]) =

Cond

lvl = 0 −> dt_lift[Pde_type, (range_pt(lvl))](pde_data_type ,
restrict[(pdir?), (range_pt(lvl)), Pde_type](pdir), Pdir),
lvl = 1 −> dt_lift[Pte_type, (range_pt(lvl))](pte_data_type ,
restrict[(ptab?), (range_pt(lvl)), Pte_type](ptab), Ptab)

EndCond

pe_size: nat = 2 % log2 size of page table entries
paging_data_type_size : Axiom
Forall (lvl : Level) :
size(uidt(paging_data_type (lvl))) = expt(2, pe_size)
End Paging_Datatype
PF_Error_Code_Type : Theory

Begin

Importing Interpreted_Data, Error_Code_Types
pf_ec_type_exists : Axiom
Exists(x : (pod_data_type ?[PF_error_code_type ])) : True
% proof status:−)
% pf_ec_data_type_TCC1 : TCCObligation
pf_ec_data_type : (pod_data_type ?[PF_error_code_type ])
End PF_Error_Code_Type
Address_Datatype: Theory

Begin

Importing Interpreted_Data
address_data_type_exists : Axiom
Exists(x : (pod_data_type ?[Memory_Address_4G ])) : True
% proof status:−)
% address_data_type_TCC1 : TCCObligation
address_data_type: (pod_data_type ?[Memory_Address_4G ])
End Address_Datatype

Segment_Types: Theory

Begin

Importing Memory_privilege, IA32
Segment_type: Type = {Data_RO_Accessed , % 0001
Data_RW_Accessed , % 0011
Code_EO_Accessed , % 1001
Code_ER_Accessed , % 1011
% System
LDT, % 0010
TSS32_Avail, % 1001
Interrupt_Gate, % 1110
Trap_Gate% 1111

}

Segment_Selector_type: Type = [#
index : below[expt(2,13)],
table_indicator: bool, % GDT= false, LDT= true
requested_privilege_level: Memory_privilege

#]

Access_Rights_type: Type = [#
segment_type: Segment_type,
system : bool,
privilege : Memory_privilege,
present : bool,
% bits 11:8 reserved
avail : bool,
long_mode: bool,
op_size_32: bool, % true = 32 bit, false = 16 bit
gran : bool,
unusable : bool
% bits 31:7 reserved

#]

% In the VMCS, IA32stores the elementsof this recordin separatefields,
% Onlythe selector field is architecturallyvisible. The remaining
% fieldsare shadowfields.

Segment_Reg_type: Type = [#
selector : Segment_Selector_type ,
base_address: Memory_Address_4G ,
limit : below[expt(2,32)],
access_rights: Access_Rights_type

#]

segment_to_priv (cs : Segment_Reg_type ) : Memory_privilege=
cs‘access_rights‘privilege
End Segment_Types

Segment_Reg_Datatype: Theory

Begin

Importing Interpreted_Data, Segment_Types
% Segment Selector
segment_selector_type_exists : Axiom
Exists (x : (pod_data_type ?[Segment_Selector_type ])) : True
% proof status:−)
% segment_selector_data_type_TCC1 : TCCObligation
segment_selector_data_type : (pod_data_type ?[Segment_Selector_type ])
% Segment Register
segment_reg_data_type_exists : Axiom
Exists(x : (pod_data_type ?[Segment_Reg_type ])) : True
% proof status:−)
% segment_reg_data_type_TCC1 : TCCObligation
segment_reg_data_type : (pod_data_type ?[Segment_Reg_type ])
End Segment_Reg_Datatype

Control_Register_Types: Theory

Begin

Importing IA32
CR0_type: Type = [#
foo : bool,
bar : bool

#]

CR2_type: Type = Memory_Address_4G

B.21 physical_memory.pvs

CR4_type: Type = [#
foo : bool

#]

End Control_Register_Types
Control_Register_Datatype: Theory

Begin

Importing Control_Register_Types , Interpreted_Data
cr0_data_type_exists : Axiom
Exists(x : (pod_data_type ?[CR0_type])) : True
% proof status:−)
% cr0_data_type_TCC1: TCCObligation
cr0_data_type: (pod_data_type ?[CR0_type])
cr2_data_type_exists : Axiom
Exists(x : (pod_data_type ?[CR2_type])) : True
% proof status:−)
% cr2_data_type_TCC1: TCCObligation
cr2_data_type: (pod_data_type ?[CR2_type])
cr4_data_type_exists : Axiom
Exists(x : (pod_data_type ?[CR4_type])) : True
% proof status:−)
% cr4_data_type_TCC1: TCCObligation
cr4_data_type: (pod_data_type ?[CR4_type])
End Control_Register_Datatype

B.21 physical_memory.pvs

% specificationof physicalmemory

Physical_Memory[(Importing IA32) min, max : Memory_Address] : Theory

Begin

IMPORTING ExprResult, Unit
Physical_memory: Type = [Address −> Byte]
% read & write

s : Var Physical_memory
a : Var Address
b : Var Byte
bl : Var list[Byte]
cp : Var bool % cross page access
physical_read_side_effect (id : Address, bl, cp)(s) : ExprResult[Physical_memory, list[Byte]] =
% Cases id Of
% Else
OK(s, bl)
% EndCases
physical_write_side_effect (id : Address, bl, cp)(s) : ExprResult[Physical_memory, list[Byte]] =
% Cases id Of
% Else
OK(s, bl)
% EndCases
physical_read(a)(s) : ExprResult[Physical_memory, Byte] =
If in_memory(min, max)(a) Then
OK(s, s(a))

Else

Fatal Endif

physical_write(a : Address, b : Byte)(s) : ExprResult[Physical_memory, Unit] =
If in_memory(min, max)(a) Then
OK(s With [(a) := b], unit)

Else

Fatal Endif

End Physical_Memory

Physical_Memory_Corollaries[(Importing IA32) min, max : Memory_Address] : Theory

Begin

IMPORTING Physical_Memory[min, max]
s : Var Physical_memory
a : Var Address
b : Var Byte
% %%%%% Nextstates
% proof status:−)
% physical_read_ok_next_state_TCC1 : TCCObligation
% proof status:−)
physical_read_ok_next_state : Lemma
OK?(physical_read(a)(s)) Implies state(physical_read(a)(s)) = s

B.21 physical_memory.pvs

% proof status:−)
% physical_write_ok_next_state_TCC1 : TCCObligation
% proof status:−)
physical_write_ok_next_state : Lemma
OK?(physical_write(a, b)(s)) Implies
state(physical_write(a, b)(s)) = s with [(a) := b]
% %%%%% Returneddata
% proof status:−)
physical_read_ok_get_data : Lemma
OK?(physical_read(a)(s)) Implies
data(physical_read(a)(s)) = s(a)

End Physical_Memory_Corollaries

Physical_Memory_Properties[(Importing IA32) min, max : Memory_Address] : Theory

Begin

IMPORTING Physical_Memory[min, max]
s : Var Physical_memory
a : Var Address
b : Var Byte
% %%%%%%%%%%%%%%%%%%%%%%%%%%%  utilitylemma
% proof status:−)
physical_read_ok: Lemma in_memory(min, max)(a) Implies OK?(physical_read(a)(s))
% proof status:−)
physical_write_ok: Lemma in_memory(min, max)(a) Implies OK?(physical_write(a, b)(s))

End Physical_Memory_Properties

Memory_Physical_Memory [(IMPORTING IA32) min, max : Memory_Address] : Theory
% Definesthe physicalmemoryinstanceof memory

Begin

IMPORTING Physical_Memory[min, max]
IMPORTING Memory[Physical_memory]
% % IMPORTINGTransformer_Result_State
% %%%% PublicInterface%%%%%
phy_mem: Memory_struct= (#

memory_read:= physical_read,
memory_write:= physical_write,
memory_write_side_effect := physical_write_side_effect ,
memory_read_side_effect := physical_read_side_effect

#)

End Memory_Physical_Memory

B.22 plain_memory.pvs

Plain_Memory[ State : Type ] : Theory
% plainmemorydefinitionand immediateutilityresults

Begin

IMPORTING Memory_Change_2
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% PlainMemoryDefinition

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Plain_Memory: Type = [#
mem : Memory_struct[State],
states : PRED[State],
ro_addr: PRED[Address],
rw_addr: PRED[Address],
other_actions: PRED[[State −> SuperResult[State]]]

#]

pm : Var Plain_Memory
addr : Var Address
size : Var nat

% We need to add one additionalset of addressesto expressthat
% certaindevicestate remainsunchangeddespiteblessedaccesses.
% Therebythe memoryitself needs not to be blessed.

%

% Example: writingto RAMdoes not change the APICEOIregisterstate.

%

% Read, write, other_actionand side effect transformersmust establish
% an invariantwhichstates:
% − that when readinga subset of the addressesis allowed, the same
% valuesare read, and
% − that deviceaccesses behavethe same before and after the blessed
% memoryaccess
% − Thisrulesout that the memoryaccess counteris in the above set
% whichis what we desire.
% − How can we formalizethis point? How do we preventthe devicefrom

B.22 plain_memory.pvs

% changinginternalstate whichmay onlybe seen after a sequence of
% futureaccesses?
plain_memory?(pm) : bool =
% there is an invarianthidden, see below
unchanged_memory_invariant ?(pm‘mem, pm‘states,
union(
union(pm‘other_actions,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr))),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))),
union(pm‘ro_addr, pm‘rw_addr))

AND

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_transformers (pm‘mem, pm‘rw_addr),
pm‘ro_addr)

AND

unchanged_memory_write_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)

AND

changed_memory_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)

AND

transformers_ok?(pm‘states,
union(
union(memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)),
memory_write_transformers (pm‘mem, pm‘rw_addr)),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))))

And

side_effect_content_unchanged (union(pm‘ro_addr, pm‘rw_addr), pm‘states,
memory_read_side_effect (pm‘mem))

And

side_effect_content_unchanged (pm‘rw_addr, pm‘states,
memory_write_side_effect (pm‘mem))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Utilityresults

%

% transformerinvariants

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
plain_memory_invariant_read_transformers_ro_addr : Lemma
plain_memory?(pm) Implies
transformer_invariant?(pm‘states,
memory_read_transformers (pm‘mem, pm‘ro_addr))
% proof status:−)

plain_memory_invariant_read_transformers_rw_addr : Lemma
plain_memory?(pm) Implies
transformer_invariant?(pm‘states,
memory_read_transformers (pm‘mem, pm‘rw_addr))
% proof status:−)
plain_memory_invariant_read_transformers_ro_rw_addr : Lemma
plain_memory?(pm) Implies
transformer_invariant?(pm‘states,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)))
% proof status:−)
plain_memory_invariant_write_transformers_rw_addr : Lemma
plain_memory?(pm) Implies
transformer_invariant?(pm‘states,
memory_write_transformers (pm‘mem, pm‘rw_addr))

% proof status:−)
plain_memory_invariant: Lemma
plain_memory?(pm) Implies
transformer_invariant?(pm‘states,
union(
pm‘other_actions,
union(union(memory_read_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_transformers (pm‘mem, pm‘rw_addr)),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem,
pm‘rw_addr)))))
% proof status:−)
plain_memory_unchanged_invariant : Lemma
plain_memory?(pm) Implies
unchanged_memory_invariant ?(pm‘mem, pm‘states,
union(
union(pm‘other_actions,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr))),
union(memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)),
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
plain_memory_unchanged_memory_invariant_write : Lemma
plain_memory?(pm) Implies
unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_transformers (pm‘mem, pm‘rw_addr),
pm‘ro_addr)
% proof status:−)

plain_memory_unchanged_memory_write_invariant : Lemma
plain_memory?(pm) Implies
unchanged_memory_write_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)
% proof status:−)
plain_memory_changed_memory_invariant : Lemma
plain_memory?(pm) Implies
changed_memory_invariant ?(pm‘mem, pm‘states, pm‘rw_addr)

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% transformerinvariantson blocks

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
plain_memory_invariant_read_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

transformer_invariant?(pm‘states, memory_read_transformers (pm‘mem,
address_block(addr, size)))
% proof status:−)
plain_memory_invariant_write_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

transformer_invariant?(pm‘states,
memory_write_transformers (pm‘mem, address_block(addr, size)))
% proof status:−)
plain_memory_transformer_invariant_read_side_effects : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

transformer_invariant?(pm‘states,
memory_read_side_effect_super_transformers (pm‘mem,
address_block(addr, size)))
% proof status:−)
plain_memory_transformer_invariant_write_side_effects : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

transformer_invariant?(pm‘states,
memory_write_side_effect_super_transformers (pm‘mem,
address_block(addr, size)))
% proof status:−)
plain_memory_transformer_invariant_read_list_block : Lemma

plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

transformer_invariant?(pm‘states,
union(memory_read_transformers (pm‘mem, address_block(addr, size)),
memory_read_side_effect_super_transformers (pm‘mem,
address_block(addr, size))))

% proof status:−)
plain_memory_transformer_invariant_write_list_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

transformer_invariant?(pm‘states,
union(memory_write_transformers (pm‘mem, address_block(addr, size)),
memory_write_side_effect_super_transformers (pm‘mem,
address_block(addr, size))))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% transformers_ok?

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
plain_memory_transformers_ok_read_ro_rw : Lemma
plain_memory?(pm)

Implies

transformers_ok?(pm‘states,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)))
% proof status:−)
plain_memory_transformers_ok_read_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

transformers_ok?(pm‘states, memory_read_transformers (pm‘mem,
address_block(addr, size)))
% proof status:−)
plain_memory_transformers_ok_write_rw : Lemma
plain_memory?(pm)

Implies

transformers_ok?(pm‘states,
memory_write_transformers (pm‘mem, pm‘rw_addr))
% proof status:−)
plain_memory_transformers_ok_write_block : Lemma
plain_memory?(pm) And

subset?(address_block(addr, size), pm‘rw_addr)

Implies

transformers_ok?(pm‘states,
memory_write_transformers (pm‘mem, address_block(addr, size)))
% proof status:−)
plain_memory_transformers_ok_read_side_effects_ro_rw : Lemma
plain_memory?(pm)

Implies

transformers_ok?(pm‘states,
memory_read_side_effect_super_transformers (pm‘mem,
union(pm‘ro_addr, pm‘rw_addr)))
% proof status:−)
plain_memory_transformers_ok_read_side_effects_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

transformers_ok?(pm‘states,
memory_read_side_effect_super_transformers (pm‘mem,
address_block(addr, size)))
% proof status:−)
plain_memory_transformers_ok_write_side_effects_ro_rw : Lemma
plain_memory?(pm)

Implies

transformers_ok?(pm‘states,
memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))
% proof status:−)
plain_memory_transformers_ok_write_side_effects_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

transformers_ok?(pm‘states,
memory_write_side_effect_super_transformers (pm‘mem,
address_block(addr, size)))

% proof status:−)
plain_memory_transformers_ok_read_list_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

transformers_ok?(pm‘states,
union(memory_read_transformers (pm‘mem, address_block(addr, size)),
memory_read_side_effect_super_transformers (pm‘mem,
address_block(addr, size))))

% proof status:−)

plain_memory_transformers_ok_write_list_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

transformers_ok?(pm‘states,
union(memory_write_transformers (pm‘mem, address_block(addr, size)),
memory_write_side_effect_super_transformers (pm‘mem,
address_block(addr, size))))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% unchanged_memory_invariant

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
plain_memory_unchanged_read_block_rw_addr : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_read_transformers (pm‘mem, address_block(addr, size)),
pm‘rw_addr)
% proof status:−)
plain_memory_unchanged_read_ro_rw_addr : Lemma
plain_memory?(pm) Implies
unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_read_transformers (pm‘mem, union(pm‘ro_addr, pm‘rw_addr)),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
plain_memory_unchanged_read_block_ro_rw_addr : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_read_transformers (pm‘mem, address_block(addr, size)),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
plain_memory_unchanged_write_block_ro_addr : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_transformers (pm‘mem, address_block(addr, size)),
pm‘ro_addr)
% unchangedinvariantsof reading
% proof status:−)

B.22 plain_memory.pvs

plain_memory_unchanged_read_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_read_transformers (pm‘mem, address_block(addr, size)),
address_block(addr, size))
% proof status:−)
plain_memory_unchanged_read_side_effect_block_ro_rw : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_read_side_effect_super_transformers (pm‘mem,
address_block(addr, size)),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
plain_memory_unchanged_read_side_effect_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_read_side_effect_super_transformers (pm‘mem,
address_block(addr, size)),
address_block(addr, size))
% proof status:−)
plain_memory_unchanged_write_side_effect_block_ro_rw : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_side_effect_super_transformers (pm‘mem,
address_block(addr, size)),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
plain_memory_unchanged_write_side_effect_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
memory_write_side_effect_super_transformers (pm‘mem,
address_block(addr, size)),
address_block(addr, size))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% unchanged_memory_write_invariant

%

B PVS Theory Sources

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
plain_memory_unchanged_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

unchanged_memory_write_invariant ?(pm‘mem, pm‘states,
address_block(addr, size))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% changed_memory_invariant

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
plain_memory_changed_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

changed_memory_invariant ?(pm‘mem, pm‘states, address_block(addr, size))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% side_effect_content_unchanged

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
plain_memory_side_effect_content_unchanged_read_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

side_effect_content_unchanged (address_block(addr, size), pm‘states,
memory_read_side_effect (pm‘mem))
% proof status:−)
plain_memory_side_effect_content_unchanged_write_block : Lemma
plain_memory?(pm) And
subset?(address_block(addr, size), pm‘rw_addr)

Implies

side_effect_content_unchanged (address_block(addr, size), pm‘states,
memory_write_side_effect (pm‘mem))
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% single reads/writes

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
plain_memory_memory_read_ok : Lemma Forall(s : State) :
plain_memory?(pm) And
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr) Implies
OK?(memory_read(pm‘mem)(addr)(s))
% proof status:−)
% plain_memory_states_memory_read_TCC1 : TCCObligation
% proof status:−)
plain_memory_states_memory_read : Lemma Forall(s : State) :
plain_memory?(pm) And
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr) Implies
pm‘states(state(memory_read(pm‘mem)(addr)(s)))
% proof status:−)
% plain_memory_memory_read_memory_read_TCC1 : TCCObligation
% proof status:−)
% plain_memory_memory_read_memory_read_TCC2 : TCCObligation
% proof status:−)
% plain_memory_memory_read_memory_read_TCC3 : TCCObligation
% proof status:−)
plain_memory_memory_read_memory_read : Lemma
Forall(s : State, addr1, addr2 : Address) :
plain_memory?(pm) And
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr1) And
union(pm‘ro_addr, pm‘rw_addr)(addr2) Implies
data(memory_read(pm‘mem)(addr1)(state(memory_read(pm‘mem)(addr2)(s)))) =
data(memory_read(pm‘mem)(addr1)(s))
% proof status:−)
plain_memory_memory_write_ok : Lemma Forall(s : State, byte : Byte) :
plain_memory?(pm) And
pm‘states(s) And
pm‘rw_addr(addr) Implies
OK?(memory_write(pm‘mem)(addr, byte)(s))
% proof status:−)
% plain_memory_states_memory_write_TCC1 : TCCObligation
% proof status:−)
plain_memory_states_memory_write : Lemma Forall(s : State, byte : Byte) :
plain_memory?(pm) And
pm‘states(s) And

pm‘rw_addr(addr) Implies
pm‘states(state(memory_write(pm‘mem)(addr, byte)(s)))
% proof status:−)
% plain_memory_memory_read_memory_write_other_TCC1 : TCCObligation
% proof status:−)
% plain_memory_memory_read_memory_write_other_TCC2 : TCCObligation
% proof status:−)
% plain_memory_memory_read_memory_write_other_TCC3 : TCCObligation
% proof status:−)
plain_memory_memory_read_memory_write_other : Lemma
Forall(s : State, ro_addr, rw_addr: Address, byte : Byte) :
plain_memory?(pm) And
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(ro_addr) And
pm‘rw_addr(rw_addr) And
Not ro_addr= rw_addrImplies
data(memory_read(pm‘mem)(ro_addr)
(state(memory_write(pm‘mem)(rw_addr, byte)(s)))) =
data(memory_read(pm‘mem)(ro_addr)(s))

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% restrictingchanges a la separationlogic

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% proof status:−)
% stays_unchanged_TCC1: TCCObligation
% proof status:−)
% stays_unchanged_TCC2: TCCObligation
stays_unchanged(pm : (plain_memory?))
(s1, s2 : (pm‘states), addresses : PRED[Address]) : bool =
Forall(addr : Address) :
union(pm‘ro_addr, pm‘rw_addr)(addr) And
addresses(addr) Implies
data(memory_read(pm‘mem)(addr)(s1)) =
data(memory_read(pm‘mem)(addr)(s2))
% proof status:−)
% stays_unchanged_unchanged_TCC1 : TCCObligation
% proof status:−)
% stays_unchanged_unchanged_TCC2 : TCCObligation

% proof status:−)
stays_unchanged_unchanged: Lemma
Forall(s1, s2 : State, addresses : PRED[Address], addr : Address) :
plain_memory?(pm) And
pm‘states(s1) And pm‘states(s2) And
union(pm‘ro_addr, pm‘rw_addr)(addr) And
stays_unchanged(pm)(s1, s2, addresses) And
addresses(addr)

Implies

data(memory_read(pm‘mem)(addr)(s1)) =
data(memory_read(pm‘mem)(addr)(s2))
% proof status:−)
stays_unchanged_symmetric: Lemma
Forall(s1, s2 : State, addresses : PRED[Address]) :
plain_memory?(pm) And
pm‘states(s1) And pm‘states(s2) Implies
stays_unchanged(pm)(s1, s2, addresses) =
stays_unchanged(pm)(s2, s1, addresses)
% proof status:−)
stays_unchanged_mono: Lemma
Forall(s1, s2 : State, addresses_1, addresses_2: PRED[Address]) :
plain_memory?(pm) And
pm‘states(s1) And pm‘states(s2) And
subset?(addresses_1, addresses_2) And
stays_unchanged(pm)(s1, s2, addresses_2) Implies
stays_unchanged(pm)(s1, s2, addresses_1)

only_changes(pm : (plain_memory?))
(s1, s2 : (pm‘states), addresses : PRED[Address]) : bool =
stays_unchanged(pm)(s1, s2,
union(pm‘ro_addr, difference(pm‘rw_addr, addresses)))
% proof status:−)
stays_unchanged_only_changes : Lemma
Forall(s1, s2 : State, addresses : PRED[Address]) :
plain_memory?(pm) And
pm‘states(s1) And pm‘states(s2) And
subset?(pm‘ro_addr, addresses) Implies
stays_unchanged(pm)(s1, s2, addresses) =
only_changes(pm)(s1, s2, difference(pm‘rw_addr, addresses))

% proof status:−)
stays_unchanged_only_changes_disjoint : Lemma
Forall(s1, s2 : State, addresses_1, addresses_2: PRED[Address]) :
plain_memory?(pm) And
pm‘states(s1) And pm‘states(s2) And
subset?(addresses_2, union(pm‘ro_addr, pm‘rw_addr)) And

disjoint?(addresses_1, addresses_2) And
only_changes(pm)(s1, s2, addresses_1)

Implies

stays_unchanged(pm)(s1, s2, addresses_2)

% proof status:−)
only_changes_symmetric: Lemma
Forall(s1, s2 : State, addresses : PRED[Address]) :
plain_memory?(pm) And
pm‘states(s1) And pm‘states(s2) Implies
only_changes(pm)(s1, s2, addresses) =
only_changes(pm)(s2, s1, addresses)
% proof status:−)
only_changes_mono: Lemma
Forall(s1, s2 : State, addresses_1, addresses_2: PRED[Address]) :
plain_memory?(pm) And
pm‘states(s1) And pm‘states(s2) And
subset?(addresses_1, addresses_2) And
only_changes(pm)(s1, s2, addresses_1) Implies
only_changes(pm)(s1, s2, addresses_2)
% proof status:−)
% only_changes_unchanged_TCC1 : TCCObligation
% proof status:−)
% only_changes_unchanged_TCC2 : TCCObligation
% proof status:−)
only_changes_unchanged: Lemma
Forall(s1, s2 : State, addresses : PRED[Address]) :
plain_memory?(pm) And
pm‘states(s1) And pm‘states(s2) And
only_changes(pm)(s1, s2, addresses) And
(pm‘ro_addr(addr) OR
pm‘rw_addr(addr) And Not addresses(addr))

Implies

data(memory_read(pm‘mem)(addr)(s1)) =
data(memory_read(pm‘mem)(addr)(s2))
% proof status:−)
% plain_memory_stays_unchanged_memory_read_TCC1 : TCCObligation
% proof status:−)
plain_memory_stays_unchanged_memory_read : Lemma
Forall(s : State, addr : Address) :
plain_memory?(pm) And
pm‘states(s) And
union(pm‘ro_addr, pm‘rw_addr)(addr)

Implies

stays_unchanged(pm)(s, state(memory_read(pm‘mem)(addr)(s)),

union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
% plain_memory_stays_unchanged_memory_write_TCC1 : TCCObligation
% proof status:−)
plain_memory_stays_unchanged_memory_write : Lemma
Forall(s : State, addr : Address, byte : Byte) :
plain_memory?(pm) And
pm‘states(s) And
pm‘rw_addr(addr)

Implies

stays_unchanged(pm)(s,
state(memory_write(pm‘mem)(addr, byte)(s)),
remove(addr, union(pm‘ro_addr, pm‘rw_addr)))
End Plain_Memory

Abstract_Read_Write_Plain [State, Data : Type] : Theory

Begin

Importing Plain_Memory, Abstract_Read_Write
pm : Var Plain_Memory[State]
dt : Var (interpreted_data_type ?[Data])
s : Var State
addr : Var Address
data : Var Data
write_data(pm, dt)(addr, data) : [State −> ExprResult[State, Unit]] =
write_data(pm‘mem, dt)(addr, data)
read_data(pm, dt)(addr) : [State −> ExprResult[State, Data]] =
read_data(pm‘mem, dt)(addr)
valid_in_mem (pm, dt)(addr) : [State −> bool] =
valid_in_mem (pm‘mem, dt)(addr)
End Abstract_Read_Write_Plain

Plain_Mem_Properties [State : Type] : Theory

%

% primitive(non−datatype) read and writeson plainmemory

Begin

IMPORTING Plain_Memory[State]
pm : Var Plain_Memory[State]

s : Var State
addr : Var Address
size : Var nat
% readinga block of memoryis a transformerinvariant
% writingto a block of memoryis a transformerinvariant
% proof status:−)
% plain_mem_write_list_read_list_TCC1 : TCCObligation
% proof status:−)
plain_mem_write_list_read_list : Lemma
Forall(size : nat, bl : list[Byte]) :
size = length(bl) AND
plain_memory?(pm) And
pm‘states(s) And
subset?(address_block(addr, size), pm‘rw_addr) And
OK?(memory_write_list (pm‘mem)(addr, bl)(s)) And
OK?(memory_read_list (pm‘mem)(addr, size)
(state(memory_write_list (pm‘mem) (addr, bl)(s))))

Implies

data(memory_read_list (pm‘mem)(addr, size)
(state(memory_write_list(pm‘mem) (addr, bl) (s))))
= bl
% proof status:−)
% plain_mem_q_read_list_TCC1 : TCCObligation
% proof status:−)
plain_mem_q_read_list : Lemma Forall(q : [State −> SuperResult[State]]) :
OK?(memory_read_list (pm‘mem)(addr, size)(s)) And
OK?(q(s)) And
OK?(memory_read_list (pm‘mem)(addr, size)(state(q(s)))) And
plain_memory?(pm) And
unchanged_memory_invariant ?(pm‘mem, pm‘states, singleton(q),
address_block(addr, size)) And
pm‘states(s) And
subset?(address_block(addr, size), union(pm‘ro_addr, pm‘rw_addr))

Implies

data(memory_read_list (pm‘mem)(addr, size) (state(q(s))))
= data(memory_read_list (pm‘mem)(addr, size) (s))
End Plain_Mem_Properties

Plain_Mem_Properties_2 [State, Data : Type] : Theory

Begin

IMPORTING Plain_Mem_Properties , Abstract_Read_Write_Plain
pm : Var Plain_Memory[State]

dt : Var (interpreted_data_type ?[Data])
s : Var State
addr : Var Address
data : Var Data
% proof status:−)
% plain_memory_inv_pred_write_data_TCC1 : TCCObligation
% proof status:−)
plain_memory_inv_pred_write_data : Lemma
plain_memory?(pm) And
pm‘states(s) And
subset?(address_block(addr, size(uidt(dt))), pm‘rw_addr) And
OK?(write_data(pm, dt)(addr, data)(s))

Implies

pm‘states(state(write_data(pm, dt)(addr, data)(s)))
% proof status:−)
plain_memory_read_data_ok : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr)) And
valid_in_mem (pm, dt)(addr)(s)

Implies

OK?(read_data(pm,dt)(addr)(s))

% proof status:−)
plain_memory_write_data_ok : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt, addr, pm‘rw_addr)

Implies

OK?(write_data(pm,dt)(addr, data)(s))

% proof status:−)
% plain_memory_write_data_valid_TCC1 : TCCObligation
% proof status:−)
plain_memory_write_data_valid : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt, addr, pm‘rw_addr)

Implies

valid_in_mem (pm, dt)(addr)
(state(write_data(pm, dt)(addr, data)(s)))

% proof status:−)
plain_memory_transformers_ok_write_data : Lemma
plain_memory?(pm) AND

in_blessed_memory ?(dt, addr, pm‘rw_addr)

Implies

transformers_ok?(pm‘states,
singleton(expr_2_super (write_data(pm, dt) (addr, data))))

% proof status:−)
plain_memory_transformer_invariant_write_data : Lemma
plain_memory?(pm) AND
in_blessed_memory ?(dt, addr, pm‘rw_addr)

Implies

transformer_invariant?(pm‘states,
singleton(expr_2_super (write_data(pm, dt) (addr, data))))
% proof status:−)
plain_memory_transformer_invariant_read_data : Lemma
plain_memory?(pm) AND
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr))

Implies

transformer_invariant?(pm‘states,
singleton(expr_2_super (read_data(pm, dt) (addr))))

% proof status:−)
plain_memory_unchanged_memory_invariant_write_data : Lemma
plain_memory?(pm) AND
in_blessed_memory ?(dt, addr, pm‘rw_addr)

IMPLIES

unchanged_memory_invariant ?(pm‘mem, pm‘states,
singleton(expr_2_super (write_data(pm, dt)(addr, data))),
difference(union(pm‘ro_addr, pm‘rw_addr),
address_block(addr, size(uidt(dt)))))
% proof status:−)
plain_memory_unchanged_memory_invariant_read_data : Lemma
plain_memory?(pm) AND
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr))

IMPLIES

unchanged_memory_invariant ?(pm‘mem, pm‘states,
singleton(expr_2_super (read_data(pm, dt)(addr))),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
% plain_memory_read_data_q_ok_TCC1 : TCCObligation
% proof status:−)
plain_memory_read_data_q_ok : Lemma
Forall(q : [State −> SuperResult[State]]) :
plain_memory?(pm) AND
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr)) AND
unchanged_memory_invariant ?(pm‘mem, pm‘states, singleton(q),
address_block(addr, size(uidt(dt)))) And

pm‘states(s) And
OK?(q(s)) And
valid_in_mem (pm,dt)(addr)(s) Implies
OK?(read_data(pm, dt)(addr)(state(q(s))))
% proof status:−)
% plain_memory_read_data_q_same_TCC1 : TCCObligation
% proof status:−)
% plain_memory_read_data_q_same_TCC2 : TCCObligation
% proof status:−)
plain_memory_read_data_q_same : Lemma
Forall(q : [State −> SuperResult[State]]) :
plain_memory?(pm) AND
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr)) AND
unchanged_memory_invariant ?(pm‘mem, pm‘states, singleton(q),
address_block(addr, size(uidt(dt)))) And
pm‘states(s) And
OK?(q(s)) And
valid_in_mem (pm,dt)(addr)(s) Implies
data(read_data(pm, dt)(addr)(state(q(s)))) =
data(read_data(pm, dt)(addr)(s))

% proof status:−)
plain_memory_read_write_ok : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt, addr, pm‘rw_addr)

IMPLIES

OK?((
write_data(pm,dt)(addr, data) ##
read_data(pm,dt)(addr)
)(s)

)

% proof status:−)
% plain_memory_read_write_res_TCC1 : TCCObligation
% proof status:−)
plain_memory_read_write_res : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt, addr, pm‘rw_addr)

IMPLIES

data((
write_data(pm,dt)(addr, data) ##
read_data(pm,dt)(addr)
)(s))
= data

addresses : VAR PRED[Address]
% proof status:−)
plain_memory_unchanged_memory_ok_result : Lemma
Forall (d : Data) :
plain_memory?(pm) And
subset?(addresses, union(pm‘ro_addr, pm‘rw_addr))

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
singleton(expr_2_super [State, Data](ok_result(d))),
addresses)
end Plain_Mem_Properties_2
Plain_Mem_Properties_3 [State, Data1, Data2 : Type] : Theory

%

% reads after writeat differentplaces returnthe previousitem

Begin

Importing Plain_Mem_Properties_2 , Memory_Change_4
% Memory_Change_To_Unit
pm : Var Plain_Memory[State]
dt1 : Var (interpreted_data_type ?[Data1])
dt2 : Var (interpreted_data_type ?[Data2])
s : Var State
addr1, addr2 : Var Address
data1 : Var Data1

% proof status:−)
plain_memory_read_write_other_ok : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) AND
valid_in_mem (pm,dt2)(addr2)(s)

IMPLIES

OK?

((

write_data(pm,dt1)(addr1, data1) ##
read_data(pm,dt2)(addr2)
)(s)

)

% proof status:−)
% plain_memory_read_write_other_res_TCC1 : TCCObligation
% proof status:−)
% plain_memory_read_write_other_res_TCC2 : TCCObligation

B.22 plain_memory.pvs

% proof status:−)
plain_memory_read_write_other_res : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) AND
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) AND
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) AND
valid_in_mem (pm,dt2)(addr2)(s)

IMPLIES

data((
write_data(pm,dt1)(addr1, data1) ##
read_data(pm,dt2)(addr2)
)(s))

=

data(read_data(pm,dt2)(addr2)(s))
% proof status:−)
plain_memory_read_read_ok : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) AND
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) AND
valid_in_mem (pm,dt1)(addr1)(s) And
valid_in_mem (pm,dt2)(addr2)(s)

IMPLIES

OK?(
( read_data(pm, dt1)(addr1) ##
read_data(pm, dt2)(addr2)
)(s)

)

% proof status:−)
% plain_memory_read_read_TCC1 : TCCObligation
% proof status:−)
% plain_memory_read_read_TCC2 : TCCObligation
% proof status:−)
plain_memory_read_read : Lemma
plain_memory?(pm) AND
pm‘states(s) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) AND
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) AND
valid_in_mem (pm,dt1)(addr1)(s) And
valid_in_mem (pm,dt2)(addr2)(s)

IMPLIES

data(
( read_data(pm, dt1)(addr1) ##
read_data(pm, dt2)(addr2)
)(s)

)

= data(read_data(pm, dt2)(addr2)(s))
q : Var [State −> ExprResult[State, Data1]]
r : Var [Data1 −> [State −> ExprResult[State, Data2]]]
addresses : VAR PRED[Address]
% proof status:−)
plain_memory_unchanged_composition : Lemma
Forall (P : PRED[Data1]) :
plain_memory?(pm) And
subset?(addresses, union(pm‘ro_addr, pm‘rw_addr)) And
(Forall (s : (pm‘states)) : OK?(q(s)) Implies P(data(q(s)))) And
unchanged_memory_invariant ?(pm‘mem, pm‘states,
singleton(expr_2_super (q)), addresses)

And

(Forall (d : (P)) : unchanged_memory_invariant ?(pm‘mem, pm‘states,
singleton(expr_2_super (r(d))), addresses))

Implies

unchanged_memory_invariant ?(pm‘mem, pm‘states,
singleton(expr_2_super (q ## r)), addresses)
End Plain_Mem_Properties_3

B.23 plain_memory_rewrites.pvs

% Rewriterules
% ===============
Block_Disjoint_Rewrites: Theory

Begin

Importing Address_Util
addr1, addr2 : Var Address
sz1, sz2 : Var nat
% differentregistersare block disjoint
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
different_registers_blocks_disjoint : Lemma
type_of(addr1) /= type_of(addr2)

Implies

blocks_disjoint?(addr1, sz1, addr2, sz2)
End Block_Disjoint_Rewrites

Plain_Mem_Rewrites1 [State : Type] : Theory

Begin

Importing Plain_Mem_Properties_3 , ExpressionStatements

B.23 plain_memory_rewrites.pvs

pm : Var Plain_Memory[State]
s : Var State
% proof status:−)
% pm_q_prop_TCC1: TCCObligation
pm_q_prop (pm : Plain_Memory[State])(res : StmtResult[State]) : bool =
OK?(res) And pm‘states(state(res))
% proof status:−)
pm_q_prop_ok_stmt : Lemma % !!! Lemmadoes not rewrite
Forall (q : [State −> StmtResult[State]]):
plain_memory?(pm) And
pm_q_prop (pm)(q(s))

Implies

OK?(q(s))

End Plain_Mem_Rewrites1

Plain_Mem_Rewrites2 [State, Data : Type] : Theory

Begin

Importing Plain_Mem_Rewrites1
pm : Var Plain_Memory[State]
dt : Var (interpreted_data_type ?[Data])
s : Var State
addr : Var Address
data : Var Data
% in blessedmemoryrewrite
% proof status:−)
in_blessed_memory_rw_ro : Lemma % (P: 4)
in_blessed_memory ?(dt, addr, pm‘rw_addr)

Implies

in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr))
% pm_q_prop
% −−−−−−−−−−−
% proof status:−)
% pm_q_prop_TCC1: TCCObligation
pm_q_prop (pm : Plain_Memory[State])(res : ExprResult[State, Data]) : bool =
OK?(res) And pm‘states(state(res))
% proof status:−)
pm_q_prop_ok_expr : Lemma % !!! Lemmadoes not rewrite

Forall (q : [State −> ExprResult[State, Data]]) :
plain_memory?(pm) And
pm_q_prop (pm)(q(s))

Implies

OK?(q(s))
% pm_q_propsimplification
% −−−−−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
pm_q_prop_single_read : Lemma % (P: 4)
plain_memory?(pm) And
pm‘states(s) And
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr)) And
valid_in_mem (pm, dt)(addr)(s)

Implies

pm_q_prop (pm)(read_data(pm, dt)(addr)(s))
% proof status:−)
pm_q_prop_ok_result_single : Lemma % (P: 4)
pm‘states(s)

Implies

pm_q_prop (pm)(ok_result(data)(s))
% plain_write_data_q_ok
% −−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
plain_memory_write_ok_single : Lemma
plain_memory?(pm) And
pm‘states(s) And
in_blessed_memory ?(dt, addr, pm‘rw_addr)

Implies

OK?(write_data(pm, dt)(addr, data)(s))
% proof status:−)
% pm_q_prop_read_TCC1 : TCCObligation
pm_q_prop_read (pm : Plain_Memory[State], dt, addr)(res : StmtResult[State]) : bool =
OK?(res) And OK?(read_data(pm, dt)(addr)(state(res))) And
pm‘states(state(res))
End Plain_Mem_Rewrites2
Plain_Mem_Rewrites3 [State, Data, Data_q: Type] : Theory

Begin

Importing Plain_Mem_Rewrites2
pm : Var Plain_Memory[State]
dt : Var (interpreted_data_type ?[Data])

s : Var State
addr : Var Address
% proof status:−)
% pm_q_prop_read_TCC1 : TCCObligation
pm_q_prop_read (pm : Plain_Memory[State], dt, addr)(res : ExprResult[State, Data_q]) : bool =
OK?(res) And OK?(read_data(pm, dt)(addr)(state(res))) And
pm‘states(state(res))
End Plain_Mem_Rewrites3

% Rewriterulesfor lemmasfrom Plain_Mem_Properties_3
Plain_Mem_Rewrites4 [State, Data, Data_q: Type] : Theory

Begin

Importing Plain_Mem_Rewrites3
pm : Var Plain_Memory[State]
dt : Var (interpreted_data_type ?[Data])
s : Var State
addr : Var Address
data : Var Data
% pm_q_prop
% −−−−−−−−−−−
% proof status:−)
plain_memory_write_ok_q_expr : Lemma
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, pm‘rw_addr) And
pm_q_prop (pm)(q(s))

Implies

OK?((q ## write_data(pm, dt)(addr, data))(s))
% proof status:−)
pm_q_prop_read_ok_expr : Lemma
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
pm_q_prop_read (pm, dt, addr)(q(s))

Implies

OK?((q ## read_data(pm, dt)(addr))(s))
% proof status:−)
pm_q_prop_read_pm_q_prop_expr : Lemma
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr)) And
pm_q_prop_read (pm, dt, addr)(q(s))

B PVS Theory Sources

Implies

pm_q_prop (pm)((q ## read_data(pm, dt)(addr))(s))
% proof status:−)
pm_q_prop_read_write_q_expr : Lemma
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, pm‘rw_addr) And
pm_q_prop (pm)(q(s))

Implies

pm_q_prop_read (pm, dt, addr)((q ## write_data(pm, dt)(addr, data))(s))
% proof status:−)
pm_q_prop_ok_result_q_expr : Lemma
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
pm_q_prop (pm)(q(s))

Implies

pm_q_prop (pm)((q ## ok_result[State, Data](data))(s))
data_q: Var Data_q
% proof status:−)
pm_q_prop_read_ok_result_single : Lemma
plain_memory?(pm) And
pm‘states(s) And
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr)) And
valid_in_mem (pm, dt)(addr)(s)

Implies

pm_q_prop_read (pm, dt, addr)(ok_result[State, Data_q](data_q)(s))
% data
% −−−−−−
% proof status:−)
% plain_memory_read_write_q_data_expr_TCC1 : TCCObligation
% proof status:−)
plain_memory_read_write_q_data_expr : Lemma
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, pm‘rw_addr) And
pm_q_prop (pm)(q(s))

Implies

data((q ## write_data(pm, dt)(addr, data) ##
read_data(pm, dt)(addr))(s)) = data
% pm_q_propsimplification
% −−−−−−−−−−−−−−−−−−−−−−−−−−
dt1 : Var (interpreted_data_type ?[Data])
dt2 : Var (interpreted_data_type ?[Data_q])

addr1 : Var Address
addr2 : Var Address
% proof status:−)
pm_q_prop_read_write_other_single : Lemma % (P: 4)
plain_memory?(pm) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) And
valid_in_mem (pm, dt2)(addr2)(s) And
pm‘states(s)

Implies

pm_q_prop_read (pm, dt2, addr2)(write_data(pm, dt1)(addr1, data)(s))
% proof status:−)
pm_q_prop_read_read_single : Lemma % (P: 4)
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) And
valid_in_mem (pm, dt1)(addr1)(s) And
valid_in_mem (pm, dt2)(addr2)(s) And
pm‘states(s)

Implies

pm_q_prop_read (pm, dt2, addr2)(read_data(pm, dt1)(addr1)(s))
End Plain_Mem_Rewrites4
Plain_Mem_Rewrites5 [State, Data : Type] : Theory

Begin

Importing Plain_Mem_Rewrites4
pm : Var Plain_Memory[State]
dt : Var (interpreted_data_type ?[Data])
s : Var State
addr : Var Address
data : Var Data
% pm_q_propsimplification
% −−−−−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
plain_memory_write_ok_q_stmt : Lemma
Forall (q : [State −> StmtResult[State]]):
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, pm‘rw_addr) And
pm_q_prop (pm)(q(s))

Implies

OK?((q ## write_data(pm, dt)(addr, data))(s))

% proof status:−)
pm_q_prop_read_ok_stmt : Lemma
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
pm_q_prop_read (pm, dt, addr)(q(s))

Implies

OK?((q ## read_data(pm, dt)(addr))(s))
% proof status:−)
pm_q_prop_read_pm_q_prop_stmt : Lemma
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, union(pm‘ro_addr, pm‘rw_addr)) And
pm_q_prop_read (pm, dt, addr)(q(s))

Implies

pm_q_prop (pm)((q ## read_data(pm, dt)(addr))(s))
% proof status:−)
pm_q_prop_read_write_q_stmt : Lemma
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, pm‘rw_addr) And
pm_q_prop (pm)(q(s))

Implies

pm_q_prop_read (pm, dt, addr)((q ## write_data(pm, dt)(addr, data))(s))
% proof status:−)
pm_q_prop_ok_result_q_stmt : Lemma
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
pm_q_prop (pm)(q(s))

Implies

pm_q_prop (pm)((q ## ok_result[State, Data](data))(s))
% proof status:−)
% plain_memory_read_write_q_data_stmt_TCC1 : TCCObligation
% proof status:−)
plain_memory_read_write_q_data_stmt : Lemma
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, pm‘rw_addr) And
pm_q_prop (pm)(q(s))

Implies

data((q ## write_data(pm, dt)(addr, data) ##
read_data(pm, dt)(addr))(s)) = data
% proof status:−)
pm_q_prop_single_write : Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, pm‘rw_addr) And
pm‘states(s)

B.23 plain_memory_rewrites.pvs

Implies

pm_q_prop (pm)(write_data(pm, dt)(addr, data)(s))
% proof status:−)
pm_q_prop_read_write_single : Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt, addr, pm‘rw_addr) And
pm‘states(s)

Implies

pm_q_prop_read (pm, dt, addr)(write_data(pm, dt)(addr, data)(s))
% plain_memory_read_write_single_data = plain_memory_read_write_res
expr : VAR [State −> ExprResult[State, Data]]
stmt : VAR [State −> StmtResult[State]]
% proof status:−)
pm_q_prop_e2s : Lemma
pm_q_prop (pm)(e2s(expr)(s)) = pm_q_prop (pm)(expr(s))
% proof status:−)
pm_q_prop_stmt_e2s : Lemma
pm_q_prop (pm)(stmt(s)) Implies
pm_q_prop (pm)((stmt ## e2s(expr))(s)) = pm_q_prop (pm)((stmt ## expr)(s))
End Plain_Mem_Rewrites5
Plain_Mem_Rewrites6 [State, Data1, Data2, Data_q: Type] : Theory

Begin

Importing Plain_Mem_Rewrites5
pm : Var Plain_Memory[State]
dt1 : Var (interpreted_data_type ?[Data1])
dt2 : Var (interpreted_data_type ?[Data2])
s : Var State
addr1, addr2 : Var Address
data1 : Var Data1
data2 : Var Data2
% pm_q_propsimplification
% −−−−−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
pm_q_prop_read_write_other_q_expr : Lemma % (P: 6)
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And

in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
pm_q_prop_read (pm, dt1, addr1)(q(s))

Implies

pm_q_prop_read (pm, dt1, addr1)((q ## write_data(pm, dt2)(addr2, data2))(s))
% proof status:−)
pm_q_prop_read_read_q_expr : Lemma % (P: 6)
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) And
pm_q_prop_read (pm, dt1, addr1)(q(s)) And
pm_q_prop_read (pm, dt2, addr2)(q(s))

Implies

pm_q_prop_read (pm, dt2, addr2)((q ## read_data(pm, dt1)(addr1))(s))
% proof status:−)
pm_q_prop_read_ok_result_q_expr : Lemma % (P: 4)
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
pm_q_prop_read (pm, dt2, addr2)(q(s))

Implies

pm_q_prop_read (pm, dt2, addr2)((q ## ok_result[State, Data1](data1))(s))
% plain_memory_read_read_single_data = plain_memory_read_read
% proof status:−)
% plain_memory_read_read_q_data_expr_TCC1 : TCCObligation
% proof status:−)
% plain_memory_read_read_q_data_expr_TCC2 : TCCObligation
% proof status:−)
plain_memory_read_read_q_data_expr : Lemma % (P: 6)
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) And
pm_q_prop_read (pm, dt2, addr2)(q(s)) And
pm_q_prop_read (pm, dt1, addr1)(q(s))

Implies

data((q ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1))(s)) =
data((q ## read_data(pm, dt1)(addr1))(s))
End Plain_Mem_Rewrites6

Plain_Mem_Rewrites7[State, Data1, Data2 : Type] : Theory

Begin

Importing Plain_Mem_Rewrites6

pm : VAR Plain_Memory[State]
s : VAR State
expr : VAR [State −> ExprResult[State, Data1]]
expr1 : VAR [State −> ExprResult[State, Data2]]
dt1 : Var (interpreted_data_type ?[Data1])
dt2 : Var (interpreted_data_type ?[Data2])
addr1, addr2 : Var Address
data1 : Var Data1
data2 : Var Data2
% proof status:−)
pm_q_prop_read_write_other_q_stmt : Lemma % (P: 6)
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
pm_q_prop_read (pm, dt1, addr1)(q(s))

Implies

pm_q_prop_read (pm, dt1, addr1)((q ## write_data(pm, dt2)(addr2, data2))(s))
% proof status:−)
% plain_memory_read_write_other_single_data_TCC1 : TCCObligation
% proof status:−)
% plain_memory_read_write_other_single_data_TCC2 : TCCObligation
% proof status:−)
plain_memory_read_write_other_single_data : Lemma % (P: 4)
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
pm_q_prop (pm)(read_data(pm, dt1)(addr1)(s)) And
pm‘states(s)

Implies

data((write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1))(s)) =
data((read_data(pm, dt1)(addr1))(s))
% proof status:−)
pm_q_prop_read_read_q_stmt : Lemma % (P: 6)
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) And
pm_q_prop_read (pm, dt1, addr1)(q(s)) And
pm_q_prop_read (pm, dt2, addr2)(q(s))

Implies

pm_q_prop_read (pm, dt2, addr2)((q ## read_data(pm, dt1)(addr1))(s))
% proof status:−)

pm_q_prop_read_ok_result_q_stmt : Lemma % (P: 4)
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
pm_q_prop_read (pm, dt2, addr2)(q(s))

Implies

pm_q_prop_read (pm, dt2, addr2)((q ## ok_result[State, Data1](data1))(s))
% proof status:−)
% plain_memory_read_write_other_q_data_stmt_TCC1 : TCCObligation
% proof status:−)
% plain_memory_read_write_other_q_data_stmt_TCC2 : TCCObligation
% proof status:−)
plain_memory_read_write_other_q_data_stmt : Lemma % (P: 6)
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
pm_q_prop_read (pm, dt1, addr1)(q(s))

Implies

data((q ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1))(s)) =
data((q ## read_data(pm, dt1)(addr1))(s))
% proof status:−)
% plain_memory_read_read_q_data_stmt_TCC1 : TCCObligation
% proof status:−)
% plain_memory_read_read_q_data_stmt_TCC2 : TCCObligation
% proof status:−)
plain_memory_read_read_q_data_stmt : Lemma % (P: 6)
Forall (q : [State −> StmtResult[State]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt2, addr2, union(pm‘ro_addr, pm‘rw_addr)) And
pm_q_prop_read (pm, dt2, addr2)(q(s)) And
pm_q_prop_read (pm, dt1, addr1)(q(s))

Implies

data((q ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1))(s)) =
data((q ## read_data(pm, dt1)(addr1))(s))
% proof status:−)
pm_q_prop_read_e2s : Lemma
pm_q_prop_read (pm, dt1, addr1)(expr1(s)) Implies
pm_q_prop_read (pm, dt1, addr1)(e2s(expr1)(s))
stmt : VAR [State −> StmtResult[State]]
% proof status:−)
pm_q_prop_read_stmt_e2s : Lemma

pm_q_prop_read (pm, dt1, addr1)(stmt(s)) Implies
pm_q_prop_read (pm, dt1, addr1)((stmt ## e2s(expr1))(s)) =
pm_q_prop_read (pm, dt1, addr1)((stmt ## expr1)(s))
End Plain_Mem_Rewrites7

Plain_Mem_Rewrites8[State, Data1, Data2, Data_q: Type] : Theory

Begin

Importing Plain_Mem_Rewrites7
pm : VAR Plain_Memory[State]
s : VAR State
dt1 : Var (interpreted_data_type ?[Data1])
dt2 : Var (interpreted_data_type ?[Data2])
addr1, addr2 : Var Address
data1 : Var Data1
data2 : Var Data2

% proof status:−)
% plain_memory_read_write_other_q_data_expr_TCC1 : TCCObligation
% proof status:−)
% plain_memory_read_write_other_q_data_expr_TCC2 : TCCObligation
% proof status:−)
plain_memory_read_write_other_q_data_expr : Lemma % (P: 6)
Forall (q : [State −> ExprResult[State, Data_q]]) :
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
pm_q_prop_read (pm, dt1, addr1)(q(s))

Implies

data((q ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1))(s)) =
data((q ## read_data(pm, dt1)(addr1))(s))

End Plain_Mem_Rewrites8

Plain_Mem_Rewrites: Theory

Begin

Importing Plain_Mem_Rewrites8
End Plain_Mem_Rewrites

Rewrite_Test[(Importing IA32) max : Memory_Address,
State, Data1, Data2 : Type] : Theory

Begin

Importing Plain_Memory[State]
Importing Plain_Mem_Rewrites
pm : Var Plain_Memory[State]
dt1 : Var (interpreted_data_type ?[Data1])
dt2 : Var (interpreted_data_type ?[Data2])
s : Var State
addr1, addr2 : Var Address
data1 : Var Data1
data2 : Var Data2

% Test for PlainMem Rewrites
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
rewrite_test: Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) And
pm‘states(s)

Implies

OK?(
(write_data(pm, dt1)(addr1, data1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
read_data(pm, dt1)(addr1)
)(s))
% proof status:−)
% rewrite_test_data_TCC1 : TCCObligation
% proof status:−)
rewrite_test_data: Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) And
pm‘states(s)

Implies

data(
(write_data(pm, dt1)(addr1, data1) ##

write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
read_data(pm, dt1)(addr1)
)(s)) = data1
% proof status:−)
% rewrite_test_data_long_TCC1 : TCCObligation
% proof status:−)
rewrite_test_data_long : Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) And
pm‘states(s)

Implies

data(
(write_data(pm, dt1)(addr1, data1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##

read_data(pm, dt2)(addr2) ##
read_data(pm, dt1)(addr1)
)(s)) = data1
% proof status:−)
rewrite_test_data_eval_if_ok_ok : Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) And
pm‘states(s)

Implies

OK?(
(write_data(pm, dt1)(addr1, data1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
Lambda(d : Data2) :
read_data(pm, dt1)(addr1))(s))

% proof status:−)
% rewrite_test_data_eval_if_ok_TCC1 : TCCObligation
% proof status:−)
rewrite_test_data_eval_if_ok : Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) And
pm‘states(s)

Implies

data(
(write_data(pm, dt1)(addr1, data1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
Lambda(d : Data2) :
read_data(pm, dt1)(addr1)
)(s)) = data1
% proof status:−)
rewrite_test_data_eval_if_ok_ok_result_ok : Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) And

pm‘states(s)

Implies

OK?[State, Data2](
(write_data(pm, dt1)(addr1, data1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
Lambda(d : Data2) :
ok_result(d)
)(s))
% proof status:−)
% rewrite_test_data_eval_if_ok_ok_result_TCC1 : TCCObligation
% proof status:−)
rewrite_test_data_eval_if_ok_ok_result : Lemma
plain_memory?(pm) And
in_blessed_memory ?(dt1, addr1, pm‘rw_addr) And
in_blessed_memory ?(dt2, addr2, pm‘rw_addr) And
blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) And
blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) And
pm‘states(s)

Implies

data(
(write_data(pm, dt1)(addr1, data1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt1)(addr1) ##
write_data(pm, dt2)(addr2, data2) ##
read_data(pm, dt2)(addr2) ##
Lambda(d : Data2) :
ok_result(d)
)(s)) = data2
End Rewrite_Test
% Rewrites: PlainMemory
% (auto−rewrite
% "plain_memory_write_ok_single "
% "plain_memory_write_ok_q_expr "
% "plain_memory_write_ok_q_stmt "
% "in_blessed_memory_rw_ro "
% "pm_q_prop_ok "
% "pm_q_prop_single_read "
% "pm_q_prop_single_write "
% "pm_q_prop_read_write_single "
% "pm_q_prop_read_write_other_single "
% "pm_q_prop_read_read_single "
% "plain_memory_read_write_other_single_data "
% "plain_memory_read_read "
% "plain_memory_read_write_res "
% "pm_q_prop_read_ok_expr "

% "pm_q_prop_read_ok_stmt "
% "pm_q_prop_read_pm_q_prop_expr "
% "pm_q_prop_read_pm_q_prop_stmt "
% "pm_q_prop_read_write_q_expr "
% "pm_q_prop_read_write_q_stmt "
% "plain_memory_read_write_q_data_expr "
% "plain_memory_read_write_q_data_stmt "
% "pm_q_prop_read_write_other_q_expr "
% "pm_q_prop_read_write_other_q_stmt "
% "pm_q_prop_read_read_q_expr "
% "pm_q_prop_read_read_q_stmt "
% "plain_memory_read_write_other_q_data_expr "
% "plain_memory_read_write_other_q_data_stmt "
% "plain_memory_read_read_q_data_expr "
% "plain_memory_read_read_q_data_stmt "
% "pm_q_prop_ok_result_single "
% "pm_q_prop_ok_result_q_expr "
% "pm_q_prop_ok_result_q_stmt "
% "pm_q_prop_read_ok_result_single "
% "pm_q_prop_read_ok_result_q_expr "
% "pm_q_prop_read_ok_result_q_stmt "
% "pm_q_prop_e2s "
% "pm_q_prop_stmt_e2s "
% "pm_q_prop_read_e2s "
% "pm_q_prop_read_stmt_e2s "
% )

B.24 ptab-sync-master-defs.pvs

reinterpret_cast_thy[State, Data1, Data2 : Type] : Theory

Begin

Importing Cpp_Verification
dt1 : VAR (interpreted_data_type ?[Data1])
dt2 : VAR (interpreted_data_type ?[Data2])
reinterpret_cast(dt1, dt2)(ex : ET[State, Data2]) : ET[State, Data1] =

(

ex ## lambda (d2 : Data2) :
allocate_stack(uidt(dt2)) ## lambda (a : Address) :
write_data(pm, dt2)(a, d2) ##
read_data(pm, dt1)(a) ## lambda (d1 : Data1) :
deallocate_stack(uidt(dt2), a) ##
ok_result[State, Data1](d1)

)

End reinterpret_cast_thy

ptab_types: Theory

B.24 ptab-sync-master-defs.pvs

Begin

Paging : Type
Buddy : Type
Ptab : Type
void : Type
End ptab_types

ptab_sync_master_defs_state_transformers [State : Type] : Theory

Begin

Importing Cpp_Verification, ptab_types

static_cast_nocv_unsigned_long_long_reference_to_nocv_unsigned_long_int

(ex : ET[State, (range(ulonglong))]) : ET[State, (range(ulong))] =

(

ex ## lambda (t : (range(ulonglong))) :
If true Then % (TODO) FIXME: dt_pred(ulonglong)(t) Then
ok_result(t)

Else

fatal_result Endif

)

static_cast_nocv_void_nocv_pointer_to_nocv_Ptab_nocv_pointer

(ex : ET[State, (range(pointer(void)))]) : ET[State, (range(pointer(class("Ptab",false))))]

int_conv_nocv_unsigned_long_int_reference_to_const_unsigned_int

(ex : ET[State, (range(ulong))]) : ET[State, (range(uint))]

int_conv_nocv_unsigned_long_int_to_nocv_unsigned_int

(ex : ET[State, (range(ulong))]) : ET[State, (range(uint))]
End ptab_sync_master_defs_state_transformers

ptab_sync_master_defs : Theory

Begin

Importing ptab_sync_master_defs_state_transformers , reinterpret_cast_thy
% To do:
% ========
% − generatestaticallyinitialisedvariablesand constants
% − generateoffsets
% offsets
% MV: >> fix pointer

Ofs_Paging_type: Type = [#
val : nat

#]

offsets_Paging: Ofs_Paging_type
Ofs_Buddy_type: Type = [#
l_base: nat,
r_base: nat,
p_base: nat

#]

offsets_Buddy: Ofs_Buddy_type
% Enum
ATTR_PRESENT: (range(ulonglong)) = shift_bits_right (1, 0)
ATTR_NOEXEC: (range(ulonglong)) = shift_bits_right (1, 63)
ATTR_ALL: (range(ulonglong)) = 0 % bitor(ATTR_NOEXEC , (shift_bits_right (1, 12) − 1))
% static members; static const initialisationis missing
levels : Address
bits_per_level: Address
allocator : Address
Ptab : Cpp_Type
End ptab_sync_master_defs

B.25 ptab-sync-master.pvs

ptab_sync_master [State : Type] : THEORY

BEGIN

IMPORTING Cpp_Verification
IMPORTING ptab_sync_master_defs
% Functionsemanticsfor addr
% File"nova/include/paging.h",line 69, character9
addr(receiver : Address)(ret_addr: Address) : ST[State] =
return(pm, dt_ulonglong, ret_addr)(bitand(ulonglong)(member(id(receiver),
offsets_Paging‘val),
unary_bitnot(int)(id(ATTR_ALL))))
call_addr(receiver : ET[State, Semantics_reference[Paging]]) : ET[State,
Semantics_ulonglong] =
with_new_returnvar (pm, dt_ulonglong)(lambda (ret_addr: Address) :
receiver ##
(lambda (receiver_addr: Address):
addr(receiver_addr)(ret_addr)))

B.25 ptab-sync-master.pvs

% Functionsemanticsfor operator=
% File"nova/include/paging.h",line 16, character1
operator_assign_Paging (receiver : Address, other : Address)(ret_addr: Address)
: ST[State] =
e2s(assign(pm, dt_ulonglong)(member(id(receiver), offsets_Paging‘val),
member(id(other), offsets_Paging‘val))) ##
return(pm, dt_reference[Paging], ret_addr)(id(receiver))
call_operator_assign_Paging (receiver : ET[State,
Semantics_reference[Paging]],
other : ET[State, Semantics_reference[Paging]])
: ET[State, Semantics_reference[Paging]] =
with_new_returnvar (pm, dt_reference[Paging])(lambda (ret_addr: Address) :
other ##
(lambda (other_addr: Address):
receiver ##
(lambda (receiver_addr: Address):
operator_assign_Paging (receiver_addr, other_addr)(ret_addr))))

% Functionsemanticsfor operator=
% File"nova/include/ptab.h",line 20, character1
operator_assign_Ptab (receiver : Address, other : Address)(ret_addr: Address)
: ST[State] =
e2s(call_operator_assign (id(receiver), id(other))) ##
return(pm, dt_reference[Ptab], ret_addr)(id(receiver))
call_operator_assign_Ptab (receiver : ET[State, Semantics_reference[Ptab]],
other : ET[State, Semantics_reference[Ptab]]) :
ET[State, Semantics_reference[Ptab]] =
with_new_returnvar (pm, dt_reference[Ptab])(lambda (ret_addr: Address) :
other ##
(lambda (other_addr: Address):
receiver ##
(lambda (receiver_addr: Address):
operator_assign_Ptab (receiver_addr, other_addr)(ret_addr))))

% Functionsemanticsfor present
% File"nova/include/paging.h",line 81, character9
present(receiver : Address)(ret_addr: Address) : ST[State] =
return(pm, dt_ulonglong, ret_addr)(bitand(ulonglong)(member(id(receiver),
offsets_Paging‘val),
id(ATTR_PRESENT)))
call_present(receiver : ET[State, Semantics_reference[Paging]]) : ET[State,
Semantics_bool] =
with_new_returnvar (pm, dt_bool)(lambda (ret_addr: Address) :
receiver ##
(lambda (receiver_addr: Address):
present(receiver_addr)(ret_addr)))

% Functionsemanticsfor phys_to_virt
% File"nova/include/buddy.h",line 74, character9
phys_to_virt (receiver : Address, phys : Address)(ret_addr: Address) :
ST[State] =
return(pm, dt_ulong, ret_addr)(plus(ulong)(minus(ulong)(id(phys),
member(id(receiver),
offsets_Buddy‘p_base)),
member(id(receiver),
offsets_Buddy‘l_base)))
call_phys_to_virt (receiver : ET[State, Semantics_reference[Buddy]],
phys : ET[State, Semantics_ulong]) : ET[State,
Semantics_ulong] =
with_new_returnvar (pm, dt_ulong)(lambda (ret_addr: Address) :
with_new_stackvar (dt_ulong)(lambda (phys_addr: Address):
e2s(assign(pm, dt_ulong)(id(phys_addr), phys)) ##
receiver ##
(lambda (receiver_addr: Address):
phys_to_virt (receiver_addr, phys_addr)(ret_addr))))

% Functionsemanticsfor phys_to_ptr
% File"nova/include/buddy.h",line 97, character9
phys_to_ptr (phys : Address)(ret_addr: Address) : ST[State] =
return(pm, dt_pointer[void], ret_addr)(reinterpret_cast(dt_pointer[void],

dt_ulong)

(call_phys_to_virt (id(allocator),

static_cast_nocv_unsigned_long_long_reference_to_nocv_unsigned_long_int

(id(phys)))))
call_phys_to_ptr (phys : ET[State, Semantics_ulonglong]) : ET[State,
Semantics_pointer[void]] =
with_new_returnvar (pm, dt_pointer[void])(lambda (ret_addr: Address) :
with_new_stackvar (dt_ulonglong)(lambda (phys_addr: Address):
e2s(assign(pm, dt_ulonglong)(id(phys_addr), phys)) ##
phys_to_ptr (phys_addr)(ret_addr)))

% Functionsemanticsfor master
% File"nova/include/ptab.h",line 36, character9
master(ret_addr: Address) : ST[State] =
with_new_stackvar (lambda (master_l: Address):
e2s(skip) ##
return(pm, dt_Address, ret_addr)(id(master_l)))
call_master: ET[State, Semantics_pointer[Ptab]] =
with_new_returnvar (pm, dt_pointer[Ptab])(lambda (ret_addr: Address) :
master)

% Functionsemanticsfor sync_master

B.25 ptab-sync-master.pvs

% File"nova/ptab.cpp",line 203, character1
sync_master(receiver : Address, virt : Address)(ret_addr: Address) :
ST[State] =
with_new_stackvar (lambda (lev : Address):
with_new_stackvar (lambda (pte : Address):
with_new_stackvar (lambda (mst : Address):
e2s(assign(pm, dt_uint)(id(lev), l2r(pm, dt_uint)(id(levels)))) ##
e2s(skip ## skip) ##
for(e2s(comma(reference[pointer[Ptab]])(assign(pm, dt_pointer[Ptab])
(id(pte), id(receiver)),
assign(pm, dt_pointer[Ptab])
(id(mst), call_master))),
n2b(literal(true)),
comma(reference[pointer[Ptab]])(assign(pm, dt_pointer[Ptab])
(id(pte),

static_cast_nocv_void_nocv_pointer_to_nocv_Ptab_nocv_pointer

(call_phys_to_ptr (
call_addr(id(pte))))),
assign(pm, dt_pointer[Ptab])
(id(mst),

static_cast_nocv_void_nocv_pointer_to_nocv_Ptab_nocv_pointer

(call_phys_to_ptr (
call_addr(id(mst)))))),
with_new_stackvar (lambda (shift : Address):
with_new_stackvar (lambda (slot : Address):
with_new_stackvar (lambda (size : Address):
e2s(assign(pm, dt_uint)(id(shift),
plus(uint)(times(uint)
(predec(pm, reference[uint])(id(lev)),
id(bits_per_level )),
literal[State, Semantics_int](12)))) ##
e2s(assign(pm, dt_uint)(id(slot),

int_conv_nocv_unsigned_long_int_to_nocv_unsigned_int

(

bitand(ulong)(shr(ulong)
(id(virt),
id(shift)),
minus(ulong)
(shl(ulong)
(literal[State, Semantics_ulong](1),
id(bits_per_level )),
literal[State, Semantics_int](1)))))) ##
e2s(assign(pm, dt_uint)(id(size),

int_conv_nocv_unsigned_long_int_to_nocv_unsigned_int

(

shl(ulong)(literal[State, Semantics_ulong](1),
id(shift))))) ##
e2s(assign_plus(pm, pointer[Ptab])(id(mst),
l2r(pm, dt(int))
(id(slot)))) ##
e2s(assign_plus(pm, pointer[Ptab])(id(pte),
l2r(pm, dt(int))
(id(slot)))) ##
if_else(call_present(id(mst)),

B PVS Theory Sources

if_else(eq(bool)(id(slot),
bitand(uint)(shr(uint)(literal[State, Semantics_uint](−807403520),
id(shift)),
minus(ulong)
(shl(ulong)
(literal[State, Semantics_ulong](1),
id(bits_per_level )),
literal[State, Semantics_int](1)))),
skip ##
continue,
skip) ##
e2s(call_operator_assign (id(pte), id(mst))) ##
skip,
skip) ##
return(pm, dt_reference[uint], ret_addr)(id(size))))))))) ##

return_void

call_sync_master (receiver : ET[State, Semantics_reference[Ptab]],
virt : ET[State, Semantics_ulong]) : ET[State,
Semantics_uint] =
with_new_returnvar (pm, dt_uint)(lambda (ret_addr: Address) :
with_new_stackvar (dt_ulong)(lambda (virt_addr: Address):
e2s(assign(pm, dt_ulong)(id(virt_addr), virt)) ##
receiver ##
(lambda (receiver_addr: Address):
sync_master(receiver_addr, virt_addr)(ret_addr))))
END ptab_sync_master

B.26 random_device.pvs

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% RandomDevice

%

% base : base addressof the device
% [base + rnd_seed] : Word(32 bit) − seed value% 2^32
% [base + mem_cnt] : Word− memoryaccess count % 2^32 ;
% writingto mem_cntclears the counterto 0
% [base + rnd_val] : Word− randomvaluebased on choose(seed x cnt x N);
% the valueis randomas long as states are
% initialisedwithdifferingseed values
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Random_Device[Physical_memory: Type,
(Importing Plain_Memory)
pm : Plain_Memory[Physical_memory]] : Theory

Begin Assuming

B.26 random_device.pvs

Importing Cpp_Types
dt_uint_size: Assumption
0 < size(uidt(dt_uint)) And 3 ∗ size(uidt(dt_uint)) <= max_linear_offset

EndAssuming

% DeviceState
% −−−−−−−−−−−−−−
Random_device_state: Type = [#
seed : nat,
memory_access_count: nat,
counter_offset: {n : nat | n <= memory_access_count }

#]

% proof status:−)
% base_TCC1: TCCObligation
size : nat = 3 ∗ size(uidt(dt_uint))
base : ({m : Memory_Address_4G| m + size <= max_linear})
% proof status:−)
% rnd_seed_TCC1: TCCObligation
% proof status:−)
% mem_cnt_TCC1: TCCObligation
% proof status:−)
% rnd_val_TCC1: TCCObligation
rnd_seed: Memory_Address_4G= base + 0 ∗ size(uidt(dt_uint))
mem_cnt: Memory_Address_4G= base + 1 ∗ size(uidt(dt_uint))
rnd_val: Memory_Address_4G= base + 2 ∗ size(uidt(dt_uint))
Importing Device_Memory[Physical_memory, pm, Random_device_state ]
Random_device_memory: Type = Device_memory
s : Var Random_device_memory
% Accessorfunctions
% −−−−−−−−−−−−−−−−−−−−
seed(s) : nat = s‘expansion‘seed
access_count(s) : nat = s‘expansion‘memory_access_count
counter_offset(s) : nat = s‘expansion‘counter_offset
% proof status:−)
% increase_access_count_TCC1: TCCObligation
increase_access_count (s)(n : nat) : Random_device_memory=
s With [(expansion) := s‘expansion With [(memory_access_count ) := access_count(s) + n]]

% proof status:−)
% clear_counter_TCC1: TCCObligation
clear_counter(s) : Random_device_memory=
s With [(expansion) := s‘expansion With [(counter_offset) := access_count(s)]]
% Side Effects
% −−−−−−−−−−−−−−
access_count(a : Address, bl : list[Byte], cp : bool)(s) :
ExprResult[Random_device_memory , list[Byte]] =
OK(increase_access_count (s)(length(bl)), bl)
unaligned_access(a : Address, bl : list[Byte], cp : bool) :
[Random_device_memory−> ExprResult[Random_device_memory , list[Byte]]] =
If null?(bl) Or disjoint?(address_block(a, length(bl)),
address_block(base, size)) Or
% check alignedaccess
(Not cp And length(bl) = size(uidt(dt_uint)) And
(a = rnd_seedOr a = mem_cntOr a = rnd_val)) Then
ok_result(bl)

Else

fatal_result Endif

% proof status:−)
% random_TCC1: TCCObligation
random(seed : nat, count : nat) :
{l : list[Byte] | length(l) = size(uidt(dt_uint))}
random(s : Random_device_memory ) : list[Byte] =
random(seed(s), access_count(s))
read_rnd_val (a : Address, bl : list[Byte], cp : bool) :
[Random_device_memory−> ExprResult[Random_device_memory , list[Byte]]] =
If cons?(bl) And a = rnd_valThen
Lambda (s : Random_device_memory ) : ok_result(random(s))(s)

Else

ok_result(bl)

Endif

% proof status:−)
% read_mem_cnt_TCC1: TCCObligation
% proof status:−)
% read_mem_cnt_TCC2: TCCObligation
% proof status:−)
% read_mem_cnt_TCC3: TCCObligation
read_mem_cnt (a : Address, bl : list[Byte], cp : bool) :
[Random_device_memory−> ExprResult[Random_device_memory , list[Byte]]] =

If cons?(bl) And a = mem_cntThen
Lambda (s : Random_device_memory ) :
ok_result(dt_uint‘to_byte(
rem(max_value(uint))(access_count(s) − counter_offset(s)), mem_cnt))(s)

Else

ok_result(bl)

Endif

% proof status:−)
% read_seed_TCC1: TCCObligation
% proof status:−)
% read_seed_TCC2: TCCObligation
% proof status:−)
% read_seed_TCC3: TCCObligation
read_seed(a : Address, bl : list[Byte], cp : bool) :
[Random_device_memory−> ExprResult[Random_device_memory , list[Byte]]] =
If cons?(bl) And a = rnd_seedThen
Lambda (s : Random_device_memory ) : ok_result(
dt_uint‘to_byte(rem(max_value(uint))(seed(s)), rnd_seed))(s)

Else

ok_result(bl)

Endif

write_rnd_dev (a : Address, bl : list[Byte], cp : bool) :
[Random_device_memory−> ExprResult[Random_device_memory , list[Byte]]] =
If cons?(bl) And (a = rnd_valOr a = rnd_seed) Then

fatal_result Else

ok_result(bl)

Endif

reset_count(a : Address, bl : list[Byte], cp : bool)(s) :
ExprResult[Random_device_memory , list[Byte]] =
If cons?(bl) And a = mem_cntThen
OK(clear_counter(s), bl)

Else

ok_result(bl)(s)

Endif

% read side effects
rnd_dev_read_side_effect (a : Address, bl : list[Byte], cp : bool) :
[Random_device_memory−> ExprResult[Random_device_memory , list[Byte]]] =

(

unaligned_access(a, bl, cp) ## Lambda (bl : list[Byte]) :
access_count(a, bl, cp) ## Lambda (bl : list[Byte]) :
read_rnd_val (a, bl, cp) ## Lambda (bl : list[Byte]) :
read_mem_cnt (a, bl, cp) ## Lambda (bl : list[Byte]) :
read_seed(a, bl, cp)

)

rnd_dev_write_side_effect (a : Address, bl : list[Byte], cp : bool) :
[Random_device_memory−> ExprResult[Random_device_memory , list[Byte]]] =

(

unaligned_access(a, bl, cp) ## Lambda (bl : list[Byte]) :
access_count(a, bl, cp) ## Lambda (bl : list[Byte]) :
write_rnd_dev (a, bl, cp) ## Lambda (bl : list[Byte]) :
reset_count(a, bl, cp)

)

% PlainMemory
% ==============
% MemoryStruct
% −−−−−−−−−−−−−−−
random_device_pm_mem : Memory_struct[Random_device_memory ] =
device_pm(rnd_dev_read_side_effect , rnd_dev_write_side_effect )
% Random_DevicePM Struct
% −−−−−−−−−−−−−−−−−−−−−−−−−
random_device_pm: Plain_Memory[Random_device_memory ] = (#
mem := random_device_pm_mem ,
states := em_lift(pm‘states),
ro_addr:= difference(pm‘ro_addr, address_block(base, size)),
rw_addr:= difference(pm‘rw_addr, address_block(base, size)),
other_actions:= em_lift(pm‘other_actions)

#)

End Random_Device
Challenge_Random_Device [Physical_memory: Type,
(Importing Plain_Memory)
pm_phy: Plain_Memory[Physical_memory]] : Theory

Begin

Assuming

Importing Cpp_uint, Extended_Real
dt_uint_size: Assumption
0 < size(uidt(dt_uint)) And 3 ∗ size(uidt(dt_uint)) <= max_linear_offset

EndAssuming

% proof status:−)
% IMP_Random_Device_TCC1 : TCCObligation
Importing Random_Device[Physical_memory, pm_phy],
Challenge_Device_Memory [Physical_memory, pm_phy, Random_device_state ]
% Side EffectConditions

% −−−−−−−−−−−−−−−−−−−−−−−−
pm : Plain_Memory[Random_device_memory ] = random_device_pm
% proof status:−)
in_blessed_memory_disjoint_device : Lemma
Forall (a : Address, l : nat) :
subset?(address_block(a, l), union(pm‘ro_addr, pm‘rw_addr))

Implies

disjoint?(address_block(a, l), address_block(base, size))
% proof status:−)
in_blessed_memory_not_device_address : Lemma
Forall (a : Address, bl : list[Byte]) :
subset?(address_block(a, length(bl)), union(pm‘ro_addr, pm‘rw_addr)) And cons?(bl)

Implies

a /= rnd_seedAnd a/= mem_cntAnd a /= rnd_val
% proof status:−)
random_side_effects_unchanged_invariant : Lemma
unchanged_memory_invariant ?(pm‘mem, pm‘states, union(
drse_super_transformers (union(pm‘ro_addr, pm‘rw_addr),

rnd_dev_read_side_effect

),

dwse_super_transformers (pm‘rw_addr, rnd_dev_write_side_effect )),
union(pm‘ro_addr, pm‘rw_addr))
% proof status:−)
random_side_effects_transformers_ok : Lemma
transformers_ok?(pm‘states, union(
drse_super_transformers (union(pm‘ro_addr, pm‘rw_addr),

rnd_dev_read_side_effect

),

dwse_super_transformers (pm‘rw_addr, rnd_dev_write_side_effect )))
% proof status:−)
random_side_effects_side_effect_content_unchanged_read : Lemma
side_effect_content_unchanged (union(pm‘ro_addr, pm‘rw_addr), pm‘states,

rnd_dev_read_side_effect

)

% proof status:−)
random_side_effects_side_effect_content_unchanged_write : Lemma
side_effect_content_unchanged (pm‘rw_addr, pm‘states,

rnd_dev_write_side_effect

)

% PlainMemory
% ==============
% proof status:−)
random_device_plain_memory : Lemma
plain_memory?(pm_phy) Implies
plain_memory?(pm)
% Failon UnalignedAccesses
% ============================

% proof status:−)
unaligned_fails_write: Lemma
Forall (s : Random_device_memory , a : Address, bl : (cons?[Byte])) :
Not disjoint?(address_block(a, length(bl)), address_block(base, size)) And
Not (length(bl) = size(uidt(dt_uint)) And (a = rnd_seedOr a = mem_cntOr a = rnd_val)) And
% underlyingwriteside effect is executedfirst; requireit to be ok
OK?(memory_write_side_effect (pm_phy‘mem)(a, bl, false)(s‘state)) And
data(memory_write_side_effect (pm_phy‘mem)(a, bl, false)(s‘state)) = bl

Implies

Fatal?(memory_write_list (pm‘mem)(a, bl)(s))
% proof status:−)
unaligned_fails_read: Lemma
Forall (s : Random_device_memory , a : Address, bl : (cons?[Byte])) :
Not disjoint?(address_block(a, length(bl)), address_block(base, size)) And
Not (length(bl) = size(uidt(dt_uint)) And (a = rnd_seedOr a = mem_cntOr a = rnd_val)) And
% underlyingread list and read side effect is executedfirst; requireit to be ok
OK?(memory_read_list_nse (pm‘mem)(a, length(bl))(s)) And
(Let ures = (memory_read_list_nse (pm‘mem)(a, length(bl)) ##
LAMBDA (bl1: list[Byte]): em_lift[Physical_memory,
Random_device_state [Physical_memory, pm_phy], list[Byte]]
(memory_read_side_effect (pm_phy‘mem)
(a, bl1, false)))(s) In
OK?(ures) And length(data(ures)) = length(bl))

Implies

Fatal?(memory_read_list (pm‘mem)(a, length(bl))(s))
End Challenge_Random_Device

B.27 result.pvs

% $Id: result.pvs,v 1.32.10.2 2008/05/14 14:25:00 tews Exp$

%

% Author: HendrikTews
% Author: MarcusVoelp
% Author: TjarkWeber, (c) 2007 RadboudUniversity

%

% Resulttypesfor C++ expressionsand statements.
% TODO: The Pagefault/Exceptionrelateddefinitionsneed cleanupwhen it is
% clear what exactlywe want to model (and at whichlevel). Perhaps
% theycould be movedto a differentfile also.

Memory_access: DATATYPE

BEGIN

Read : Read?
Write : Write?
Execute : Execute?
END Memory_access

B.27 result.pvs

% Thisdifferesfrom CPUprivilegelevelsin that there are onlytwo.
% We assume that CPL1 and CPL2 are neverever used.
Memory_privilege: DATATYPE

BEGIN

Supervisor : Supervisor?
User : User?
END Memory_privilege

Memory_access_util: Theory
% utilityfunctionfor Memory_access

Begin

Importing Memory_access
RX_Memory_access: Type = {p : pred[Memory_access] | subset?(add(Execute, singleton(Read)), p)}
R_Memory_access: Type = {p : pred[Memory_access] | member(Read, p)}
memory_access_to_bools (ar : PRED[Memory_access]) : [bool, bool] =
(member(Write, ar), member(Execute, ar))
bools_to_memory_access (write : bool, fetch : bool) : PRED[Memory_access] =
If write Then
If fetch Then
add(Execute, add(Write, singleton(Read)))

Else

add(Write, singleton(Read))

Endif Else

If fetch Then
add(Execute, singleton(Read))

Else

singleton(Read)

Endif Endif

End Memory_access_util

Memory_privilege_util: Theory
% utilityfunctionsfor Memory_privilege

Begin

Importing Memory_privilege
memory_privilege_to_bool (ar : Memory_privilege) : bool =
Cases ar of
Supervisor : false,
User : true

EndCases

bool_to_memory_privilege (b : bool) : Memory_privilege=
IF b Then User Else Supervisor Endif

% proof status:−)
bool_to_memory_privilege_iso : Lemma Forall(ar : Memory_privilege) :
bool_to_memory_privilege (memory_privilege_to_bool (ar)) = ar
End Memory_privilege_util

Error_Code_Types: Theory

Begin

Importing Memory_privilege, Memory_access_util
PF_error_code_type : Type = [#
reserved_bit_violation: bool, % page fault not modeled
privilege : Memory_privilege,
access : R_Memory_access ,
present : bool

#]

End Error_Code_Types

Exception_type: Datatype

Begin

Importing Error_Code_Types
% Exceptionswhichmay possiblyoccur in the kerneland whichare
% smoothlyhandled. If a not listedexceptionsoccurs in kernelcode
% this is a fatal error. The followinglists when these exceptions
% occur withinthe kernel:
% − the kernelcopies from / to user memory
% − sync withmasterpage tables
Page_fault(ec : PF_error_code_type ) : Page_fault?
% − lazysegment loads
General_protection: General_protection? %
End Exception_type

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% ExprResult: the resulttypefor C++ expressions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ExprResult[State, Data : Type] : DATATYPE

BEGIN

% % IMPORTINGPagefault_Flag
IMPORTING Exception_type

% resultOK withsuccessor state and resultdata
OK(state: State, data: Data) : OK?
% not (yet) deliveredexceptionor interrupt
% Before the exceptionhandlercan be invokedthe exceptionmust be
% delivered. At deliverythe IDTis traversedand the conditionsfor
% doublefaultsneed to be checked and the stack frame must be
% constructed.
Exception(
ex_type: Exception_type,
state : State % state duringwhichexceptionoccured
) : Exception?
% % % not (yet) handledpage fault
% % Page_fault(
% % pfa : Address,
% % page_fault_flags: Pagefault_flag) : Page_fault?
% %
% % % TLBinconsistentwithcurrentpage directory
% % TLB_fault: TLB_fault?
% %
% % % generalprotectionfault (in case somebodywantsto handlethose)
% % % XXXshouldall exceptionsget a result?
% % GP_fault: GP_fault?
% %
% % % returnfrom interrupt
% % % Attention: this resultmust be caught immediately. It must not
% % % be passed throughother state transformers!
% % Iret(next_state: State) : Iret?
% %
% worst case crash (undefinedbehavior)
Fatal : Fatal?
% a non−terminatingprogramstatementhas been encountered
Hang : Hang?
END ExprResult

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% StmtResult: the resulttypefor C++ statements

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
StmtResult[State : Type] : DATATYPE

BEGIN

Importing Exception_type
% resultOK withsuccessor state

% Note that this, unlikethe "ExprResult.OK"constructor, does not have a
% "data"argument. (If it had, we wouldhave to inventa term of type"Data"
% at some places in the C++ program, e.g. at the beginningof a function, or
% after catchinga break/continue.)
OK(state : State) : OK?
% "break"has been executed
Break(state : State) : Break?
% "continue"has been executed
Continue(state : State) : Continue?
% "return"has been executed
% We model returnexpras expr## lambda(res : Data) : write(ret_addr, data)
% where ret_addrcan be an unusedregion of the stack frame suitable
% to hold the returnedtypeor a registerof suitablesize.
% Thismodel includesreturningclasses by allocatingthem in a
% callerallocatedmemoryand returningintegraltypesin the eax registeras
% specifiedin the UnixSystemV ABIfor Intel386Processors.
Return(state : State) : Return?
% "goto label"has been executed
% The formalizationof goto statements, althoughpossible, wouldintroduce
% two complications:
% 1. C++ allowsgotos into nested substatements. Thuseverystatement
% potentiallycatches a Gotoresult.
% 2. Since backwardsjumpsmay lead to non−termination, gotos need to be
% treatedsimilarto loops.
% Goto(state : State, label: string) : Goto?
% "switch(case)"has been executed, and we’re lookingfor a matching
% "case"
% Note that "case"cannot have type"Data",as that typeis alreadyreserved
% for the resultof the functionin whichthe switchstatementoccurs. Thus
% we’re using the fixedtype"int".Alternatively , StmtResultcould take
% anothertypeargument"SwitchData: Type".
Switch(state : State, case : int) : Switch?
% a switchstamementhas been executed, and we alreadyknow that there is no
% matching"case"(hence the "default"must be taken if there is one)
Default(state : State) : Default?
% Not (yet) deliveredexceptionor interrupt, see also ExprResult.
Exception(
ex_type: Exception_type,
state : State % state duringwhichexceptionoccured
) : Exception?
% worst case crash (undefinedbehavior)
Fatal : Fatal?
% a non−terminatingprogramstatementhas been encountered

Hang : Hang?
END StmtResult

% The followingis a reducedsupertypeof ExprResultand StmtResult.
% Transformerinvariantsand other generalstuff, eg transformer_ok?,
% are formulatedwithSuperResult. Expressiontransformersand statement
% transformerscan be cast into a supertransformerin the obviousway:

%

% OK −> OK
% abnormalitieswithsuccessor state −> Abnormal
% everythingelse −> Bottom

%

% See Super_Embeddingbelow.
SuperResult[State : Type] : DATATYPE

Begin

OK(state : State) : OK?
Abnormal(state : State) : abnormal?
Bottom : bottom?
End SuperResult

Super_Result_Util [State : Type] : Theory

Begin

Importing SuperResult
has_next_state (res : SuperResult[State]) : bool =
Cases res OF
OK(state) : true,
Abnormal(state) : true,
Bottom : false

EndCases

End Super_Result_Util

Super_Embedding_Expr [State, Data : Type] : Theory

Begin

Importing ExprResult, Super_Result_Util
has_next_state (expr : ExprResult[State, Data]) : bool =
Cases expr OF
OK(state, date) : true,
Exception(ex_type, state) : true,
Fatal : false,
Hang : false

EndCases

% proof status:−)
% expr_2_super_res_TCC1 : TCCObligation

% proof status:−)
% expr_2_super_res_TCC2 : TCCObligation
expr_2_super_res (expr : ExprResult[State, Data]) : SuperResult[State] =
IF OK?(expr) Then OK(state(expr))
Elsif has_next_state (expr) Then Abnormal(state(expr))
Else Bottom

Endif

End Super_Embedding_Expr
Super_Embedding_Stmt [State : Type] : Theory

Begin

Importing StmtResult, Super_Result_Util
has_next_state (stmt : StmtResult[State]) : bool =
Cases stmt OF
OK(state) : true,
Break(state) : true,
Continue(state) : true,
Return(state) : true,
Switch(state, case) : true,
Default(state) : true,
Exception(ex_type, state) : true,
Fatal : false,
Hang : false

EndCases

% proof status:−)
% stmt_2_super_res_TCC1 : TCCObligation
% proof status:−)
% stmt_2_super_res_TCC2 : TCCObligation
stmt_2_super_res (stmt : StmtResult[State]) : SuperResult[State] =
IF OK?(stmt) Then OK(state(stmt))
Elsif has_next_state (stmt) Then Abnormal(state(stmt))
Else Bottom

Endif

End Super_Embedding_Stmt
Super_Embedding: Theory

Begin

Importing Super_Embedding_Stmt , Super_Embedding_Expr
End Super_Embedding

B.28 search-example.pvs

% Additional_Rewrites [State, Data : Type] : Theory

B.28 search-example.pvs

% Begin
% address_of_q
% check_bounds_q
% same_array_left_q
% same_array_right_q
% not_null_q
% EndAdditional_Rewrites
Search_Example[State : Type] : Theory

Begin

IMPORTING Cpp_Verification[State]
% Variableand ConstantDefinition
% ==================================
first : Address % pointerto firstarrayelement
last : Address % pointerto last arrayelement
current : Address % pointerto currentarrayelement
N : posnat = 2 % arraysize
% proof status:−)
% value_TCC1: TCCObligation
value : (range(uint)) % valueto search for
% Preconditions
% ===============
% proof status:−)
% Search_Pre_TCC1: TCCObligation
% proof status:−)
% Search_Pre_TCC2: TCCObligation
% proof status:−)
% Search_Pre_TCC3: TCCObligation
% proof status:−)
% Search_Pre_TCC4: TCCObligation
% proof status:−)
% Search_Pre_TCC5: TCCObligation
% proof status:−)
% Search_Pre_TCC6: TCCObligation
% proof status:−)

% Search_Pre_TCC7: TCCObligation
% proof status:−)
% Search_Pre_TCC8: TCCObligation
% proof status:−)
% Search_Pre_TCC9: TCCObligation
Search_Pre: PRED[State] =
Lambda (s : State) :
plain_memory?(pm) And
pm‘states(s) And
% Parameters
% 1. firstand last are allocatedin blessedmemory
in_blessed_memory ?(dt_cv_pointer (pointer(uint)), first,
union(pm‘ro_addr, pm‘rw_addr)) And
in_blessed_memory ?(dt_cv_pointer (pointer(uint)), last,
union(pm‘ro_addr, pm‘rw_addr)) And
% 2. the memorylocationsat firstand last store validpointervalues
valid_in_mem (pm, dt_cv_pointer (pointer(uint)))(first)(s) And
valid_in_mem (pm, dt_cv_pointer (pointer(uint)))(last)(s) And
% LocalVariables
% 3. currentis allocatedin blessedwritablememory
in_blessed_memory ?(dt_cv_pointer (pointer(uint)),
current, pm‘rw_addr) And
% 4. currentis disjointfrom first
blocks_disjoint?(first, size_of(pointer(uint)),
current, size_of(pointer(uint))) And
blocks_disjoint?(current, size_of(pointer(uint)),
first, size_of(pointer(uint))) And
% 5. currentis disjointfrom last
blocks_disjoint?(last, size_of(pointer(uint)),
current, size_of(pointer(uint))) And
blocks_disjoint?(current, size_of(pointer(uint)),
last, size_of(pointer(uint))) And
% Assertions
Let first_value=
data(read_data(pm, dt_cv_pointer (pointer(uint)))(first)(s)),
last_value=
data(read_data(pm, dt_cv_pointer (pointer(uint)))(last)(s)) In
% 6. firstand last are non null
not_null?(pointer(uint))(first_value) And
not_null?(pointer(uint))(last_value) And
% Array
% 7. arrayelementsare in blessedmemory
(Forall (i : below[N]) :
in_blessed_memory ?[(range(uint))](dt(uint),
down(address_of(pointer(uint))
(add(pointer(uint))(first_value, i ∗ size_of(uint)))),
union(pm‘ro_addr, pm‘rw_addr))) And
% 8. arrayelementsare disjointfrom current
(Forall (i : below[N]) :

B.28 search-example.pvs

blocks_disjoint

?(

down(address_of(pointer(uint))
(add(pointer(uint))(first_value, i ∗ size_of(uint)))),
size_of(uint),
current,
size_of(pointer(uint)))) And
(Forall (i : below[N]) :

blocks_disjoint

?(

current, size_of(pointer(uint)),
down(address_of(pointer(uint))
(add(pointer(uint))(first_value, i ∗ size_of(uint)))),
size_of(uint))) And
% 9. arrayelementscontainvalidintegers
(Forall (i : below[N]) :
valid_in_mem (pm, dt(uint))
(down(address_of(pointer(uint))
(add(pointer(uint))(first_value, i ∗ size_of(uint)))))(s))

And

% 10. arraybounds
data(read_data(pm, dt_cv_pointer (pointer(uint)))(last)(s)) =
add(pointer(uint))(first_value, N ∗ size_of(uint)) And
% 11. same array
same_array(pointer(uint))(first_value, last_value) And
(Forall (i : below[N]) :
same_array(pointer(uint))(first_value,
add(pointer(uint))(first_value, i ∗ size_of(uint))))
% /∗∗
% ∗ search the arrayelementwhose valueis val
% ∗
% ∗ @param val the valueto search for
% ∗ @param firstpointerto the firstelementof the array(from which
% ∗ to startthe search)
% ∗ @param last pointerbeyondthe last elementof the array
% ∗ @return pointerto the firstoccurrenceof val after (including) first
% ∗/
% uint∗ search(uintval, uint∗ first, uint∗ last) {
% assert(first);
% assert(last);
% 1) uint∗ current= first;
% 2) while(current< last) {
% 3) if (∗current== val)
% 4) break;
% 5) ++ current;
% }
% proof status:−)
% search_TCC1: TCCObligation

% proof status:−)
% search_TCC2: TCCObligation
% proof status:−)
% search_TCC3: TCCObligation
% proof status:−)
% search_TCC4: TCCObligation
search : ST[State] =
% 1)
e2s[State, Address]
(assign(pm, dt_cv_pointer (pointer(uint)))
(id(current),
l2r(pm, dt_cv_pointer (pointer(uint)))(id(first)))) ##
% 2)
while(N + 1,
lt_ptr(pointer(uint))
(l2r(pm, dt_cv_pointer (pointer(uint)))(id(current)),
l2r(pm, dt_cv_pointer (pointer(uint)))(id(last))),
% 3)

if_else(

eq(l2r(pm, dt(uint))(deref(pm, pointer(uint))
(l2r(pm, dt_cv_pointer (pointer(uint)))(id(current)))),
literal(value)),
% 4)
break,
skip) ##
% 5)
e2s[State, Address](preinc_ptr(pm, pointer(uint))(id(current))))
% Postconditions:
% =================
% read firstafter search
read_first: PRED[State] =
Lambda (s : State) :
OK?(read_data(pm, dt_cv_pointer (pointer(uint)))(first)(s))
% read currentafter search
read_current: PRED[State] =
Lambda (s : State) :
OK?(read_data(pm, dt_cv_pointer (pointer(uint)))(current)(s)) And
not_null?(pointer(uint))(data(read_data(pm, dt_cv_pointer (pointer(uint)))(current)(s)))
% proof status:−)
% deref_current_TCC1: TCCObligation
% proof status:−)
% deref_current_TCC2: TCCObligation
% read currentafter search

deref_current: PRED[State] =
Lambda (s : State) :
read_current(s) And
Let current_value=
data(read_data(pm, dt_cv_pointer (pointer(uint)))(current)(s)) In
not_null?(pointer(uint))(current_value) And
OK?(read_data(pm, dt(uint))
(down(address_of(pointer(uint))(current_value)))(s))
% read last after search
read_last: PRED[State] =
Lambda (s : State) :
OK?(read_data(pm, dt_cv_pointer (pointer(uint)))(last)(s))
% proof status:−)
% read_array_TCC1: TCCObligation
% proof status:−)
% read_array_TCC2: TCCObligation
% proof status:−)
% read_array_TCC3: TCCObligation
% read arrayafter search
read_array: PRED[State] =
Lambda (s : State) :
read_first(s) And
Let first_value=
data(read_data(pm, dt_cv_pointer (pointer(uint)))(first)(s)) In
not_null?(pointer(uint))(first_value)

And

Forall (i : below[N]) :
OK?(read_data(pm, dt(uint))
(down(address_of(pointer(uint))
(add(pointer(uint))(first_value, i ∗ size_of(uint)))))(s))
% proof status:−)
% not_found_TCC1: TCCObligation
% proof status:−)
% not_found_TCC2: TCCObligation
% proof status:−)
% not_found_TCC3: TCCObligation
% proof status:−)
% not_found_TCC4: TCCObligation
% not found:
% the valuecould not be found in the array; current= last
not_found: PRED[State] =
Lambda (s : State) :

read_first(s) And
read_current(s) And
read_last(s) And
read_array(s) And
(Let first_value=
data(read_data(pm, dt_cv_pointer (pointer(uint)))(first)(s)) In
Forall (i : below[N]) :
(data(read_data(pm, dt(uint))
(down(address_of(pointer(uint))(add(pointer(uint))
(first_value, i ∗ size_of(uint)))))(s)) /= value))

Implies

data(read_data(pm, dt_cv_pointer (pointer(uint)))(last)(s)) =
data(read_data(pm, dt_cv_pointer (pointer(uint)))(current)(s))
% proof status:−)
% found_TCC1: TCCObligation
% proof status:−)
% found_TCC2: TCCObligation
% proof status:−)
% found_TCC3: TCCObligation
found : PRED[State] =
Lambda (s : State) :
(read_first(s) And
read_current(s) And
read_last(s) And
read_array(s) And
deref_current(s) And
data(read_data(pm, dt_cv_pointer (pointer(uint)))
(last)(s)) /=
data(read_data(pm, dt_cv_pointer (pointer(uint)))(current)(s)))

Implies

data(read_data(pm, dt(uint))
(down(address_of(pointer(uint))(
data(read_data(pm, dt_cv_pointer (pointer(uint)))(current)(s)))))(s))
= value
% Lemmas
% ========
% proof status:−)
% uchar_range_values_TCC1 : TCCObligation
% proof status:−)
uchar_range_values: Lemma
Forall (n : nat) : n <= 255 Implies range(uchar)(n)
% proof status:−)
search_terminates: Lemma

Valid(

Search_Pre,

search,
Lambda (s : State) : true)
% proof status:−)
search_read_first: Lemma
valid(

Search_Pre,

search,

read_first)

% proof status:−)
search_read_current: Lemma
valid(

Search_Pre,

search,

read_current

)

% proof status:−)
search_deref_current: Lemma
valid(

Search_Pre,

search,

deref_current

)

% proof status:−)
search_read_last: Lemma
valid(

Search_Pre,

search,

read_last)

% proof status:−)
search_read_array: Lemma
valid(

Search_Pre,

search,

read_array)

% proof status:−)
search_not_found: Lemma
valid(

Search_Pre,

search,

not_found)

% proof status:−)
search_found: Lemma
valid(

Search_Pre,

search,

found)

End Search_Example

B.29 statement-rewrites.pvs

% $Id: statement−rewrites.pvs,v 1.10.4.1.4.2 2008/05/14 14:25:00 tews Exp$

%

% Author: MarcusVölp

%

% Rewritingrulesfor C++ statements. See statements.pvs for the statement
% formalization.

%

% The statementrewritingrulessimplifycode by symbolic
% simlificationof the controlflow constructs. Forexamplea breakwill
% removeall followingstatementsuntilit reaches a catch breakin
% whichcase break## catch_breakis eleminatedfrom the code.
% Statementsare simplifiedrightto left. Here one expression
% transformerrespectivelyone lexprtransformer(StmtResult−>
% ExprResult) is allowedto occur after the simplificationpoint. The
% forwardrulessimplifythese two cases plus those cases witha leading
% statementautomaticallywiththe help of the respectiverulesfor the
% standalonecase. Because of the requirementon rewritingrulesthese
% lemmashave to be definedfor any form a standalonesimplifcationmay
% assume. The forms are denotedby the s−c−> s, ... sequence whichstands
% for statement1## complexstatementsimplifiesto statement1.
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Single_Statement_Rewrites0 [State : Type] : THEORY

BEGIN

Importing Statements
stmt : VAR [State −> StmtResult[State]]
stmt1 : VAR [State −> StmtResult[State]]
stmt2 : VAR [State −> StmtResult[State]]
stmt3 : VAR [State −> StmtResult[State]]
cstmt : VAR [StmtResult[State] −> StmtResult[State]]
cstmt1 : VAR [StmtResult[State] −> StmtResult[State]]
fcstmt : VAR [[State −> StmtResult[State]] −>
[StmtResult[State] −> StmtResult[State]]]
s : VAR State
n : VAR int
% Switch/ Default/ Continue/ Returnelemination
% ==================================================
% Break

B.29 statement-rewrites.pvs

% −−−−−−−
% proof status:−)
break_catch_break: Lemma
OK?(stmt(s)) Implies
(stmt ## break ## catch_break)(s) = stmt(s)
% proof status:−)
break_break_stmt: Lemma
Break?(stmt(s)) Implies
(stmt ## stmt1 ## catch_break)(s) = (stmt ## catch_break)(s)
% proof status:−)
break_break_catch_continue : Lemma
Break?(stmt(s)) Implies
(stmt ## catch_continue## catch_break)(s) = (stmt ## catch_break)(s)
% proof status:−)
break_break_catch_default : Lemma
Break?(stmt(s)) Implies
(stmt ## catch_default## catch_break)(s) = (stmt ## catch_break)(s)
% proof status:−)
break_break_lift_stmt : Lemma
Break?(stmt(s)) Implies
(stmt ## lift(stmt1) ## catch_break)(s) = (stmt ## catch_break)(s)
% proof status:−)
break_break_case: Lemma
Break?(stmt(s)) Implies
(stmt ## case(n) ## catch_break)(s) = (stmt ## catch_break)(s)
% proof status:−)
break_break_default: Lemma
Break?(stmt(s)) Implies
(stmt ## default ## catch_break)(s) = (stmt ## catch_break)(s)
% proof status:−)
break_break: Lemma
Break?(break(s))
% proof status:−)
stmt_break_break: Lemma
OK?(stmt(s)) Implies
Break?((stmt ## break)(s))
% proof status:−)
break_stmt_break: Lemma
Break?(stmt(s)) Implies
Break?((stmt ## stmt1)(s))
% proof status:−)

break_stmt_catch_continue : Lemma
Break?(stmt(s)) Implies
Break?((stmt ## catch_continue)(s))
% proof status:−)
break_stmt_catch_default : Lemma
Break?(stmt(s)) Implies
Break?((stmt ## catch_default)(s))
% proof status:−)
break_stmt_lift: Lemma
Break?(stmt(s)) Implies
Break?((stmt ## lift(stmt1))(s))
% proof status:−)
break_stmt_case: Lemma
Break?(stmt(s)) Implies
Break?((stmt ## case(n))(s))
% proof status:−)
break_stmt_default: Lemma
Break?(stmt(s)) Implies
Break?((stmt ## default)(s))
% Continue
% −−−−−−−−−−
% proof status:−)
continue_catch_continue: Lemma
OK?(stmt(s)) Implies
(stmt ## continue ## catch_continue)(s) = stmt(s)
% proof status:−)
continue_break_stmt: Lemma
Continue?(stmt(s)) Implies
(stmt ## stmt1 ## catch_continue)(s) = (stmt ## catch_continue)(s)
% proof status:−)
continue_break_catch_continue : Lemma
Continue?(stmt(s)) Implies
(stmt ## catch_break## catch_continue)(s) = (stmt ## catch_continue)(s)
% proof status:−)
continue_break_catch_default : Lemma
Continue?(stmt(s)) Implies
(stmt ## catch_default## catch_continue)(s) = (stmt ## catch_continue)(s)
% proof status:−)
continue_break_lift_stmt : Lemma
Continue?(stmt(s)) Implies
(stmt ## lift(stmt1) ## catch_continue)(s) = (stmt ## catch_continue)(s)
% proof status:−)

continue_break_case: Lemma
Continue?(stmt(s)) Implies
(stmt ## case(n) ## catch_continue)(s) = (stmt ## catch_continue)(s)
% proof status:−)
continue_break_default: Lemma
Continue?(stmt(s)) Implies
(stmt ## default ## catch_continue)(s) = (stmt ## catch_continue)(s)
% proof status:−)
continue_continue: Lemma
Continue?(continue(s))
% proof status:−)
stmt_continue_continue: Lemma
OK?(stmt(s)) Implies
Continue?((stmt ## continue)(s))
% proof status:−)
continue_stmt_continue: Lemma
Continue?(stmt(s)) Implies
Continue?((stmt ## stmt1)(s))
% proof status:−)
continue_stmt_catch_break : Lemma
Continue?(stmt(s)) Implies
Continue?((stmt ## catch_break)(s))
% proof status:−)
continue_stmt_catch_default : Lemma
Continue?(stmt(s)) Implies
Continue?((stmt ## catch_default)(s))
% proof status:−)
continue_stmt_lift: Lemma
Continue?(stmt(s)) Implies
Continue?((stmt ## lift(stmt1))(s))
% proof status:−)
continue_stmt_case: Lemma
Continue?(stmt(s)) Implies
Continue?((stmt ## case(n))(s))
% proof status:−)
continue_stmt_default: Lemma
Continue?(stmt(s)) Implies
Continue?((stmt ## default)(s))
% switch/ defaultare free−standing; use fwd rewriting
% ========================================================
% switch

% −−−−−−−−
% proof status:−)
switch_stmt: Lemma
switch_result(n) ## stmt = switch_result(n)
% proof status:−)
stmt_switch_stmt: Lemma
stmt ## switch_result(n) ## stmt1 = stmt ## switch_result(n)
% proof status:−)
switch_case_taken: Lemma
(switch_result[State](n) ## case(n)) = skip
% proof status:−)
stmt_switch_case_taken : Lemma
OK?(stmt(s)) Implies
(stmt ## switch_result(n) ## case(n))(s) = stmt(s)
% proof status:−)
switch_case_not_taken : Lemma
Forall (n1, n2 : int) : n1 /= n2 Implies
switch_result[State](n1) ## case(n2) = switch_result(n1)
% proof status:−)
stmt_switch_case_not_taken : Lemma
Forall (n1, n2 : int) : OK?(stmt(s)) And n1 /= n2 Implies
(stmt ## switch_result(n1) ## case(n2))(s) = (stmt ## switch_result(n1))(s)
% proof status:−)
switch_default: Lemma
switch_result[State](n) ## default = switch_result(n)
% proof status:−)
stmt_switch_default: Lemma
OK?(stmt(s)) Implies
(stmt ## switch_result(n) ## default)(s) = (stmt ## switch_result(n))(s)
% proof status:−)
switch_catch_break: Lemma
switch_result[State](n) ## catch_break= switch_result(n)
% proof status:−)
stmt_switch_catch_break : Lemma
OK?(stmt(s)) Implies
(stmt ## switch_result(n) ## catch_break)(s) = (stmt ## switch_result(n))(s)
% proof status:−)
switch_catch_continue: Lemma
switch_result[State](n) ## catch_continue= switch_result(n)
% proof status:−)
stmt_switch_catch_continue : Lemma

OK?(stmt(s)) Implies
(stmt ## switch_result(n) ## catch_continue)(s) = (stmt ## switch_result(n))(s)
% proof status:−)
switch_catch_default: Lemma
switch_result[State](n) ## catch_default= switch_result(n)
% proof status:−)
stmt_switch_catch_default : Lemma
OK?(stmt(s)) Implies
(stmt ## switch_result(n) ## catch_default)(s) = (stmt ## switch_result(n))(s)
% default
% −−−−−−−−−
% proof status:−)
default_stmt: Lemma
default_result## stmt = default_result
% proof status:−)
stmt_default_stmt: Lemma
stmt ## default_result## stmt1 = stmt ## default_result
% proof status:−)
default_case: Lemma
default_result[State] ## case(n) = default_result
% proof status:−)
stmt_default_case: Lemma
OK?(stmt(s)) Implies
(stmt ## default_result## case(n))(s) = (stmt ## default_result)(s)
% proof status:−)
default_default: Lemma
default_result[State] ## default = skip
% proof status:−)
stmt_default_default: Lemma
OK?(stmt(s)) Implies
(stmt ## default_result## default)(s) = stmt(s)
% proof status:−)
default_catch_break: Lemma
default_result[State] ## catch_break= default_result
% proof status:−)
stmt_default_catch_break : Lemma
OK?(stmt(s)) Implies
(stmt ## default_result## catch_break)(s) = (stmt ## default_result)(s)
% proof status:−)
default_catch_continue: Lemma
default_result[State] ## catch_continue= default_result

% proof status:−)
stmt_default_catch_continue : Lemma
OK?(stmt(s)) Implies
(stmt ## default_result## catch_continue)(s) = (stmt ## default_result)(s)
% proof status:−)
default_catch_default: Lemma
default_result[State] ## catch_default= skip
% proof status:−)
stmt_default_catch_default : Lemma
OK?(stmt(s)) Implies
(stmt ## default_result## catch_default)(s) = stmt(s)
% Returnrewrites
% =================
% proof status:−)
return_void_result: Lemma
return_void[State] = return_result

% Skip Elemination
% ==================
% proof status:−)
skip_ok: Lemma
OK?(skip(s))
% proof status:−)
% skip_state_TCC1: TCCObligation
% proof status:−)
skip_state: Lemma
state(skip(s)) = s
% proof status:−)
skip_elemination: Lemma
(stmt ## skip) = stmt
% proof status:−)
stmt_skip_elemination: Lemma
(skip ## stmt) = stmt
% Stmt Ok Elemination
% =====================
% proof status:−)
stmt_remove_catch_default : Lemma
OK?(stmt(s)) Implies
(stmt ## catch_default)(s) = stmt(s)

% proof status:−)
stmt_remove_case: Lemma
OK?(stmt1(s)) Implies
(stmt1 ## case(n))(s) = stmt1(s)
% proof status:−)
stmt_remove_default: Lemma
OK?(stmt1(s)) Implies
(stmt1 ## default)(s) = stmt1(s)
% proof status:−)
stmt_remove_catch_continue : Lemma
OK?(stmt(s)) Implies
(stmt ## catch_continue)(s) = stmt(s)
% proof status:−)
stmt_remove_catch_break : Lemma
OK?(stmt(s)) Implies
(stmt ## catch_break)(s) = stmt(s)
% proof status:−)
stmt_ok_lift: Lemma
OK?(stmt1(s)) Implies
(stmt1 ## lift(stmt2))(s) = (stmt1 ## stmt2)(s)
% While
% =======
b_ex: VAR [State −> ExprResult[State, bool]]
max : Var nat
% proof status:−)
% while_unroll_TCC1: TCCObligation
% proof status:−)
while_unroll: Lemma
max > 0 Implies
while(max, b_ex, stmt)(s) =
if_else(b_ex, stmt ## catch_continue##
while(max − 1, b_ex, stmt) ## catch_break, skip)(s)
% proof status:−)
stmt_while_unroll: Lemma
max > 0 Implies
(stmt1 ## while(max, b_ex, stmt2))(s) =
(stmt1 ## if_else(b_ex, stmt2 ## catch_continue##
while(max − 1, b_ex, stmt2) ## catch_break, skip))(s)
% Conditionuniversallytrue in all states implieshang of while
% proof status:−)
iterate_while_ok: Lemma

Forall (n : nat) :
(Forall (s : State) : OK?((e2s(b_ex) ## stmt)(s)))

Implies

OK?(iterate_while(n, b_ex, stmt)(s))
% proof status:−)
while_hang: Lemma
(Forall (s : State) :
OK?(b_ex(s)) And data(b_ex(s)) And
OK?((e2s(b_ex) ## stmt)(s)))

Implies

while(b_ex, stmt) = hang_result
% Composition
% =============
% proof status:−)
composition_assoc_rewrite_stmt_ok : Lemma
OK?(stmt(s)) Implies
(stmt ## (stmt1 ## cstmt))(s) = ((stmt ## stmt1) ## cstmt)(s)
% proof status:−)
composition_assoc_rewrite_stmt_ok_cstmt : Lemma
OK?(stmt(s)) Implies
((stmt ## (stmt1 ## cstmt)) ## cstmt1)(s) = (((stmt ## stmt1) ## cstmt) ## cstmt1)(s)

END Single_Statement_Rewrites0
Single_Statement_Rewrites1 [State, Data : Type] : THEORY

BEGIN

Importing Single_Statement_Rewrites0 , Plain_Mem_Rewrites
stmt : VAR [State −> StmtResult[State]]
stmt1 : VAR [State −> StmtResult[State]]
stmt2 : VAR [State −> StmtResult[State]]
stmt3 : VAR [State −> StmtResult[State]]
cstmt : VAR [StmtResult[State] −> StmtResult[State]]
cstmt1 : VAR [StmtResult[State] −> StmtResult[State]]
fcstmt : VAR [[State −> StmtResult[State]] −>
[StmtResult[State] −> StmtResult[State]]]
fstmt : VAR [Data −> [State −> StmtResult[State]]]
expr : VAR [State −> ExprResult[State, Data]]
lexpr : VAR [StmtResult[State] −> ExprResult[State, Data]]
data : VAR Data
s : VAR State
n : VAR int
% Stmt Ok EleminationExprForms

% ===============================
% proof status:−)
forward_s_c_s_of_s_expr : Lemma
(stmt ## cstmt)(s) = stmt(s) Implies
(stmt ## cstmt ## expr)(s) = (stmt ## expr)(s)
% proof status:−)
stmt_ok_lift_expr : Lemma
OK?(stmt1(s)) Implies
(stmt1 ## lift(stmt2) ## expr)(s) = (stmt1 ## stmt2 ## expr)(s)
% proof status:−)
break_break_stmt_expr : Lemma
Break?(stmt(s)) Implies
(stmt ## stmt1 ## catch_break## expr)(s) = (stmt ## catch_break## expr)(s)
% proof status:−)
break_break_catch_continue_expr : Lemma
Break?(stmt(s)) Implies
(stmt ## catch_continue## catch_break## expr)(s) = (stmt ## catch_break## expr)(s)
% proof status:−)
break_break_catch_default_expr : Lemma
Break?(stmt(s)) Implies
(stmt ## catch_default## catch_break## expr)(s) = (stmt ## catch_break## expr)(s)
% proof status:−)
break_break_lift_stmt_expr : Lemma
Break?(stmt(s)) Implies
(stmt ## lift(stmt1) ## catch_break## expr)(s) = (stmt ## catch_break## expr)(s)
% proof status:−)
break_break_case_expr : Lemma
Break?(stmt(s)) Implies
(stmt ## case(n) ## catch_break## expr)(s) = (stmt ## catch_break## expr)(s)
% proof status:−)
break_break_default_expr : Lemma
Break?(stmt(s)) Implies
(stmt ## default ## catch_break## expr)(s) = (stmt ## catch_break## expr)(s)
% proof status:−)
continue_break_stmt_expr : Lemma
Continue?(stmt(s)) Implies
(stmt ## stmt1 ## catch_break## expr)(s) = (stmt ## catch_break## expr)(s)
% proof status:−)
continue_break_catch_continue_expr : Lemma
Continue?(stmt(s)) Implies
(stmt ## catch_break## catch_continue## expr)(s) = (stmt ## catch_continue## expr)(s)
% proof status:−)

continue_break_catch_default_expr : Lemma
Continue?(stmt(s)) Implies
(stmt ## catch_default## catch_continue## expr)(s) = (stmt ## catch_continue## expr)(s)
% proof status:−)
continue_break_lift_stmt_expr : Lemma
Continue?(stmt(s)) Implies
(stmt ## lift(stmt1) ## catch_continue## expr)(s) = (stmt ## catch_continue## expr)(s)
% proof status:−)
continue_break_case_expr : Lemma
Continue?(stmt(s)) Implies
(stmt ## case(n) ## catch_continue## expr)(s) = (stmt ## catch_continue## expr)(s)
% proof status:−)
continue_break_default_expr : Lemma
Continue?(stmt(s)) Implies
(stmt ## default ## catch_continue## expr)(s) = (stmt ## catch_continue## expr)(s)
% While
% =======
b_ex: VAR [State −> ExprResult[State, bool]]
max : Var nat
% proof status:−)
% while_unroll_expr_TCC1 : TCCObligation
% proof status:−)
while_unroll_expr: Lemma
max > 0 Implies
(while(max, b_ex, stmt) ## expr)(s) =
(if_else(b_ex, stmt ## catch_continue##
while(max − 1, b_ex, stmt) ## catch_break, skip) ## expr)(s)
% proof status:−)
while_unroll_lexpr: Lemma
max > 0 Implies
(while(max, b_ex, stmt) ## lexpr)(s) =
(if_else(b_ex, stmt ## catch_continue##
while(max − 1, b_ex, stmt) ## catch_break, skip) ## lexpr)(s)
% proof status:−)
stmt_while_unroll_expr : Lemma
max > 0 Implies
(stmt1 ## while(max, b_ex, stmt2) ## expr)(s) =
(stmt1 ## if_else(b_ex, stmt2 ## catch_continue##
while(max − 1, b_ex, stmt2) ## catch_break, skip) ## expr)(s)
% proof status:−)
stmt_while_unroll_lexpr : Lemma
max > 0 Implies

(stmt1 ## while(max, b_ex, stmt2) ## lexpr)(s) =
(stmt1 ## if_else(b_ex, stmt2 ## catch_continue##
while(max − 1, b_ex, stmt2) ## catch_break, skip) ## lexpr)(s)
% E2s−FinalRewrite
% ===================
% proof status:−)
e2s_ok: Lemma
OK?(expr(s)) Implies
OK?(e2s(expr)(s))
% proof status:−)
stmt_e2s_ok: Lemma
OK?((stmt ## expr)(s)) Implies
OK?((stmt ## e2s(expr))(s))
% proof status:−)
% e2s_state_TCC1: TCCObligation
% proof status:−)
% e2s_state_TCC2: TCCObligation
% proof status:−)
e2s_state: Lemma
OK?(expr(s)) Implies
state(e2s(expr)(s)) = state(expr(s))
% proof status:−)
% stmt_e2s_state_TCC1: TCCObligation
% proof status:−)
% stmt_e2s_state_TCC2: TCCObligation
% proof status:−)
stmt_e2s_state: Lemma
OK?((stmt ## expr)(s)) Implies
state((stmt ## e2s(expr))(s)) = state((stmt ## expr)(s))
% Fexpr/ FstmtRewrite
% =======================
% proof status:−)
comp_eval_if_ok_fstmt : Lemma
OK?(expr(s)) Implies
(expr ## fstmt)(s) = (e2s(expr) ## fstmt(data(expr(s))))(s)
% proof status:−)
stmt_eval_if_ok_fstmt : Lemma
OK?((stmt ## expr)(s))

Implies

(stmt ## (expr ## fstmt))(s) = (stmt ## (e2s(expr) ## fstmt(data((stmt ## expr)(s)))))(s)

% proof status:−)
comp_eval_if_ok_fstmt_cstmt : Lemma
OK?(expr(s)) Implies
((expr ## fstmt) ## cstmt)(s) = (e2s(expr) ## fstmt(data(expr(s))) ## cstmt)(s)
% proof status:−)
stmt_eval_if_ok_fstmt_cstmt : Lemma
OK?((stmt ## expr)(s))

Implies

(stmt ## (expr ## fstmt) ## cstmt)(s) = (stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## cstmt)(s)
% Composition
% =============
% proof status:−)
composition_assoc_rewrite_expr_1 : Lemma
(stmt ## (stmt1 ## expr)) = ((stmt ## stmt1) ## expr)
% proof status:−)
composition_assoc_rewrite_expr_2 : Lemma
(stmt ## (cstmt ## expr)) = ((stmt ## cstmt) ## expr)
% proof status:−)
composition_assoc_rewrite_expr_3 : Lemma
(cstmt ## (cstmt1 ## expr)) = ((cstmt ## cstmt1) ## expr)
% proof status:−)
composition_assoc_rewrite_expr_4 : Lemma
(stmt ## (lift(stmt1) ## lexpr)) = ((stmt ## stmt1) ## lexpr)
% proof status:−)
composition_assoc_rewrite_expr_5 : Lemma
(stmt ## (cstmt ## lexpr)) = ((stmt ## cstmt) ## lexpr)
% proof status:−)
composition_assoc_rewrite_expr_6 : Lemma
(cstmt ## (cstmt1 ## lexpr)) = ((cstmt ## cstmt1) ## lexpr)
% proof status:−)
composition_assoc_rewrite_stmt_ok : Lemma
OK?(stmt(s)) Implies
(stmt ## (stmt1 ## cstmt))(s) = ((stmt ## stmt1) ## cstmt)(s)
% proof status:−)
composition_assoc_rewrite_stmt_ok_expr : Lemma
OK?(stmt(s)) Implies
(stmt ## (stmt1 ## cstmt) ## expr)(s) = ((stmt ## stmt1) ## cstmt ## expr)(s)
% proof status:−)
composition_assoc_rewrite_stmt_ok_expr_lexpr : Lemma
OK?(stmt(s)) Implies
(stmt ## (stmt1 ## cstmt) ## lexpr)(s) = ((stmt ## stmt1) ## cstmt ## lexpr)(s)

% proof status:−)
ok_result_fstmt: Lemma
Forall (data : Data) :
ok_result(data) ## fstmt = fstmt(data)
pm : Var Plain_Memory[State]
dt : Var (interpreted_data_type ?[Data])
addr : Var Address
% proof status:−)
pm_q_prop_read_ok_s_read_ok : Lemma
pm_q_prop_read (pm, dt, addr)(skip(s)) Implies
OK?(read_data(pm, dt)(addr)(s))

END Single_Statement_Rewrites1
Single_Statement_Rewrites2[State, Data1, Data2 : Type] : THEORY

BEGIN

Importing Single_Statement_Rewrites1
s : VAR State
stmt : VAR [State −> StmtResult[State]]
cstmt : VAR [StmtResult[State] −> StmtResult[State]]
expr : VAR [State −> ExprResult[State, Data1]]
expr1 : VAR [State −> ExprResult[State, Data2]]
fexpr : VAR [Data2 −> [State −> ExprResult[State, Data1]]]
fstmt : VAR [Data1 −> [State −> StmtResult[State]]]
% Lemmasto speed up rewriting
% ==============================
% proof status:−)
ok_result_fexpr: Lemma
Forall (data : Data2) :
ok_result(data) ## fexpr = fexpr(data)
% E2s Expr
% ===========
% proof status:−)
e2s_merge: Lemma
(e2s(expr) ## e2s(expr1)) = e2s(expr ## expr1)
% proof status:−)
stmt_e2s_merge: Lemma
(stmt ## e2s(expr) ## e2s(expr1)) =
(stmt ## e2s(expr ## expr1))
% proof status:−)

e2s_expr: Lemma
(e2s(expr1) ## expr)(s) = (expr1 ## expr)(s)
% proof status:−)
stmt_e2s_expr: Lemma
(stmt ## e2s(expr1) ## expr)(s) = (stmt ## expr1 ## expr)(s)
% proof status:−)
composition_assoc_expression_rewrite_stmt : Lemma
(stmt ## (expr ## expr1)) = ((stmt ## expr) ## expr1)
% proof status:−)
comp_eval_if_ok_fstmt_expr : Lemma
OK?(expr(s)) Implies
((expr ## fstmt) ## expr1)(s) = (e2s(expr) ## fstmt(data(expr(s))) ## expr1)(s)
% proof status:−)
stmt_eval_if_ok_fstmt_expr : Lemma
OK?((stmt ## expr)(s)) Implies
(stmt ## (expr ## fstmt) ## expr1)(s) =
(stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## expr1)(s)
% proof status:−)
stmt_eval_if_ok_fexpr : Lemma
OK?((stmt ## expr1)(s)) Implies
(stmt ## (expr1 ## fexpr))(s) = (stmt ## expr1 ## fexpr(data((stmt ## expr1)(s))))(s)
% proof status:−)
comp_eval_if_ok_fstmt_cstmt_expr : Lemma
OK?(expr(s)) Implies
(((expr ## fstmt) ## cstmt) ## expr1)(s) =
(((e2s(expr) ## fstmt(data(expr(s)))) ## cstmt) ## expr1)(s)
% proof status:−)
stmt_eval_if_ok_fstmt_cstmt_expr : Lemma
OK?((stmt ## expr)(s)) Implies
(stmt ## (expr ## fstmt) ## cstmt ## expr1)(s) =
(stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## cstmt ## expr1)(s)
End Single_Statement_Rewrites2

Single_Statement_Rewrites3[State, Data1, Data2, Data3 : Type] : THEORY

BEGIN

Importing Single_Statement_Rewrites2
% Assumption: there is not alwaysan expressionat the end !!!
expr : VAR [State −> ExprResult[State, Data1]]
expr1 : VAR [State −> ExprResult[State, Data2]]
expr2 : VAR [State −> ExprResult[State, Data3]]

fexpr : VAR [Data1 −> [State −> ExprResult[State, Data3]]]
stmt : VAR [State −> StmtResult[State]]
s : VAR State
% E2s Expr
% ===========
% proof status:−)
ok_result_elemination_2 : Lemma
Forall (data : Data3) :
((expr ## ok_result[State, Data3](data)) ## expr1) = (expr ## expr1)
% Composition
% =============
% proof status:−)
comp_eval_if_ok_fexpr_expr : Lemma
OK?(expr(s)) Implies
((expr ## fexpr) ## expr1)(s) = (expr ## fexpr(data(expr(s))) ## expr1)(s)
% proof status:−)
expr_eval_if_ok_fexpr : Lemma
OK?((expr1 ## expr)(s)) Implies
(expr1 ## (expr ## fexpr))(s) = (expr1 ## expr ## fexpr(data((expr1 ## expr)(s))))(s)
% proof status:−)
composition_assoc_expression_rewrite : Lemma
(expr ## (expr1 ## expr2)) = ((expr ## expr1) ## expr2)
% proof status:−)
stmt_eval_if_ok_fexpr_expr : Lemma
OK?((stmt ## expr)(s)) Implies
(stmt ## (expr ## fexpr) ## expr1)(s) =
(stmt ## expr ## fexpr(data((stmt ## expr)(s))) ## expr1)(s)
END Single_Statement_Rewrites3

Single_Statement_Rewrites4[State, Data1, Data2, Data3, Data4 : Type] : THEORY

BEGIN

Importing Single_Statement_Rewrites3
expr : VAR [State −> ExprResult[State, Data1]]
expr1 : VAR [State −> ExprResult[State, Data2]]
expr2 : VAR [State −> ExprResult[State, Data4]]
fexpr : VAR [Data2 −> [State −> ExprResult[State, Data3]]]
s : VAR State

% Composition
% =============
% proof status:−)
expr_eval_if_ok_fexpr_expr : Lemma
OK?((expr ## expr1)(s)) Implies
(expr ## (expr1 ## fexpr) ## expr2)(s) =
(expr ## expr1 ## fexpr(data((expr ## expr1)(s))) ## expr2)(s)
END Single_Statement_Rewrites4
While_Hoare[State, Ord : Type] : Theory

Begin

Importing Single_Statement_Rewrites4 , More_Relations
s0 : Var State
< : Var PRED[[Ord, Ord]]
b_ex: Var [State −> ExprResult[State, bool]]
body : Var [State −> StmtResult[State]]
n : Var nat
% proof status:−)
iterate_while_right: Lemma
Forall (n : nat) :
iterate_while(1 + n, b_ex, body) =
iterate_while(n, b_ex, body) ## lift(e2s(b_ex) ## body ## catch_continue)
% WhileInvariant
% −−−−−−−−−−−−−−−−−
% proof status:−)
% while_variant ?_TCC1: TCCObligation
while_variant?(b_ex, body, <)(variant : [State −> Ord],
Q : PRED[StmtResult[State]]) : bool =

well_founded

?(<)

And

while_invariant?(b_ex, body)(Q, Q)

And

Forall(s : State) :
Q(OK(s)) And OK?(b_ex(s)) And data(b_ex(s)) And
OK?((e2s(b_ex) ## body ## catch_continue)(s))

Implies

variant(state((e2s(b_ex) ## body ## catch_continue)(s))) < variant(s)

% proof status:−)
% while_no_cb_TCC1: TCCObligation

while_no_cb (b_ex, body) : [State −> StmtResult[State]] =
Lambda (s : State) :
If Exists (n : nat): while_termination_point ?(b_ex, body, s)(n) Then

Let

i = min[nat](while_termination_point ?(b_ex, body, s))

In

(iterate_while(i, b_ex, body) ## e2s(b_ex))(s)

Else

Hang Endif

% proof status:−)
while_no_cb_cb_while : Lemma
while(b_ex, body) = (while_no_cb (b_ex, body) ## catch_break)

% proof status:−)
iterate_while_invariant: Lemma
Forall (inv_abnorm?, inv_norm? : PRED[StmtResult[State]], n : nat) :
while_invariant?(b_ex, body)(inv_abnorm?, inv_norm?)

And

inv_abnorm?(OK(s0))

And

(Forall (m : nat) : m < n Implies Not while_termination_point ?(b_ex, body, s0)(m))

Implies

inv_abnorm?(iterate_while(n, b_ex, body)(s0))

% proof status:−)
min_termination_point_no_less : Lemma
Forall (m : nat) :
(Exists (n : nat) : while_termination_point ?(b_ex, body, s0)(n))

And

m < min[nat](while_termination_point ?(b_ex, body, s0))

Implies

Not while_termination_point ?(b_ex, body, s0)(m)

% proof status:−)
while_terminates: Lemma
Forall (term_inv? : PRED[StmtResult[State]], variant : [State −> Ord]) :
while_variant?(b_ex, body, <)(variant, term_inv?) And % term_inv?(s0)
term_inv?(OK(s0))

Implies

Exists (n : nat) : while_termination_point ?(b_ex, body, s0)(n)

% proof status:−)
hoare_while: Lemma
Forall (term_inv? : PRED[StmtResult[State]],

data_inv_abnorm ?, data_inv_norm ? : PRED[StmtResult[State]],
variant : [State −> Ord]) :
while_variant?(b_ex, body, <)(variant, term_inv?)

And

while_invariant?(b_ex, body)(data_inv_abnorm ?, data_inv_norm ?)

And

data_inv_abnorm ?(OK(s0)) And % term_inv?(s0)
term_inv?(OK(s0))

Implies

Let res = while_no_cb (b_ex, body)(s0) In
term_inv?(res)

And

((data_inv_abnorm ?(res) And Not OK?(res)) OR
data_inv_norm ?(res))
End While_Hoare
While_Rewrites[State, Ord : Type] : Theory

Begin

Importing While_Hoare
s : VAR State
pm : Var Plain_Memory[State]
b_ex: VAR [State −> ExprResult[State, bool]]
body : VAR [State −> StmtResult[State]]
stmt : VAR [State −> StmtResult[State]]
% data invariant: P = abnormaltermination, Q = normaltermination
% terminationinvariant: Q
P, Q, R : VAR [State −> PRED[StmtResult[State]]]
% property
S : VAR PRED[StmtResult[State]]
% variant
variant : VAR [State −> [State −> Ord]]
< : VAR PRED[[Ord, Ord]]

while_no_cb (b_ex, body)(P, Q, R, variant, <) : [State −> StmtResult[State]] =
while_no_cb [State, Ord](b_ex, body)

% proof status:−)
while_to_while_no_cb : Lemma
while[State, Ord](b_ex, body)(P, Q, R, variant, <) =
(while_no_cb (b_ex, body)(P, Q, R, variant, <) ## catch_break)

% proof status:−)
while_inv_rewrite_termination_result : Lemma
P(s)(skip(s)) And R(s)(skip(s))

And

while_variant?(b_ex, body, <)(variant(s), R(s))

And

while_invariant?(b_ex, body)(P(s), Q(s))

And

(Forall (res : StmtResult[State]) : R(s)(res) Implies S(res))

Implies

S(while_no_cb (b_ex, body)(P, Q, R, variant, <)(s))

% proof status:−)
while_inv_rewrite_data_ok : Lemma
P(s)(skip(s)) And R(s)(skip(s))

And

while_variant?(b_ex, body, <)(variant(s), R(s))

And

while_invariant?(b_ex, body)(P(s), Q(s))

And

OK?(while_no_cb (b_ex, body)(P, Q, R, variant, <)(s))

And

(Forall (res : StmtResult[State]) : Q(s)(res) Implies S(res))

Implies

S(while_no_cb (b_ex, body)(P, Q, R, variant, <)(s))

% proof status:−)
while_inv_rewrite_data_break : Lemma
P(s)(skip(s)) And R(s)(skip(s))

And

while_variant?(b_ex, body, <)(variant(s), R(s))

And

while_invariant?(b_ex, body)(P(s), Q(s))

And

Break?(while_no_cb (b_ex, body)(P, Q, R, variant, <)(s))

And

(Forall (res : StmtResult[State]) : (P(s)(res) Or Q(s)(res)) And Break?(res) Implies S(res))

Implies

S(while_no_cb (b_ex, body)(P, Q, R, variant, <)(s))

% proof status:−)
while_inv_rewrite_data_return : Lemma
P(s)(skip(s)) And R(s)(skip(s))

And

while_variant?(b_ex, body, <)(variant(s), R(s))

And

while_invariant?(b_ex, body)(P(s), Q(s))

And

Return?(while_no_cb (b_ex, body)(P, Q, R, variant, <)(s))

B PVS Theory Sources

And

(Forall (res : StmtResult[State]) : (P(s)(res) Or Q(s)(res)) And Return?(res) Implies S(res))

Implies

S(while_no_cb (b_ex, body)(P, Q, R, variant, <)(s))
% proof status:−)
% stmt_while_inv_rewrite_termination_result_TCC1 : TCCObligation
% proof status:−)
stmt_while_inv_rewrite_termination_result : Lemma
OK?(stmt(s)) And P(state(stmt(s)))(stmt(s)) And R(state(stmt(s)))(stmt(s))

And

while_variant?(b_ex, body, <)(variant(state(stmt(s))), R(state(stmt(s))))

And

while_invariant?(b_ex, body)(P(state(stmt(s))), Q(state(stmt(s))))

And

(Forall (res : StmtResult[State]) : R(state(stmt(s)))(res) Implies S(res))

Implies

S((stmt ## while_no_cb (b_ex, body)(P, Q, R, variant, <))(s))
% (auto−rewrite"stmt_while_inv_rewrite_data_ok !")
% Can’t rewriteusing stmt_while_inv_rewrite_data_ok : LHS key S is bad.
% proof status:−)
stmt_while_inv_rewrite_data_ok : Lemma
OK?(stmt(s)) And P(state(stmt(s)))(stmt(s)) And R(state(stmt(s)))(stmt(s))

And

while_variant?(b_ex, body, <)(variant(state(stmt(s))), R(state(stmt(s))))

And

while_invariant?(b_ex, body)(P(state(stmt(s))), Q(state(stmt(s))))

And

OK?((stmt ## while_no_cb (b_ex, body)(P, Q, R, variant, <))(s))

And

(Forall (res : StmtResult[State]) : Q(state(stmt(s)))(res) Implies S(res))

Implies

S((stmt ## while_no_cb (b_ex, body)(P, Q, R, variant, <))(s))
% proof status:−)
stmt_while_inv_rewrite_data_break : Lemma
OK?(stmt(s)) And P(state(stmt(s)))(stmt(s)) And R(state(stmt(s)))(stmt(s))

And

while_variant?(b_ex, body, <)(variant(state(stmt(s))), R(state(stmt(s))))

And

while_invariant?(b_ex, body)(P(state(stmt(s))), Q(state(stmt(s))))

And

Break?((stmt ## while_no_cb (b_ex, body)(P, Q, R, variant, <))(s))

And

(Forall (res : StmtResult[State]) :
(P(state(stmt(s)))(res) Or Q(state(stmt(s)))(res)) And Break?(res) Implies S(res))

Implies

S((stmt ## while_no_cb (b_ex, body)(P, Q, R, variant, <))(s))

B.29 statement-rewrites.pvs

% proof status:−)
stmt_while_inv_rewrite_data_return : Lemma
OK?(stmt(s)) And P(state(stmt(s)))(stmt(s)) And R(state(stmt(s)))(stmt(s))

And

while_variant?(b_ex, body, <)(variant(state(stmt(s))), R(state(stmt(s))))

And

while_invariant?(b_ex, body)(P(state(stmt(s))), Q(state(stmt(s))))

And

Return?((stmt ## while_no_cb (b_ex, body)(P, Q, R, variant, <))(s))

And

(Forall (res : StmtResult[State]) :
(P(state(stmt(s)))(res) Or Q(state(stmt(s)))(res)) And Return?(res) Implies S(res))

Implies

S((stmt ## while_no_cb (b_ex, body)(P, Q, R, variant, <))(s))
% proof status:−)
pm_q_prop_while : Lemma
Let pm_q_prop_inv = Lambda (s : State) : Lambda (res : StmtResult[State]) :
pm_q_prop (pm)(catch_break(res))

In

pm‘states(s) And R(s)(skip(s))

And

while_variant?(b_ex, body, <)(variant(s), R(s))

And

while_invariant?(b_ex, body)(pm_q_prop_inv (s), pm_q_prop_inv (s))

Implies

pm_q_prop (pm)(while(b_ex, body)(P, Q, R, variant, <)(s))
% proof status:−)
% pm_q_prop_stmt_while_TCC1 : TCCObligation
% proof status:−)
pm_q_prop_stmt_while : Lemma
Let pm_q_prop_inv = Lambda (s : State) : Lambda (res : StmtResult[State]) :
pm_q_prop (pm)(catch_break(res))

In

pm_q_prop (pm)(stmt(s)) And R(state(stmt(s)))(stmt(s))

And

while_variant?(b_ex, body, <)(variant(state(stmt(s))), R(state(stmt(s))))

And

while_invariant?(b_ex, body)(pm_q_prop_inv (state(stmt(s))), pm_q_prop_inv (state(stmt(s))))

Implies

pm_q_prop (pm)((stmt ## while(b_ex, body)(P, Q, R, variant, <))(s))
End While_Rewrites
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Statement_Rewrites : importseverything

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Statement_Rewrites[State : Type] : Theory

Begin

Importing While_Rewrites
End Statement_Rewrites

B.30 statements.pvs

% $Id: statements.pvs,v 1.37.2.1.2.1.2.2 2008/05/14 14:25:00 tews Exp$

%

% Author: TjarkWeber(based on lecturematerialby HendrikTews)
% MarcusVölp(rewritingrules)
% (c) 2007 RadboudUniversity

%

% A shallowembeddingof (some) C++ statementsas state transformers.
% Section numbersin commentsthroughoutthis file refer to
% "Programminglanguages− C++", ISO/IEC14882:1998(E)
% Most statementshave type
% State −> StmtResult[State]

%

% "case"and "default"labelstatementshoweverhave type
% StmtResult[State] −> StmtResult[State]
% so that theycan catch a "Switch"or "Default"result.

%

% Functionsof the formertypeare liftedto the lattertypeby modifying
% resultsof the form
% OK(state)
% only, and passingthe resultthroughunchangedotherwise(see the definitions
% of ## in state−transformer.pvs).
% Deviationsfrom the C++ standard:

%

% "goto"(6.6.4) and goto labels(6.1) have not been modeled. Thiswouldnot
% be difficultin principle, but the possibilityof jumpsinto substatements
% (e.g. into an "if"or "while")wouldmake the formalizationof these
% statementsmore complicated. Alsonote that (backward) gotos may cause
% nonterminationand wouldneed to be modeledsomewhatsimilarto loops.

%

% Forthe same reason, "case"and "default"labelsare requiredto appearon
% top−levelstatementscontainedwithinthe (compound) substatementof a
% "switch"statementonly, contraryto what 6.4.2.6 specifies. (Note that this
% rulesout code like Duff’s Device.)

%

% The conditionof a "switch"statementmust evaluateto a valueof typeint
% (cf. 6.4.2.2).

B.30 statements.pvs

% >> Thisis accordingto the standard: the conditionmust be of integraltype,
% enum type(whichhas an integralbase type) or of a class typethat can
% be convertedto an integralor enum type.

%

% Functionsmust alwaysuse a "return"statementto return; flowingoff the
% end of a functionis not allowed(cf. 6.6.3.2). Thiscan be achievedthrough
% a trivialsource code transformation, where a "return_void"statementis
% appended(as the body’s last statement) to each functionwithreturntype
% void. Alternatively , "catch_return"(see expressions.pvs) could be
% overloadedto convertOK(s) into OK(s, unit), but that wouldprobablycause
% ambiguitiesin typechecking.
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 6.1: Labeledstatement

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
LabeledStatements[State : Type] : THEORY

BEGIN

IMPORTING StmtResult
const : VAR int
stmt : VAR [State −> StmtResult[State]]
% res : VARStmtResult[State]
% ident: VARstring
% goto target: not modeled
% label(ident)(res) : StmtResult[State] =
% CASESres OF
% Goto(state, label):
% if label= identthen OK(state) else res endif
% ELSEres
% ENDCASES
% switch: case target
case(const) : [StmtResult[State] −> StmtResult[State]] =
Lambda (res : StmtResult[State]) :
CASES res OF
Switch(state, case):
if case = const then OK(state) else res endif
ELSE res

ENDCASES

% switch: defaulttarget
default : [StmtResult[State] −> StmtResult[State]] =
Lambda (res : StmtResult[State]) :
CASES res OF
Default(state): OK(state)
ELSE res

B PVS Theory Sources

ENDCASES

END LabeledStatements
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 6.2: Expressionstatement

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
SkipStatements[State : Type] : THEORY

BEGIN

IMPORTING StmtResult
s : VAR State
skip : [State −> StmtResult[State]] =
Lambda (s : State) : OK(s)
END SkipStatements
ExpressionStatements[State, ExprData : Type] : THEORY

BEGIN

IMPORTING ExprResult, StmtResult
s : VAR State
ex : VAR [State −> ExprResult[State,ExprData]]
% expression−to−statement
e2s(ex) : [State −> StmtResult[State]] =
Lambda (s : State) :
CASES ex(s) OF
OK(state, data): OK(state), % forget the expressiondata
Fatal: Fatal,
Hang: Hang,
% TODO: other possibleexpressionresults?
Exception(ex, state) : Exception(ex, state)

ENDCASES

END ExpressionStatements
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 6.3: Compoundstatementor block

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Thereis no need to model blocks here (or so I hope − what about the scope of

% declarationsthough?). Compositionof statementsis definedas
% ##
% in state−transformer.pvs.

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Auxiliarycatch_XXXfunctions; used to model jumps(cf. 6.6)

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
CatchAux[State : Type] : THEORY

BEGIN

IMPORTING ExprResult, StmtResult
res : VAR StmtResult[State]
catch_break(res) : StmtResult[State] =
CASES res OF
Break(state): OK(state)
ELSE res

ENDCASES

catch_continue(res) : StmtResult[State] =
CASES res OF
Continue(state): OK(state)
ELSE res

ENDCASES

% catch_switch: not needed since a switchstatementwillbe enteredwitha
% "Switch"resultonlyif there is a matchingcase target
catch_default(res) : StmtResult[State] =
CASES res OF
Default(state): OK(state)
ELSE res

ENDCASES

catch_return(res) : StmtResult[State] =
CASES res OF
Return(state): OK(state)
ELSE res

ENDCASES

END CatchAux

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 6.4: Selectionstatements(if, switch)

B PVS Theory Sources

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
SelectionStatements[State : Type] : THEORY

BEGIN

IMPORTING State_Transformer, CatchAux
s : VAR State
b_ex: VAR [State −> ExprResult[State,bool]]
t1, t2: VAR [State −> StmtResult[State]]
n_ex: VAR [State −> ExprResult[State,int]]
case_consts: VAR list[int]
case_stm: VAR [StmtResult[State] −> StmtResult[State]]
% 6.4.1
% if ... else ...
if_else(b_ex, t1, t2) : [State −> StmtResult[State]] =
(b_ex## lambda (b : bool): if b then t1 else t2 endif)
% if withoutelse (6.4.1) is equivalentto if_else(b_ex, t1, skip)
% 6.4.2
% switch
% case_constsis a list of all constantsthat occur as case labelswithinthe
% switchstatement. We need it to determinebeforehandif there is one such
% labelthat matches; otherwisethe defaultlabel(if there is one) must be
% taken (cf. 6.4.2.5).
switch(n_ex, case_consts, case_stm) : [State −> StmtResult[State]] =

(

n_ex## (lambda (n : int) :
if member(n, case_consts) then
switch_result(n) ## case_stm

else

default_result## case_stm## catch_default
endif) ## catch_break

)

END SelectionStatements
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 6.5: Iterationstatements(while, do while, for)

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
IterationStatements1[State : Type] : THEORY

B.30 statements.pvs

BEGIN

IMPORTING SkipStatements, ExpressionStatements,
SelectionStatements, Number_Props
s : VAR State
b_ex: VAR [State −> ExprResult[State,bool]]
body: VAR [State −> StmtResult[State]]
% 6.5.1
% while
% proof status:−)
% iterate_while_TCC1: TCCObligation
% proof status:−)
% iterate_while_TCC2: TCCObligation
% unrollthe loop n times (must returnthe state immediatelybefore
% evaluationof b_ex, so that we can define while_termination_point ?)
iterate_while(n : nat, b_ex, body)(s) : RECURSIVE
StmtResult[State] =
(if n = 0 then

skip else

e2s(b_ex) ##
body ##
catch_continue##
iterate_while(n−1, b_ex, body)
endif)(s)
MEASURE n
% proof status:−)
% while_termination_point ?_TCC1: TCCObligation
while_termination_point ?(b_ex, body, s)(n : nat) : bool =
let res = iterate_while(n, b_ex, body)(s) in
not OK?(res) or
not OK?(b_ex(state(res))) or
not data(b_ex(state(res)))
% proof status:−)
% while_TCC1: TCCObligation
while(b_ex, body) : [State −> StmtResult[State]] =
Lambda (s : State) :
if exists (n : nat): while_termination_point ?(b_ex, body, s)(n) then

let

i = min[nat](while_termination_point ?(b_ex, body, s))
in (
iterate_while(i, b_ex, body) ##

e2s(b_ex) ## % evaluateb_exone more time

catch_break

)(s)

else

Hang endif

% proof status:−)
nonzero_min_while_termination_point : Lemma
(Exists (n : nat) : while_termination_point ?(b_ex, body, s)(n)) And
Not min[nat](while_termination_point ?(b_ex, body, s)) = 0

Implies

OK?(b_ex(s)) And data(b_ex(s))
% Warningdo not auto−rewritewithwhile_as_if_while .
% Use while(max, ...) and while_unrollinstead
% proof status:−)
while_as_if_while : Lemma
while(b_ex, body) = if_else(b_ex, body ## catch_continue##
while(b_ex, body) ## catch_break, skip)
while(max : nat, b_ex, body) : [State −> StmtResult[State]] =
while(b_ex, body)
% Warningdo not auto−rewritewiththis lemma−−− takes too long;
% use while_unroll_rewrite ∗ instead
% while_unroll: Lemma
% Forall(max : nat) : max > 0
% Implies
% while(max, b_ex, body) =
% if_else(b_ex, body## catch_continue## while(max − 1, b_ex, body) ##
% catch_break, skip)
% while_unroll_0: Lemma
% while(0, b_ex, body) = while(b_ex, body)

while_invariant?(b_ex, body)(P, Q : PRED[StmtResult[State]]) : bool =
Forall (s : State) :
P(skip(s)) Implies
If OK?(b_ex(s)) And data(b_ex(s)) Then
P((e2s(b_ex) ## body ## catch_continue[State])(s))

Else

Q(e2s(b_ex)(s))

Endif

% 6.5.2
% do
% unrollthe loop n times (must returnthe state immediatelybefore
% evaluationof b_ex, so that we can define do_termination_point ?)

iterate_do(n : nat, body, b_ex)(s) : RECURSIVE
StmtResult[State] =
(if n = 0 then
body ##

catch_continue else

body ##
catch_continue##
e2s(b_ex) ##
iterate_do(n−1, body, b_ex)
endif)(s)
MEASURE n
% proof status:−)
iterate_do_as_while : Lemma
Forall (n : nat) :
iterate_do(n, body, b_ex) = (body ## catch_continue##
iterate_while(n, b_ex, body))
% proof status:−)
% do_termination_point ?_TCC1: TCCObligation
do_termination_point ?(body, b_ex, s)(n : nat) : bool =
let res = iterate_do(n, body, b_ex)(s) in
not OK?(res) or
not OK?(b_ex(state(res))) or
not data(b_ex(state(res)))
% proof status:−)
% termination_point_do_as_while_TCC1 : TCCObligation
% proof status:−)
termination_point_do_as_while : Lemma
OK?((body ## catch_continue)(s)) Implies
do_termination_point ?(body, b_ex, s) =
while_termination_point ?(b_ex, body, state(
(body ## catch_continue)(s)))
% proof status:−)
% do_while_TCC1: TCCObligation
do_while(body, b_ex) : [State −> StmtResult[State]] =
Lambda (s : State) :
if exists (n : nat): do_termination_point ?(body, b_ex, s)(n) then

let

i = min[nat](do_termination_point ?(body, b_ex, s))
in (
iterate_do(i, body, b_ex) ##
e2s(b_ex) ## % evaluateb_exone more time

catch_break

)(s)

else

Hang endif

% proof status:−)
do_as_while: Lemma
do_while(body, b_ex) = (body ## catch_continue## while(b_ex, body) ##

catch_break)

do_while(max : nat, body, b_ex) : [State −> StmtResult[State]] =
do_while(body, b_ex)
% proof status:−)
do_while_unroll: Lemma
Forall (max : nat) :
do_while(max, body, b_ex) = (body ## catch_continue##
while(max, b_ex, body) ## catch_break)
END IterationStatements1

IterationStatements2[State, ExprData : Type] : THEORY

BEGIN

IMPORTING IterationStatements1
s : VAR State
b_ex: VAR [State −> ExprResult[State,bool]]
body: VAR [State −> StmtResult[State]]
% 6.5: A for−init−statementis eitheran expression−statementor a
% simple−declaration. We have not modeledthe latter(yet).
init: VAR [State −> StmtResult[State]]
expr: VAR [State −> ExprResult[State,ExprData]]
% 6.5.3
% for
% proof status:−)
% iterate_for_TCC1: TCCObligation
% proof status:−)
% iterate_for_TCC2: TCCObligation
% unrollthe loop n times (must returnthe state immediatelybefore
% evaluationof b_ex, so that we can define for_termination_point ?)
iterate_for(n : nat, b_ex, expr, body)(s) : RECURSIVE
StmtResult[State] =
(if n = 0 then

skip else

e2s(b_ex) ##

body ##
catch_continue##
e2s(expr) ##
iterate_for(n−1, b_ex, expr, body)
endif)(s)
MEASURE n
% proof status:−)
% iterate_for_as_while_TCC1 : TCCObligation
% proof status:−)
iterate_for_as_while : Lemma
Forall (n : nat) : n > 0 Implies
iterate_for(n, b_ex, expr, body) =
(e2s(b_ex) ## body ## catch_continue##
iterate_while(n − 1, expr ## b_ex, body) ## e2s(expr))
% proof status:−)
% for_termination_point ?_TCC1: TCCObligation
for_termination_point ?(b_ex, expr, body, s)(n : nat) : bool =
let res = iterate_for(n, b_ex, expr, body)(s) in
not OK?(res) or
not OK?(b_ex(state(res))) or
not data(b_ex(state(res)))
% proof status:−)
% termination_point_for_as_while_TCC1 : TCCObligation
% proof status:−)
termination_point_for_as_while : Lemma
Forall (n : nat) :
n > 0 And
OK?((e2s(b_ex) ## body ## catch_continue)(s))

Implies

for_termination_point ?(b_ex, expr, body, s)(n) =
while_termination_point ?(expr ## b_ex, body,
state((e2s(b_ex) ## body ## catch_continue)(s)))(n − 1)
% proof status:−)
% min_termination_point_for_as_while_TCC1 : TCCObligation
% proof status:−)
% min_termination_point_for_as_while_TCC2 : TCCObligation
% proof status:−)
% min_termination_point_for_as_while_TCC3 : TCCObligation
% proof status:−)
min_termination_point_for_as_while : Lemma
(Exists (n : nat):
for_termination_point ?(b_ex, expr, body, s)(n)) And

OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) And
Not min[nat](for_termination_point ?(b_ex, expr, body, s)) = 0 Implies
min[nat](for_termination_point ?(b_ex, expr, body, s)) =
min[nat](while_termination_point ?(expr ## b_ex, body,
state[State]((e2s(b_ex) ## body ## catch_continue)(s)))) + 1
% proof status:−)
% nonzero_min_for_termination_point_TCC1 : TCCObligation
% proof status:−)
nonzero_min_for_termination_point : Lemma
(Exists (n : nat):
for_termination_point ?(b_ex, expr, body, s)(n)) And
Not min[nat](for_termination_point ?(b_ex, expr, body, s)) = 0

Implies

OK?(b_ex(s)) And data(b_ex(s))
for(init, b_ex, expr, body) : [State −> StmtResult[State]] =
(init ##
lambda (state : State):
if exists (n : nat):
for_termination_point ?(b_ex, expr, body, state)(n) then

let

i = min[nat](for_termination_point ?(b_ex, expr, body, state))
in (
iterate_for(i, b_ex, expr, body) ##
e2s(b_ex) ## % evaluateb_exone more time

catch_break

)(state)

else

Hang endif

)

% proof status:−)
for_as_while: Lemma
for(init, b_ex, expr, body) =
(init ##
if_else(b_ex, body ## catch_continue## while(expr ## b_ex, body) ##
catch_break, skip))
for(max : nat, init, b_ex, expr, body) : [State −> StmtResult[State]] =
for(init, b_ex, expr, body)
% proof status:−)
for_unroll: Lemma
Forall (max : nat) :
for(max, init, b_ex, expr, body) =
(init ##
if_else(b_ex, body ## catch_continue##
while(max, expr ## b_ex, body) ## catch_break, skip))

END IterationStatements2
IterationStatements3[State, Ord : Type] : Theory

Begin

Importing IterationStatements1
b_ex: VAR [State −> ExprResult[State, bool]]
body : VAR [State −> StmtResult[State]]
% data invariant(P = abnormaltermination, Q = normaltermination)
% terminationinvariantR
P, Q, R : VAR [State −> PRED[StmtResult[State]]]
% variant
variant : VAR [State −> [State −> Ord]]
< : VAR PRED[[Ord, Ord]]
% whilewithembeddedloop invariants
while(b_ex, body)(P, Q, R, variant, <) : [State −> StmtResult[State]] =
while(b_ex, body)
do_while(body, b_ex)(P, Q, R, variant, <) : [State −> StmtResult[State]] =
do_while(body, b_ex)
% proof status:−)
do_while_inv_unroll : Lemma
do_while(body, b_ex)(P, Q, R, variant, <) =
(body ## catch_continue## while(b_ex, body)(P, Q, R, variant, <) ##

catch_break)

End IterationStatements3

IterationStatements4[State, ExprData, Ord : Type] : Theory

Begin

Importing IterationStatements2, IterationStatements3
b_ex: VAR [State −> ExprResult[State, bool]]
body : VAR [State −> StmtResult[State]]
init: VAR [State −> StmtResult[State]]
expr: VAR [State −> ExprResult[State,ExprData]]
% data invariant(P = abnormaltermination, Q = normaltermination)
% terminationinvariantR
P, Q, R : VAR [State −> PRED[StmtResult[State]]]
% variant
variant : VAR [State −> [State −> Ord]]

< : VAR PRED[[Ord, Ord]]
% whilewithembeddedloop invariants
for(init, b_ex, expr, body)(P, Q, R, variant, <) :
[State −> StmtResult[State]] =
for(init, b_ex, expr, body)
% proof status:−)
for_inv_unroll: Lemma
for(init, b_ex, expr, body)(P, Q, R, variant, <) =
(init ##
if_else(b_ex, body ## catch_continue##
while(expr ## b_ex, body)(P, Q, R, variant, <) ##
catch_break, skip))
End IterationStatements4

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 6.6: Jumpstatements(break, continue, return, goto)

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
JumpStatements1[State : Type] : THEORY

BEGIN

IMPORTING State_Transformer
s : VAR State
% label: VARstring
% 6.6.1
break : [State −> StmtResult[State]] =
Lambda (s : State) : Break(s)
% 6.6.2
continue : [State −> StmtResult[State]] =
Lambda (s : State) : Continue(s)
% 6.6.3
return_void: [State −> StmtResult[State]] =

return_result

% 6.6.4
% goto: not modeled
% goto(label)(s) : StmtResult[State] = Goto(s, label)
END JumpStatements1

JumpStatements2[State, Data : Type] : THEORY

BEGIN

IMPORTING Cpp_Types,
ExpressionStatements, Abstract_Read_Write_Plain
dt : VAR (interpreted_data_type ?[Data])
addr : VAR Address
pm : VAR Plain_Memory[State]
% % 6.6.3
% MV: this is bogus as we have to potentiallycall the copy constructor
% for compoundobjects; don’t do it but generatean assignmentto ret_addr
% instead
return(pm, dt, addr)(ex : ET[State, Data]) : [State −> StmtResult[State]] =

(

e2s(
ex ## lambda (e : Data) :
write_data(pm, dt)(addr, e)
) ##

return_result )

END JumpStatements2

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% 6.7: Delarationstatement

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
DeclarationStatements1[State : Type] : THEORY

BEGIN

IMPORTING Abstract_Read_Write_Plain , CatchAux
fstmt : VAR [Address −> [State −> StmtResult[State]]]
addr : Var Address
uidt : Var Uninterpreted_data_type% to determinesize
% cf. 6.7.2, 6.6.2
% MV >> Use cpp typeinsteadof dt
% Thisway we can allocatewithproperalignment
% MV >> do we have non−fundamentalExprResultsanyway
allocate_stack(uidt) : [State −> ExprResult[State, Address]] =
ok_result(Mem(0)) % TODO: returnproperstack address;
% allocatesize(uidt) bytes
deallocate_stack(uidt, addr) : [State −> StmtResult[State]] =

Lambda (s : State) : OK(s) % TODO: modifystack (release memoryagain)
with_new_stackvar (uidt)(fstmt) : [State −> StmtResult[State]] =

(

allocate_stack(uidt) ## Lambda (addr : Address) :
fstmt(addr) ##
lift_destructor(deallocate_stack(uidt, addr))

)

END DeclarationStatements1

DeclarationStatements2[State, Data : Type] : THEORY

BEGIN

IMPORTING DeclarationStatements1
fstmt : VAR [Address −> [State −> StmtResult[State]]]
addr : Var Address
uidt : Var Uninterpreted_data_type% to determinesize
dt : Var (interpreted_data_type ?[Data])
pm : Var Plain_Memory[State]
with_new_returnvar (pm, dt)(fstmt) : [State −> ExprResult[State, Data]] =

(

allocate_stack(uidt(dt)) ## Lambda (addr : Address) :
fstmt(addr) ##
catch_return##
read_data(pm, dt)(addr)

)

END DeclarationStatements2

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Assemblerstatement(this is NOT a C++ statement)

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
AssemblerStatements[State: Type] : THEORY

BEGIN

IMPORTING SkipStatements, State_Transformer
str : VAR string
% We do not model assemblerstatements. In fact, we can’t model them in
% general, unlesswe know a lot more about the machinestate. This
% definitionis providedonlyso that the semanticscompilercan translate
% assemblerstatementsto type−correct (but unverifiable) PVS code.

B.31 state-transformer.pvs

asm(str) : [State −> StmtResult[State]] =
Lambda (s : State) : Fatal
END AssemblerStatements

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Statements: importseverything

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Statements[State : Type] : THEORY

BEGIN

IMPORTING LabeledStatements,
% SkipStatements,
% ExpressionStatements ,
% SelectionStatements,
% IterationStatements1,
% IterationStatements2,
% IterationStatements3,
IterationStatements4,
JumpStatements1,
JumpStatements2,
% DeclarationStatements1,
DeclarationStatements2,

AssemblerStatements

END Statements

B.31 state-transformer.pvs

% $Id: state−transformer.pvs,v 1.61.6.1.4.2 2008/05/14 14:25:00 tews Exp$

%

% Author: HendrikTews
% Author: MarcusVoelp
% Author: TjarkWeber, (c) 2007 RadboudUniversity

%

% Liftingand compositionof state transformers.
Transformer_Super_Embedding_Expr [State, Data : Type] : THEORY
% map expressionand statmenttransformersinto supertransformers
% utilitylemmasto breakup the supertransformers

BEGIN

IMPORTING Super_Embedding
s : VAR State
expr : VAR [State −> ExprResult[State, Data]]
expr_2_super (expr)(s) : SuperResult[State] =
expr_2_super_res (expr(s))

% proof status:−)
ok_expr_2_super : LEMMA
OK?(expr_2_super (expr)(s)) = OK?(expr(s))
% proof status:−)
has_next_state_expr_2_super : LEMMA
has_next_state (expr_2_super (expr)(s)) = has_next_state (expr(s))
% state_expr_2_super_TCC1
% state_expr_2_super_TCC2
% proof status:−)
% state_expr_2_super_TCC1 : TCCObligation
% proof status:−)
% state_expr_2_super_TCC2 : TCCObligation
% proof status:−)
state_expr_2_super : LEMMA
has_next_state (expr(s)) implies
state(expr_2_super (expr)(s)) = state(expr(s))
End Transformer_Super_Embedding_Expr
Transformer_Super_Embedding_Stmt [State : Type] : THEORY
% map expressionand statmenttransformersinto supertransformers
% utilitylemmasto breakup the supertransformers

BEGIN

IMPORTING Super_Embedding
s : VAR State
stmt : VAR [State −> StmtResult[State]]
stmt_2_super (stmt)(s) : SuperResult[State] =
stmt_2_super_res (stmt(s))
% proof status:−)
ok_stmt_2_super : LEMMA
OK?(stmt_2_super (stmt)(s)) = OK?(stmt(s))
% proof status:−)
has_next_state_stmt_2_super : LEMMA
has_next_state (stmt_2_super (stmt)(s)) = has_next_state (stmt(s))
% state_stmt_2_super_TCC1
% state_stmt_2_super_TCC2
% proof status:−)
% state_stmt_2_super_TCC1 : TCCObligation

% proof status:−)
% state_stmt_2_super_TCC2 : TCCObligation
% proof status:−)
state_stmt_2_super : LEMMA
has_next_state (stmt(s)) implies
state(stmt_2_super (stmt)(s)) = state(stmt(s))
End Transformer_Super_Embedding_Stmt
Transformer_Super_Embedding: Theory

Begin

Importing Transformer_Super_Embedding_Stmt , Transformer_Super_Embedding_Expr
End Transformer_Super_Embedding

State_Transformer_Lift_Expr [State, Data : Type] : THEORY

BEGIN

IMPORTING Transformer_Super_Embedding
s : VAR State
% lift data to ExprResult
ok_result(data : Data)(s) : ExprResult[State, Data] =
OK(s, data)
% proof status:−)
ok_result_ok: LEMMA Forall(data : Data) :
OK?(ok_result(data)(s))
% proof status:−)
% ok_result_data_TCC1: TCCObligation
% proof status:−)
ok_result_data: LEMMA Forall (data : Data) :
data(ok_result(data)(s)) = data
% proof status:−)
ok_result_state: Lemma Forall (data : Data) :
state(ok_result(data)(s)) = s
% proof status:−)
expr_2_super_ok_result : LEMMA Forall(data : Data) :
OK?(expr_2_super (ok_result(data))(s))
% lift a constantof type"lift[Data]"to "ExprResult[State, Data]"
ok_lift(d : lift[Data])(s) : ExprResult[State, Data] =
CASES d OF
bottom : Fatal,

up(b) : OK(s, b)

ENDCASES

% proof status:−)
ok_lift_ok: LEMMA Forall(d : lift[Data]) :
up?(d) implies ok_lift(d)(s) = OK(s, down(d))
% lift exceptionto ExprResult
exception_result(ex : Exception_type)(s) : ExprResult[State, Data] =
Exception(ex, s)
fatal_result(s) : ExprResult[State, Data] =

Fatal

% proof status:−)
has_next_state_ok_result : Lemma Forall (data : Data) :
has_next_state (ok_result(data)(s))
% proof status:−)
has_next_state_fatal_result : Lemma
Not has_next_state (fatal_result(s))
% proof status:−)
expr_2_super_fatal_result : Lemma
expr_2_super (fatal_result)(s) = Bottom
% typeabbreviations
ET : TYPE = [State −> ExprResult[State, Data]]
END State_Transformer_Lift_Expr

State_Transformer_Lift_Stmt [State : Type] : THEORY

BEGIN

IMPORTING Transformer_Super_Embedding
s : VAR State
% define liftingfor statements
% "lift"lifts a function"stmt"
% [State −> StmtResult[State]]
% to
% [StmtResult[State] −> StmtResult[State]]

%

% If the argumentis OK, then "stmt"is applied, else "stmt"is skipped. Note
% that inputand outputtypemust be the same.
stmt : VAR [State −> StmtResult[State]]
sres : VAR StmtResult[State]

lift(stmt)(sres) : StmtResult[State] =
CASES sres OF
OK(state) : stmt(state)
ELSE sres

ENDCASES

% "lift_destructor"lifts a function"stmt"
% [State −> StmtResult[State]]
% to
% [StmtResult[State] −> StmtResult[State]]

%

% If the argumentis OK, Break, Continue, or Return, then "stmt"is applied,
% else "stmt"is skipped. If "stmt"returnsan OK state, the previousresult
% constructor(Break/Continue/Return) is then used to replacethe OK
% constructor. (Usefulfor C++ destructors, whichmay need to be called
% after a break/continue/returnstatement.) Note that inputand outputtype
% must be the same.
% TODO: what about exceptions?
lift_destructor(stmt)(sres) : StmtResult[State] =
CASES sres OF
OK(state) : stmt(state),
Break(state) :
CASES stmt(state) OF
OK(newstate) : Break(newstate)
ELSE stmt(state)
ENDCASES,
Continue(state) :
CASES stmt(state) OF
OK(newstate) : Continue(newstate)
ELSE stmt(state)
ENDCASES,
Return(state) :
CASES stmt(state) OF
OK(newstate) : Return(newstate)
ELSE stmt(state)

ENDCASES

ELSE sres

ENDCASES

% switchresults
switch_result(n : int)(s) : StmtResult[State] =
Switch(s, n)
default_result(s) : StmtResult[State] =
Default(s)
hang_result(s) : StmtResult[State] =

Hang

return_result(s) : StmtResult[State] =

B PVS Theory Sources

Return(s)
% typeabbreviations
ST : TYPE = [State −> StmtResult[State]]
END State_Transformer_Lift_Stmt
State_Transformer_Lift: THEORY

BEGIN

IMPORTING State_Transformer_Lift_Expr , State_Transformer_Lift_Stmt
END State_Transformer_Lift
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% Compositionof Statementsand Expressions

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% The compositionoperator## willbe heavilyoverloaded.
% we artificiallysplitthe differentdefinitionsinto
% severaltheories, such that eg show−expanded−sequent will
% tell whichof the many## has been used.
Composition_Simple_Statement_Simple_Statement [State : Type] : THEORY

BEGIN

IMPORTING State_Transformer_Lift
s : VAR State
stmt_1: VAR [State −> StmtResult[State]]
stmt_2: VAR [State −> StmtResult[State]]
% Note that ## is left−associative, whichis importantin cases like
% (s1 ## s2) ## catch_continue
% vs.
% s1 ## (s2 ## catch_continue)
% where the treatmentof a "Continue"raisedin s1 dependson the
% parentheses!
##(stmt_1, stmt_2)(s) : StmtResult[State] =
lift(stmt_2)(stmt_1(s))
END Composition_Simple_Statement_Simple_Statement
Composition_Simple_Statement_Lifted_Statement [State : Type] : THEORY

BEGIN

IMPORTING StmtResult
s : VAR State
stmt_1: VAR [State −> StmtResult[State]]
lift_stmt_2: VAR [StmtResult[State] −> StmtResult[State]]
% Example: whilebody## catch_continue
##(stmt_1, lift_stmt_2 )(s) : StmtResult[State] =
lift_stmt_2 (stmt_1(s))
END Composition_Simple_Statement_Lifted_Statement

Composition_Lifted_Statement_Simple_Statement [State : Type] : THEORY

BEGIN

IMPORTING State_Transformer_Lift
sres : VAR StmtResult[State]
lift_stmt_1: VAR [StmtResult[State] −> StmtResult[State]]
stmt_2: VAR [State −> StmtResult[State]]
% Example: (case 1) ## (if ...)
##(lift_stmt_1 , stmt_2)(sres) : StmtResult[State] =
lift(stmt_2)(lift_stmt_1 (sres))
END Composition_Lifted_Statement_Simple_Statement

Composition_Lifted_Statement_Lifted_Statement [State : Type] : THEORY

BEGIN

IMPORTING StmtResult
sres : VAR StmtResult[State]
lift_stmt_1: VAR [StmtResult[State] −> StmtResult[State]]
lift_stmt_2: VAR [StmtResult[State] −> StmtResult[State]]
% Example: ((case 1) ## ... ) ## (case 2)
##(lift_stmt_1 , lift_stmt_2 )(sres) : StmtResult[State] =
lift_stmt_2 (lift_stmt_1 (sres))
END Composition_Lifted_Statement_Lifted_Statement

Composition_Simple_Expression_Data_Expression [State, Data1, Data2 : Type] :

THEORY BEGIN

IMPORTING Transformer_Super_Embedding
s : VAR State

expr : VAR [State −> ExprResult[State, Data1]]
fexpr : VAR [Data1 −> [State −> ExprResult[State, Data2]]]
% expression## (lambdadata: expression)
##(expr, fexpr)(s) : ExprResult[State, Data2] =
CASES expr(s) OF
OK(state, data) : fexpr(data)(state),
Exception(ex_type, state) : Exception(ex_type, state),
Fatal : Fatal,
Hang : Hang
% TODO: other expressionresults?

ENDCASES

% super_comp_expr_expr_TCC1
% super_comp_expr_expr_TCC1
% proof status:−)
% super_comp_expr_expr_TCC1 : TCCObligation
% proof status:−)
% super_comp_expr_expr_TCC2 : TCCObligation
% proof status:−)
super_comp_expr_expr : Lemma
expr_2_super (expr ## fexpr)(s) =
CASES expr_2_super (expr)(s) OF
OK(state) : expr_2_super (fexpr(data(expr(s))))
(state(expr_2_super (expr)(s)))
ELSE expr_2_super (expr)(s)

ENDCASES

% deprecatednow, but kept for compatibility
eval_if_ok (expr, fexpr) : MACRO [State −> ExprResult[State, Data2]] =
(expr ## fexpr)
END Composition_Simple_Expression_Data_Expression

Composition_Simple_Expression_Simple_Expression [State, Data1, Data2 : Type] :

THEORY BEGIN

IMPORTING Composition_Simple_Expression_Data_Expression
s : VAR State
expr1 : VAR [State −> ExprResult[State, Data1]]
expr2 : VAR [State −> ExprResult[State, Data2]]
% expression## expression(forgetfulcomposition)

##(expr1, expr2)(s) : ExprResult[State, Data2] =
(expr1 ## (lambda (d : Data1): expr2))(s)
% proof status:−)
comp_expr_forget_expr : LEMMA
(expr1 ## expr2)(s) =
CASES expr1(s) OF
OK(state, data) : expr2(state),
Exception(ex_type, state) : Exception(ex_type, state),
Fatal : Fatal,
Hang : Hang
% TODO: other expressionresults?

ENDCASES

% proof status:−)
super_comp_expr_forget_expr : LEMMA
expr_2_super (expr1 ## expr2)(s) =
CASES expr_2_super (expr1)(s) OF
OK(state) : expr_2_super (expr2)(state)
ELSE expr_2_super (expr1)(s)

ENDCASES

% proof status:−)
% comp_simple_expr_simple_expr_TCC1 : TCCObligation
% proof status:−)
comp_simple_expr_simple_expr : Lemma
OK?(expr1(s)) Implies
expr2(state(expr1(s))) = (expr1 ## expr2)(s)
% proof status:−)
% comp_simple_expr_simple_expr_ok_TCC1 : TCCObligation
% proof status:−)
comp_simple_expr_simple_expr_ok : Lemma
OK?((expr1 ## expr2)(s)) Implies
OK?(expr2(state(expr1(s))))
% proof status:−)
% comp_simple_expr_simple_expr_data_TCC1 : TCCObligation
% proof status:−)
comp_simple_expr_simple_expr_data : Lemma
OK?((expr1 ## expr2)(s)) Implies
data(expr2(state(expr1(s)))) = data((expr1 ## expr2)(s))
% proof status:−)
% comp_simple_expr_simple_expr_state_TCC1 : TCCObligation
% proof status:−)
comp_simple_expr_simple_expr_state : Lemma
OK?((expr1 ## expr2)(s)) Implies

state(expr2(state(expr1(s)))) = state((expr1 ## expr2)(s))
END Composition_Simple_Expression_Simple_Expression

Composition_Simple_Expression_Data_Statement [State, Data : Type] :

THEORY BEGIN

IMPORTING ExprResult, StmtResult
s : VAR State
expr : VAR [State −> ExprResult[State, Data]]
fstmt : VAR [Data −> [State −> StmtResult[State]]]
% expression## (lambdadata: statement)
##(expr, fstmt)(s) : StmtResult[State] =
CASES expr(s) OF
OK(state, data) : fstmt(data)(state),
Exception(ex_type, state) : Exception(ex_type, state),
Fatal : Fatal,
Hang : Hang
% TODO: other expressionresults?

ENDCASES

END Composition_Simple_Expression_Data_Statement

Composition_Simple_Statement_Simple_Expression [State, Data : Type] :

THEORY BEGIN

IMPORTING StmtResult, ExprResult
s : VAR State
stmt : VAR [State −> StmtResult[State]]
expr : VAR [State −> ExprResult[State, Data]]
% define liftingfor expressions
sres : VAR StmtResult[State]
lift(expr)(sres) : ExprResult[State, Data] =
CASES sres OF
OK(state) : expr(state),
Hang : Hang,
Exception(ex_type, state) : Exception(ex_type, state)

ELSE Fatal

ENDCASES;

% Example: stmt ## read_data(...)
##(stmt, expr)(s) : ExprResult[State, Data] =
lift(expr)(stmt(s))
% useful for Hoare logic, to appendexpressionsin the postcondition
% (e.g. read_data(...)) to the program
% comp_simple_stmt_simple_expr_TCC1
% proof status:−)
% comp_simple_stmt_simple_expr_TCC1 : TCCObligation
% proof status:−)
comp_simple_stmt_simple_expr : LEMMA
OK?(stmt(s)) implies
expr(state(stmt(s))) = (stmt ## expr)(s)
% proof status:−)
% comp_simple_stmt_simple_expr_ok_TCC1 : TCCObligation
% proof status:−)
comp_simple_stmt_simple_expr_ok : Lemma
OK?((stmt ## expr)(s)) Implies
OK?(expr(state(stmt(s))))
% proof status:−)
% comp_simple_stmt_simple_expr_data_TCC1 : TCCObligation
% proof status:−)
comp_simple_stmt_simple_expr_data : Lemma
OK?((stmt ## expr)(s)) Implies
data(expr(state(stmt(s)))) = data((stmt ## expr)(s))
% proof status:−)
% comp_simple_stmt_simple_expr_state_TCC1 : TCCObligation
% proof status:−)
comp_simple_stmt_simple_expr_state : Lemma
OK?((stmt ## expr)(s)) Implies
state(expr(state(stmt(s)))) = state((stmt ## expr)(s))
END Composition_Simple_Statement_Simple_Expression

Composition_Simple_Statement_Lifted_Expression [State, Data : Type] :

THEORY BEGIN

IMPORTING StmtResult, ExprResult
s : VAR State
stmt : VAR [State −> StmtResult[State]]

lift_expr: VAR [StmtResult[State] −> ExprResult[State, Data]]
% Example: function_body## catch_return
##(stmt, lift_expr)(s) : ExprResult[State, Data] =
lift_expr(stmt(s))
END Composition_Simple_Statement_Lifted_Expression

Composition_Lifted_Statement_Simple_Expression [State, Data : Type] :

THEORY BEGIN

IMPORTING Composition_Simple_Statement_Simple_Expression
sres : VAR StmtResult[State]
lift_stmt_1: VAR [StmtResult[State] −> StmtResult[State]]
expr_2: VAR [State −> ExprResult[State, Data]]
##(lift_stmt_1 , expr_2)(sres) : ExprResult[State, Data] =
lift(expr_2)(lift_stmt_1 (sres))
END Composition_Lifted_Statement_Simple_Expression

Composition_Lifted_Statement_Lifted_Expression [State, Data : Type] :

THEORY BEGIN

IMPORTING Composition_Simple_Statement_Simple_Expression
sres : VAR StmtResult[State]
lift_stmt: VAR [StmtResult[State] −> StmtResult[State]]
lift_expr: VAR [StmtResult[State] −> ExprResult[State, Data]]
##(lift_stmt, lift_expr)(sres) : ExprResult[State, Data] =
lift_expr(lift_stmt(sres))
END Composition_Lifted_Statement_Lifted_Expression

Statement_Composition_Rewrites [State: Type] : THEORY

BEGIN

IMPORTING Composition_Simple_Statement_Simple_Statement ,

Composition_Simple_Statement_Lifted_Statement

,

Composition_Lifted_Statement_Simple_Statement

,

Composition_Lifted_Statement_Lifted_Statement

s : VAR State
sres : VAR StmtResult[State]
stmt_1: VAR [State −> StmtResult[State]]

stmt_2: Var [State −> StmtResult[State]]
stmt_3: Var [State −> StmtResult[State]]
lift_stmt_1: VAR [StmtResult[State] −> StmtResult[State]]
lift_stmt_2: VAR [StmtResult[State] −> StmtResult[State]]
lift_stmt_3: VAR [StmtResult[State] −> StmtResult[State]]
% Forsymbolicevaluation, we want a compositionoperatorthat associates
% to the right: e.g.
% ((s1 ## s2) ## catch_continue)(s)
% must be rewrittento
% (s1 ## (lift(s2) ## catch_continue))(s)
% before evaluationcan be performed, startingwiths1.

%

% With3 statements, each one eitherliftedor not, there are 8 cases to
% consider.

%

% Essentially: when stmt_2is not lifted, but stmt_3is, then stmt_2must be
% lifted.
% proof status:−)
composition_assoc_rewrite_1 : LEMMA
(stmt_1## (stmt_2## stmt_3)) =
((stmt_1## stmt_2) ## stmt_3)
% proof status:−)
composition_assoc_rewrite_2 : LEMMA
(stmt_1## (lift(stmt_2) ## lift_stmt_3 )) =
((stmt_1## stmt_2) ## lift_stmt_3 )
% proof status:−)
composition_assoc_rewrite_3 : LEMMA
(stmt_1## (lift_stmt_2## stmt_3)) =
((stmt_1## lift_stmt_2 ) ## stmt_3)
% proof status:−)
composition_assoc_rewrite_4 : LEMMA
(stmt_1## (lift_stmt_2## lift_stmt_3 )) =
((stmt_1## lift_stmt_2 ) ## lift_stmt_3 )
% proof status:−)
composition_assoc_rewrite_5 : LEMMA
(lift_stmt_1## (stmt_2## stmt_3)) =
((lift_stmt_1## stmt_2) ## stmt_3)
% proof status:−)
composition_assoc_rewrite_6 : LEMMA
equalities[[StmtResult[State] −> StmtResult[State]]].= (
(lift_stmt_1## (lift(stmt_2) ## lift_stmt_3 )),
((lift_stmt_1## stmt_2) ## lift_stmt_3 ))
% proof status:−)
composition_assoc_rewrite_7 : LEMMA

(lift_stmt_1## (lift_stmt_2## stmt_3)) =
((lift_stmt_1## lift_stmt_2 ) ## stmt_3)
% proof status:−)
composition_assoc_rewrite_8 : LEMMA
equalities[[StmtResult[State] −> StmtResult[State]]].= (
(lift_stmt_1## (lift_stmt_2## lift_stmt_3 )),
((lift_stmt_1## lift_stmt_2 ) ## lift_stmt_3 ))
END Statement_Composition_Rewrites

Expression_Composition_Rewrites [State, Data1, Data2 : Type] : THEORY

BEGIN

IMPORTING Composition_Simple_Expression_Simple_Expression
s : VAR State
expr : VAR [State −> ExprResult[State, Data1]]
fexpr : VAR [Data1 −> [State −> ExprResult[State, Data2]]]
% proof status:−)
comp_eval_if_ok_fexpr : LEMMA
OK?(expr(s)) implies
(expr ## fexpr)(s) = (expr ## fexpr(data(expr(s))))(s)
END Expression_Composition_Rewrites

Ok_Result_Rewrite [State, Data1, Data2 : Type] : Theory

Begin

Importing State_Transformer_Lift ,

Composition_Simple_Expression_Data_Statement

,

Expression_Composition_Rewrites

,

Composition_Lifted_Statement_Simple_Expression

s : Var State
data : Var Data1
data2 : Var Data2
q : Var [State −> ExprResult[State, Data2]]
states : Var PRED[State]

% ok_result
% −−−−−−−−−−−
% proof status:−)
ok_result_q_ok : Lemma
OK?[State, Data1]((q ## ok_result(data))(s)) = OK?(q(s))
% proof status:−)

% ok_result_q_state_TCC1 : TCCObligation
% proof status:−)
% ok_result_q_state_TCC2 : TCCObligation
% proof status:−)
ok_result_q_state : Lemma
OK?(q(s)) Implies
state[State, Data1]((q ## ok_result(data))(s)) = state(q(s))
% proof status:−)
% ok_result_q_data_TCC1 : TCCObligation
% proof status:−)
ok_result_q_data : Lemma
OK?(q(s)) Implies
data((q ## ok_result(data))(s)) = data
% proof status:−)
ok_result_elemination_1 : Lemma
(ok_result[State, Data1](data) ## q) = q
End Ok_Result_Rewrite

Transformer_Invariant[State : Type] : Theory

Begin

IMPORTING Super_Result_Util
transformers : Var PRED[[State −> SuperResult[State]]]
states : Var PRED[State]

% proof status:−)
% result_pred_TCC1: TCCObligation
result_pred(states) : PRED[SuperResult[State]] =
Lambda(res : SuperResult[State]) :
has_next_state (res) Implies states(state(res))
% invariantsfor state transformers
transformer_invariant?(states, transformers) : bool =
Forall(s : State, q : [State −> SuperResult[State]]) :
states(s) AND transformers(q) IMPLIES
result_pred(states)(q(s))
% proof status:−)
% super_transformer_invariant_next_ok_TCC1 : TCCObligation
% invariantlemma
% proof status:−)
super_transformer_invariant_next_ok : Lemma

Forall(s : State, q : [State −> SuperResult[State]]) :
transformer_invariant?(states, transformers) AND
states(s) AND transformers(q) AND
has_next_state (q(s))

IMPLIES

states(state(q(s)))
% Monotonicity
% proof status:−)
transformer_invariant_mono_transformers : Lemma
Forall(transformers_1, transformers_2:
PRED[[State −> SuperResult[State]]]) :
subset?(transformers_1, transformers_2) AND
transformer_invariant?(states, transformers_2)

IMPLIES

transformer_invariant?(states, transformers_1)
% unionof transformers
% proof status:−)
transformer_invariant_union_transformers : Lemma
Forall(transformers_1, transformers_2:
PRED[[State −> SuperResult[State]]]) :
transformer_invariant?(states, transformers_1) AND
transformer_invariant?(states, transformers_2)

IMPLIES

transformer_invariant?(states, union(transformers_1, transformers_2))

% the full set is alwaysan invariant
% proof status:−)
transformer_invariant_truth: Lemma
transformer_invariant?(fullset[State], transformers)
% proof status:−)
transformer_invariant_all_transformers : Lemma
(Forall (q : [State −> SuperResult[State]]) : transformers(q) Implies
transformer_invariant?(states, singleton(q)))

Implies

transformer_invariant?(states, transformers)
% all transformersreturnOK
transformers_ok?(states, transformers) : bool =
Forall(s : State, q : [State −> SuperResult[State]]) :
states(s) AND transformers(q)

IMPLIES

OK?(q(s))
% access lemma
% proof status:−)
super_transformers_ok_ok : Lemma
Forall(s : State, q : [State −> SuperResult[State]]) :
transformers_ok?(states, transformers) AND

states(s) AND transformers(q) IMPLIES
OK?(q(s))
% Monotonicity
% proof status:−)
transformers_ok_mono_transformers : Lemma
Forall(transformers_1, transformers_2:
PRED[[State −> SuperResult[State]]]) :
subset?(transformers_1, transformers_2) AND
transformers_ok?(states, transformers_2)

IMPLIES

transformers_ok?(states, transformers_1)
% proof status:−)
transformers_ok_mono_states : Lemma
Forall(states_1, states_2: PRED[State]) :
subset?(states_1, states_2) AND
transformers_ok?(states_2, transformers)

IMPLIES

transformers_ok?(states_1, transformers)
% lemmafor union
% proof status:−)
transformers_ok_union_transformers : Lemma
Forall(transformers_1, transformers_2:
PRED[[State −> SuperResult[State]]]) :
transformers_ok?(states, transformers_1) AND
transformers_ok?(states, transformers_2)

IMPLIES

transformers_ok?(states, union(transformers_1, transformers_2))
% proof status:−)
transformers_ok_all_transformers : Lemma
(Forall (q : [State −> SuperResult[State]]) : transformers(q) Implies
transformers_ok?(states, singleton(q)))

Implies

transformers_ok?(states, transformers)

End Transformer_Invariant

Transformer_Invariant_2 [State, Data : Type] : Theory
% expresssome of above lemmasfor non−supertransformers

Begin

Importing Transformer_Invariant, Transformer_Super_Embedding
transformers : Var PRED[[State −> SuperResult[State]]]
states : Var PRED[State]
% proof status:−)
% expr_transformer_invariant_next_ok_TCC1 : TCCObligation

% proof status:−)
expr_transformer_invariant_next_ok : Lemma
Forall(s : State, q : [State −> ExprResult[State, Data]]) :
transformer_invariant?(states, transformers) AND
states(s) AND transformers(expr_2_super (q)) AND
has_next_state (q(s))

IMPLIES

states(state(q(s)))

% proof status:−)
expr_transformers_ok_ok : Lemma
Forall(s : State, q : [State −> ExprResult[State, Data]]) :
transformers_ok?(states, transformers) AND
states(s) AND transformers(expr_2_super (q)) IMPLIES
OK?(q(s))
% proof status:−)
% expr_result_pred_next_state_TCC1 : TCCObligation
% proof status:−)
expr_result_pred_next_state : Lemma
Forall(s : State, q : [State −> ExprResult[State, Data]]) :
has_next_state (q(s)) And
result_pred(states)(expr_2_super (q)(s)) Implies
states(state(q(s)))
End Transformer_Invariant_2

Transformer_Invariant_3 [State, Data1, Data2 : Type] : Theory

Begin

Importing Transformer_Invariant_2 , Expression_Composition_Rewrites
states : Var PRED[State]
expr1 : Var [State −> ExprResult[State, Data1]]
expr2 : Var [State −> ExprResult[State, Data2]]
fexpr : Var [Data1 −> [State −> ExprResult[State, Data2]]]
% proof status:−)
fexpr_composition_transformers_ok : Lemma
Forall (P : PRED[Data1]) :
transformers_ok?(states, singleton(expr_2_super (expr1))) And
transformer_invariant?(states, singleton(expr_2_super (expr1))) And
(Forall (s : (states)) : OK?(expr1(s)) Implies P(data(expr1(s)))) And
(Forall (d : (P)) : transformers_ok?(states, singleton(expr_2_super (fexpr(d)))))

Implies

transformers_ok?(states, singleton(expr_2_super (expr1 ## fexpr)))
% proof status:−)

expr_composition_transformers_ok : Lemma
transformers_ok?(states, singleton(expr_2_super (expr1))) And
transformer_invariant?(states, singleton(expr_2_super (expr1))) And
transformers_ok?(states, singleton(expr_2_super (expr2)))

Implies

transformers_ok?(states, singleton(expr_2_super (expr1 ## expr2)))
% proof status:−)
fexpr_composition_transformer_invariant : Lemma
Forall (P : PRED[Data1]) :
transformer_invariant?(states, singleton(expr_2_super (expr1))) And
(Forall (s : (states)) : OK?(expr1(s)) Implies P(data(expr1(s)))) And
(Forall (d : (P)) : transformer_invariant?(states, singleton(expr_2_super (fexpr(d)))))

Implies

transformer_invariant?(states, singleton(expr_2_super (expr1 ## fexpr)))
% proof status:−)
expr_composition_transformer_invariant : Lemma
transformer_invariant?(states, singleton(expr_2_super (expr1))) And
transformer_invariant?(states, singleton(expr_2_super (expr2)))

Implies

transformer_invariant?(states, singleton(expr_2_super (expr1 ## expr2)))
End Transformer_Invariant_3

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% State_Transformer: importseverything

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
State_Transformer: Theory

BEGIN

IMPORTING

% Transformer_Super_Embedding ,
% State_Transformer_Lift ,
% Composition_Simple_Statement_Simple_Statement ,
% Composition_Simple_Statement_Lifted_Statement ,
% Composition_Lifted_Statement_Simple_Statement ,
% Composition_Lifted_Statement_Lifted_Statement ,
% Composition_Simple_Expression_Data_Expression ,
% Composition_Simple_Expression_Simple_Expression ,
% Composition_Simple_Expression_Data_Statement ,
% Composition_Simple_Statement_Simple_Expression ,

Composition_Simple_Statement_Lifted_Expression

,

Composition_Lifted_Statement_Lifted_Expression

,

Statement_Composition_Rewrites

,

% Expression_Composition_Rewrites ,

Ok_Result_Rewrite

,

% Make_Transformer ,

% Transformer_Invariant ,
% Transformer_Invariant_2 ,

Transformer_Invariant_3

END State_Transformer

B.32 types.pvs

% $Id: types.pvs,v 1.16.4.2.2.4.2.4 2008/05/14 14:25:01 tews Exp$

%

% Author: TjarkWeber; HendrikTews; MarcusVölpet al.
% (c) 2007 RadboudUniversity

%

% A formalizationof C++ types.
% Section numbersin commentsthroughoutthis file refer to
% "Programminglanguages− C++", ISO/IEC14882:1998(E)

% Open Issues/ To Do
% =====================
% Open issue: can we reap benefitfrom this?
% 3.9.1 pt 7 representationof valueof integralthroughpure binarysystem
% integralvalue= Sum (0 <= p <(?=) n) b[p] ∗ 2^p withbits b[p]

%

% Canwe concludefrom this that the max_value_bitsare the bits in the
% valuerepresentation, or more preciselythat:
% [bits in object representation] >= [bits in valuerepresentation]
% size(uidt(unsigned)) ∗ bits_per_byte>= max_value_bits (unsigned)
% Open issue:
% The underlyingdata model withits to_byte/from_byteencodingfunctions
% does not reallyallowto model individualbits whichare in a type’s
% object representation, but NOT in its valuerepresentation.
% Open issue: const, volatile
% Is it wise to formaliseconst, volatileas Cpp_Type; there seems to be
% no easy way to define that expressionson cv(t) behavelike expressions
% on t. Shouldwe use typ(c, v : bool) instead? Note that this implies
% dt(t) = dt(volatile(t)) and thus that hiddenbits cannot indicatea
% volatileaccess.
% MV: To do:
% − classes are not CVqualifiedby theirmembershowevera cv class
% behavelike all nonstaticmembersbeing cv qualified; use the semantics
% compilerto generateappropriatemembertypes
% − cv(array) = array(cv)
% − cv voidonlyas functionreturnparameter
% − cv functionaffects cv of this => use semanticscompilerto typethis
% => define dt(∗) onlyfor interpretedtypeswithdomain
% Numberx Addressx SemanticsPointer

B.32 types.pvs

% −> generic handlingof dt
% −> generic behaviourof const, volatile
% −> Define CV_Arithmetric
% −> dt_const(t) = dt(t)
% −> dt_volatile(t) = dt(t) exceptfor hiddenbits
% Not modelled(yet):
% − Pointer−to−function
% − const/volatilespecifiers
% − float, double, long double
% − Conversionbetweenintegraltypesand bitsets
% − Conversionbetweenintegraltypesand enumerationtypes
% − wirdkein everymehr für Datentypendefiniert?
% − dt_existsTCCdurchinstanziierungmit konkretemModellbeweisen
% 3.9.1.1: "In any particularimplementation, a plainchar object can
% take on eitherthe same valuesas a signed char or an
% unsignedchar; whichone is implementation−defined."−− We
% take this to also mean that the valuerepresentationis the
% same for char and (either) signed char or unsignedchar. (Why?)
% Todo:
% − shouldwe encode arg_typeas list[Cpp_Type]
% or betteras members, below[members] −> CppType
% − variablearguments
% − semanticcompilergeneratesvar_argsobject to containarguments
% − var_argsobject is passed to function
% − defaultvalues
% − semanticscompilerinitialisesall uninitialisedvalueswithdefaults.
% See abstract_data.pvs for the underlyingdata typemodel.

%

% Namingconventions:
% − theoriesare named"Cpp_< type>",
% − valueranges are named"range(< type>)",
% − data typesare named"dt_< type>",
% where < type> is one of
% − uchar, schar, char,
% − short, int, long, longlong,
% − ushort, uint, ulong, ulonglong,
% − wchar_t,
% − bool,
% − void,
% − pointer,
% − reference.
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% FundamentalTypes

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Deviationsfrom the C++ standard:

%

% The underlyingdata model withits to_byte/from_byteencodingfunctions
% does not reallyallowto model individualbits whichare in a type’s
% object representation, but NOT in its valuerepresentation.
% 3.9.1 pt 1 UnsignedChar
% ==========================
Cpp_uchar: Theory

Begin

Importing finite_sets@finite_sets_minmax [nat, <=], More_More_List_Props
% Alignment
% −−−−−−−−−−−
align_uchar: posnat
% proof status:−)
% range_uchar_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_uchar: non_empty_finite_set [nat]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_uchar)]
dt_uchar_exists: Axiom
Exists (dt : (pod_data_type ?[(range_uchar)])) : true
% proof status:−)
% dt_uchar_TCC1: TCCObligation
dt_uchar: (pod_data_type ?[(range_uchar)])
% 5.3.3 pt 1 "The size_ofoperatoryieldsthe numberof bytesin the object
% representationof its operand."
% "size_of(unsignedchar) [is] 1"
dt_uchar_size: Axiom
size(uidt(dt_uchar)) = 1
% 3.9.1 pt 1: "Forunsignedcharactertypes, all possiblebit patternsof the
% valuerepresentationrepresentnumbers."
% (TODO: Thisseems to follow from the arithmetic−mod−2^n requirement
% (3.9.1 pt 4) already−− maybewe could proveit?!)
dt_uchar_valid: Axiom
Forall (l : list[Byte], a : Address):
length(l) = size(uidt(dt_uchar)) Implies valid?(uidt(dt_uchar))(l, a)

B.32 types.pvs

% Bits in the valuerepresentation
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
max_value_bits_uchar : posnat
% proof status:−)
% value_bitmask_uchar_TCC1 : TCCObligation
% a bitmaskin whichall bits are set that are affected by a bit
% operationon this type
value_bitmask_uchar: {l : list[Byte] | length(l) = size(uidt(dt_uchar))}
% C Standard, 5.2.4.2.1: UCHAR_MAX>= 255 (2^8 − 1)
% 3.9.1 pt 4 "Unsignedintegers[...]shallobey the laws of arithmetic
% modulo2^n where n is the numberof bits in the value
% representation"
min_max_value_bits_uchar : Axiom
max_value_bits_uchar >= 8
% 3.9 p4: "ForPOD types, the valuerepresentationis the set of bits in
% the object representationthat determinesa value[...]"
% 3.9.1 pt1: "Forcharactertypes, all bits of the object representation
% participatein the valuerepresentation."
dt_uchar_bits: Axiom
max_value_bits_uchar = size(uidt(dt_uchar)) ∗ bits_per_byte
% max_value(uchar) >= 255
max_uchar: Axiom
max(range_uchar) >= (2^max_value_bits_uchar ) − 1
% 3.9.1 pt 4 "Unsignedintegers[...]shallobey the laws of arithmetic
% modulo2^n where n is the numberof bits in the value
% representation"
binary_range_uchar: Axiom
Forall (n : nat) :
range_uchar(n) IFF n <= max(range_uchar)
% => max_value_bits (uchar) >= min_bits_per_byte
% => max_value(uchar) = 2^bits_per_byte− 1
End Cpp_uchar
% 3.9.1 pt 1 Signed Char
% ==========================
Cpp_schar: Theory

Begin

Importing Cpp_uchar, finite_sets@finite_sets_minmax [int, <=]

% Alignment
% −−−−−−−−−−−

% 3.9.1 pt 1 alignmentof schar = alignmentof uchar
align_schar: posnat = align_uchar
% proof status:−)
% range_schar_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_schar: non_empty_finite_set [int]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_schar)]
dt_schar_exists: Axiom
Exists (dt : (pod_data_type ?[(range_schar)])) : true
% proof status:−)
% dt_schar_TCC1: TCCObligation
dt_schar: (pod_data_type ?[(range_schar)])
% 3.9.1 pt 1 size_of(schar) = size_of(uchar)
dt_schar_size: Axiom
size(uidt(dt_schar)) = size(uidt(dt_uchar))
% 3.9.1 pt 3 "The range of nonnegativevaluesof a signed integertype
% is the range of the correspondingunsignedintegertype,
% and the valuerepresentationof each corresponding
% signed / unsignedtypeshallbe the same."
schar_nonneg_is_uchar : Axiom
Forall (i : (range_schar)) : i >= 0 Implies range_uchar(i)
% proof status:−)
% schar_value_eq_uchar_value_TCC1 : TCCObligation
schar_value_eq_uchar_value : Axiom
Forall (i : (range_schar), a : Address) : i >= 0 Implies
to_byte(dt_schar)(i, a) = to_byte(dt_uchar)(i, a)
max_value_bits_schar : nat
% proof status:−)
% value_bitmask_schar_TCC1 : TCCObligation
value_bitmask_schar: {l : list[Byte] | length(l) = size(uidt(dt_schar))}
% 3.9 pt 4: "ForPOD types, the valuerepresentationis the set of bits in
% the object representationthat determinesa value[...]"
% 3.9.1 pt 1: "Forcharactertypes, all bits of the object representation
% participatein the valuerepresentation."
% The highestorderbit may howeverencode the sign of the value.

% (footnote 49 3.9.1 pt 7)
dt_schar_bits: Axiom
max_value_bits_schar >= size(uidt(dt_schar)) ∗ bits_per_byte− 1
% C Standard, 5.2.4.2.1: SCHAR_MIN<= −127 (−(2^7 − 1))
% C Standard, 5.2.4.2.1: SCHAR_MAX>= 127 (2^7 − 1)
min_schar: Axiom
min(range_schar) <= −((2 ^max_value_bits_schar ) − 1)
max_schar: Axiom
max(range_schar) >= (2 ^max_value_bits_schar ) − 1
schar_binary: Axiom
Forall (i : int) :
range_schar(i) IFF (min(range_schar) <= i And i <= max(range_schar))
% => min_value(schar) <= −127
% => max_value(schar) >= 127
% => max_value_bits (schar) >= min_bits_per_byte− 1
End Cpp_schar

% 3.9.1 pt 1 Char
% =================
Cpp_char: Theory

Begin

Importing Cpp_schar
% Alignment
% −−−−−−−−−−−
% 3.9.1 pt 1 alignmentof char = alignmentof uchar
align_char: posnat = align_uchar
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_char: non_empty_finite_set [int]
% 3.9.1.1: "In any particularimplementation, a plainchar object can
% take on eitherthe same valuesas a signed char or an
% unsignedchar; whichone is implementation−defined."
char_is_uchar_or_schar : Axiom
range_char= range_scharOR range_char= range_uchar
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_char)]
dt_char_exists: Axiom
Exists (dt : (pod_data_type ?[(range_char)])) : true

% proof status:−)
% dt_char_TCC1: TCCObligation
dt_char: (pod_data_type ?[(range_char)])
% 3.9.1 pt 1 size_of(schar) = size_of(uchar)
dt_char_size: Axiom
size(uidt(dt_char)) = size(uidt(dt_uchar))
max_value_bits_char : nat
% proof status:−)
% value_bitmask_char_TCC1 : TCCObligation
value_bitmask_char: {l : list[Byte] | length(l) = size(uidt(dt_char))}
% 3.9 pt 4: "ForPOD types, the valuerepresentationis the set of bits in
% the object representationthat determinesa value[...]"
% 3.9.1 pt 1: "Forcharactertypes, all bits of the object representation
% participatein the valuerepresentation."
% The highestorderbit may howeverencode the sign of the value.
% (footnote 49 3.9.1 pt 7)
dt_char_bits: Axiom
max_value_bits_char >= size(uidt(dt_char)) ∗ bits_per_byte− 1
% proof status:−)
min_char: Lemma
min(range_char) <= 0
% proof status:−)
max_char: Lemma
max(range_char) >= 127
% proof status:−)
char_binary: Lemma
Forall (i : int) :
range_char(i) IFF (min(range_char) <= i And i <= max(range_char))
End Cpp_char

% 3.9.1 pt 2 Signed Short Int
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−
Cpp_short: Theory

Begin

Importing Cpp_schar, finite_sets@finite_sets_minmax [int, <=]
% Alignment
% −−−−−−−−−−−
align_short: posnat

% proof status:−)
% range_short_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_short: non_empty_finite_set [int]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_short)]
dt_short_exists: Axiom
Exists (dt : (pod_data_type ?[(range_short)])) : true
% proof status:−)
% dt_short_TCC1: TCCObligation
dt_short: (pod_data_type ?[(range_short)])
% 3.9.1.2: "Thereare four signed integertypes: signed char,
% short int, int, and long int. In this list, each type
% providesat least as much storage as those precedingit
% in the list."−− We take this to mean that both the value
% range and the size of the object representationmust not
% be smaller.
dt_short_size: Axiom
size(uidt(dt_short)) >= size(uidt(dt_schar))
short_value_supset_schar_value : Axiom
Forall (i : (range_schar)) : range_short(i)
max_value_bits_short : nat
% proof status:−)
% value_bitmask_short_TCC1 : TCCObligation
value_bitmask_short: {l : list[Byte] | length(l) = size(uidt(dt_short))}
% C Standard, 5.2.4.2.1: SHRT_MIN<= −32767 (−(2^15 − 1))
min_short: Axiom
min(range_short) <= −32767
% C Standard, 5.2.4.2.1: SHRT_MAX>= 32767 (2^15 − 1)
max_short: Axiom
max(range_short) >= 32767
short_binary: Axiom
FORALL(i: int):
range_short(i) IFF (min(range_short) <= i And i <= max(range_short))
End Cpp_short

% 3.9.1 pt 2 Signed Int
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−
Cpp_int: Theory

Begin

Importing Cpp_short, finite_sets@finite_sets_minmax [int, <=]
% Alignment
% −−−−−−−−−−−
align_int: posnat
% proof status:−)
% range_int_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_int: non_empty_finite_set [int]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_int)]
dt_int_exists: Axiom
Exists (dt : (pod_data_type ?[(range_int)])) : true
% proof status:−)
% dt_int_TCC1: TCCObligation
dt_int: (pod_data_type ?[(range_int)])
% 3.9.1.2: "Thereare four signed integertypes: signed char,
% short int, int, and long int. In this list, each type
% providesat least as much storage as those precedingit
% in the list."−− We take this to mean that both the value
% range and the size of the object representationmust not
% be smaller.
dt_int_size: Axiom
size(uidt(dt_int)) >= size(uidt(dt_short))
int_value_supset_short_value : Axiom
Forall (i : (range_short)) : range_int(i)
max_value_bits_int : nat
% proof status:−)
% value_bitmask_int_TCC1 : TCCObligation
value_bitmask_int: {l : list[Byte] | length(l) = size(uidt(dt_int))}
% C Standard, 5.2.4.2.1: INT_MIN<= −32767 (−(2^15 − 1))
min_int: Axiom

min(range_int) <= −32767
% C Standard, 5.2.4.2.1: INT_MAX>= 32767 (2^15 − 1)
max_int: Axiom
max(range_int) >= 32767
int_binary: Axiom
FORALL(i: int):
range_int(i) IFF (min(range_int) <= i And i <= max(range_int))
End Cpp_int

% 3.9.1 pt 2 Signed Long
% −−−−−−−−−−−−−−−−−−−−−−−−
Cpp_long: Theory

Begin

Importing Cpp_int, finite_sets@finite_sets_minmax [int, <=]
% Alignment
% −−−−−−−−−−−
align_long: posnat
% proof status:−)
% range_long_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_long: non_empty_finite_set [int]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_long)]
dt_long_exists: Axiom
Exists (dt : (pod_data_type ?[(range_long)])) : true
% proof status:−)
% dt_long_TCC1: TCCObligation
dt_long: (pod_data_type ?[(range_long)])
% 3.9.1 pt 2: "Thereare four signed integertypes: signed char,
% short int, int, and long int. In this list, each type
% providesat least as much storage as those precedingit
% in the list."−− We take this to mean that both the value
% range and the size of the object representationmust not
% be smaller.
dt_long_size: Axiom
size(uidt(dt_long)) >= size(uidt(dt_int))

long_value_supset_int_value : Axiom
Forall (i : (range_int)) : range_long(i)
max_value_bits_long : nat
% proof status:−)
% value_bitmask_long_TCC1 : TCCObligation
value_bitmask_long: {l : list[Byte] | length(l) = size(uidt(dt_long))}
% C Standard, 5.2.4.2.1: LONG_MIN<= −2147483647 (−(2^31 − 1))
min_long: Axiom
min(range_long) <= −2147483647
% C Standard, 5.2.4.2.1: LONG_MAX>= 2147483647 (2^31 − 1)
max_long: Axiom
max(range_long) >= 2147483647
long_binary: Axiom
FORALL(i: int):
range_long(i) IFF (min(range_long) <= i And i <= max(range_long))
End Cpp_long

% Signed Long Long
% (not in the mentionedversionof the C++ standard)
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
Cpp_longlong: Theory

Begin

Importing Cpp_long, finite_sets@finite_sets_minmax [int, <=]
% Alignment
% −−−−−−−−−−−
align_longlong: posnat
% proof status:−)
% range_longlong_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_longlong: non_empty_finite_set [int]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_longlong)]
dt_longlong_exists: Axiom
Exists (dt : (pod_data_type ?[(range_longlong)])) : true
% proof status:−)

% dt_longlong_TCC1: TCCObligation
dt_longlong: (pod_data_type ?[(range_longlong)])
% Following3.9.1 pt 2 in principlewe define:
dt_longlong_size: Axiom
size(uidt(dt_longlong)) >= size(uidt(dt_long))
longlong_value_supset_long_value : Axiom
Forall (i : (range_long)) : range_longlong(i)
max_value_bits_longlong : nat
% proof status:−)
% value_bitmask_longlong_TCC1 : TCCObligation
value_bitmask_longlong: {l : list[Byte] | length(l) =
size(uidt(dt_longlong))}
% C Standard, 5.2.4.2.1: LLONG_MIN<= −922337203685477807 (−(2^63 − 1))
min_longlong: Axiom
min(range_longlong) <= −922337203685477807
% C Standard, 5.2.4.2.1: LLONG_MAX>= 922337203685477807 (2^63 − 1)
max_longlong: Axiom
max(range_longlong) >= 922337203685477807
longlong_binary: Axiom
FORALL(i: int):
range_longlong(i) IFF
(min(range_longlong) <= i And i <= max(range_longlong))
End Cpp_longlong

% 3.9.1 pt 3 UnsignedShort Integer
% ===================================
Cpp_ushort: Theory

Begin

Importing Cpp_short, finite_sets@finite_sets_minmax [nat, <=]
% Alignment
% −−−−−−−−−−−
% 3.9.1 pt 3 unsignedintegersshallhave the same alignmentas the
% correspondingsigned integer
align_ushort: posnat = align_short
% proof status:−)
% range_ushort_TCC1: TCCObligation
% Rangeof values

% −−−−−−−−−−−−−−−−−
range_ushort: non_empty_finite_set [nat]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_ushort)]
dt_ushort_exists: Axiom
Exists (dt : (pod_data_type ?[(range_ushort)])) : true
% proof status:−)
% dt_ushort_TCC1: TCCObligation
dt_ushort: (pod_data_type ?[(range_ushort)])
% 3.9.1 pt 3 unsignedintegersshallhave the same size as the
% correspondingsigned integer
dt_ushort_size: Axiom
size(uidt(dt_ushort)) = size(uidt(dt_short))
% 3.9.1 pt 3 "The range of nonnegativevaluesof a signed integertypeis a
% subrangeof the correspondingunsignedintegertype, and the
% valuerepresentationof each correspondingsigned / unsigned
% typeshallbe the same."
ushort_value_supset_short_value : Axiom
Forall (i : (range_short)) : i >= 0 Implies range_ushort(i)
% proof status:−)
% ushort_represenation_same_for_positive_short_TCC1 : TCCObligation
ushort_represenation_same_for_positive_short : Axiom
Forall (i : (range_short), a : Address) : i >= 0 Implies
to_byte(dt_ushort)(i, a) = to_byte(dt_short)(i, a)
% Bits in the valuerepresentation
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
max_value_bits_ushort : posnat
% proof status:−)
% value_bitmask_ushort_TCC1 : TCCObligation
value_bitmask_ushort: {l : list[Byte] | length(l) = size(uidt(dt_ushort))}
% C Standard, 5.2.4.2.1: USHRT_MAX>= 65535 (2^16 − 1)
max_ushort_bits: Axiom
max_value_bits_ushort >= 16
% 3.9.1 pt 4 "Unsignedintegers[...]shallobey the laws of arithmetic
% modulo2^n where n is the numberof bits in the value
% representation..."
binary_range_ushort: Axiom
Forall (n : nat) :

range_ushort(n) IFF n <= max(range_ushort)
End Cpp_ushort

% 3.9.1 pt 3 UnsignedInteger
% ===================================
Cpp_uint: Theory

Begin

Importing Cpp_int, finite_sets@finite_sets_minmax [nat, <=]
% Alignment
% −−−−−−−−−−−
% 3.9.1 pt 3 unsignedintegersshallhave the same alignmentas the
% correspondingsigned integer
align_uint: posnat = align_int
% proof status:−)
% range_uint_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_uint: non_empty_finite_set [nat]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_uint)]
dt_uint_exists: Axiom
Exists (dt : (pod_data_type ?[(range_uint)])) : true
% proof status:−)
% dt_uint_TCC1: TCCObligation
dt_uint: (pod_data_type ?[(range_uint)])
% 3.9.1 pt 3 unsignedintegersshallhave the same size as the
% correspondingsigned integer
dt_uint_size: Axiom
size(uidt(dt_uint)) = size(uidt(dt_int))
% 3.9.1 pt 3 "The range of nonnegativevaluesof a signed integertypeis a
% subrangeof the correspondingunsignedintegertype, and the
% valuerepresentationof each correspondingsigned / unsigned
% typeshallbe the same."
uint_value_supset_int_value : Axiom
Forall (i : (range_int)) : i >= 0 Implies range_uint(i)
% proof status:−)
% uint_represenation_same_for_positive_int_TCC1 : TCCObligation

uint_represenation_same_for_positive_int : Axiom
Forall (i : (range_int), a : Address) : i >= 0 Implies
to_byte(dt_uint)(i, a) = to_byte(dt_int)(i, a)
% Bits in the valuerepresentation
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
max_value_bits_uint : posnat
% proof status:−)
% value_bitmask_uint_TCC1 : TCCObligation
value_bitmask_uint: {l : list[Byte] | length(l) = size(uidt(dt_uint))}
% C Standard, 5.2.4.2.1: UINT_MAX>= 65535 (2^16 − 1)
max_uint_bits: Axiom
max_value_bits_uint >= 16
max_uint: Axiom
max(range_uint) >= (2^max_value_bits_uint ) − 1
% 3.9.1 pt 4 "Unsignedintegers[...]shallobey the laws of arithmetic
% modulo2^n where n is the numberof bits in the value
% representation..."
binary_range_uint: Axiom
Forall (n : nat) :
range_uint(n) IFF n <= max(range_uint)
End Cpp_uint

% 3.9.1 pt 3 UnsignedLong
% ==========================
Cpp_ulong: Theory

Begin

Importing Cpp_long, finite_sets@finite_sets_minmax [nat, <=]
% Alignment
% −−−−−−−−−−−
% 3.9.1 pt 3 unsignedintegersshallhave the same alignmentas the
% correspondingsigned integer
align_ulong: posnat = align_long
% proof status:−)
% range_ulong_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_ulong: non_empty_finite_set [nat]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−

Importing Interpreted_Data[(range_ulong)]
dt_ulong_exists: Axiom
Exists (dt : (pod_data_type ?[(range_ulong)])) : true
% proof status:−)
% dt_ulong_TCC1: TCCObligation
dt_ulong: (pod_data_type ?[(range_ulong)])
% 3.9.1 pt 3 unsignedintegersshallhave the same size as the
% correspondingsigned integer
dt_ulong_size: Axiom
size(uidt(dt_ulong)) = size(uidt(dt_long))
% 3.9.1 pt 3 "The range of nonnegativevaluesof a signed integertypeis a
% subrangeof the correspondingunsignedintegertype, and the
% valuerepresentationof each correspondingsigned / unsigned
% typeshallbe the same."
ulong_value_supset_long_value : Axiom
Forall (i : (range_long)) : i >= 0 Implies range_ulong(i)
% proof status:−)
% ulong_represenation_same_for_positive_long_TCC1 : TCCObligation
ulong_represenation_same_for_positive_long : Axiom
Forall (i : (range_long), a : Address) : i >= 0 Implies
to_byte(dt_ulong)(i, a) = to_byte(dt_long)(i, a)
% Bits in the valuerepresentation
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
max_value_bits_ulong : posnat
% proof status:−)
% value_bitmask_ulong_TCC1 : TCCObligation
value_bitmask_ulong: {l : list[Byte] | length(l) = size(uidt(dt_ulong))}
% C Standard, 5.2.4.2.1: ULONG_MAX>= 4294967295 (2^32 − 1)
max_ulong_bits: Axiom
max_value_bits_ulong >= 32
max_ulong: Axiom
max(range_ulong) >= (2^max_value_bits_ulong ) − 1
% 3.9.1 pt 4 "Unsignedintegers[...]shallobey the laws of arithmetic
% modulo2^n where n is the numberof bits in the value
% representation..."
binary_range_ulong: Axiom
Forall (n : nat) :
range_ulong(n) IFF n <= max(range_ulong)

End Cpp_ulong
% 3.9.1 pt 3 UnsignedLong Long
% ===============================
Cpp_ulonglong: Theory

Begin

Importing Cpp_longlong, finite_sets@finite_sets_minmax [nat, <=]
% Alignment
% −−−−−−−−−−−
% 3.9.1 pt 3 unsignedintegersshallhave the same alignmentas the
% correspondingsigned integer
align_ulonglong: posnat = align_longlong
% proof status:−)
% range_ulonglong_TCC1: TCCObligation
% Rangeof values
% −−−−−−−−−−−−−−−−−
range_ulonglong: non_empty_finite_set [nat]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_ulonglong)]
dt_ulonglong_exists: Axiom
Exists (dt : (pod_data_type ?[(range_ulonglong)])) : true
% proof status:−)
% dt_ulonglong_TCC1: TCCObligation
dt_ulonglong: (pod_data_type ?[(range_ulonglong)])
% 3.9.1 pt 3 unsignedintegersshallhave the same size as the
% correspondingsigned integer
dt_ulonglong_size: Axiom
size(uidt(dt_ulonglong)) = size(uidt(dt_longlong))
% 3.9.1 pt 3 "The range of nonnegativevaluesof a signed integertypeis a
% subrangeof the correspondingunsignedintegertype, and the
% valuerepresentationof each correspondingsigned / unsigned
% typeshallbe the same."
ulonglong_value_supset_longlong_value : Axiom
Forall (i : (range_longlong)) : i >= 0 Implies range_ulonglong(i)
% proof status:−)
% ulonglong_represenation_same_for_positive_longlong_TCC1 : TCCObligation
ulonglong_represenation_same_for_positive_longlong : Axiom
Forall (i : (range_longlong), a : Address) : i >= 0 Implies
to_byte(dt_ulonglong)(i, a) = to_byte(dt_longlong)(i, a)

% Bits in the valuerepresentation
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
max_value_bits_ulonglong : posnat
% proof status:−)
% value_bitmask_ulonglong_TCC1 : TCCObligation
value_bitmask_ulonglong: {l : list[Byte] | length(l) =
size(uidt(dt_ulonglong))}
% C Standard, 5.2.4.2.1: ULLONG_MAX>= 18446744073709551615 (2^64 − 1)
max_ulonglong_bits: Axiom
max_value_bits_ulonglong >= 64
max_ulonglong: Axiom
max(range_ulonglong) >= (2^max_value_bits_ulonglong ) − 1
% 3.9.1 pt 4 "Unsignedintegers[...]shallobey the laws of arithmetic
% modulo2^n where n is the numberof bits in the value
% representation..."
binary_range_ulonglong: Axiom
Forall (n : nat) :
range_ulonglong(n) IFF n <= max(range_ulonglong)
End Cpp_ulonglong

% 3.9 pt 8 Float
% ================
Cpp_float: Theory

Begin

Importing Extended_Real
% Alignment
% −−−−−−−−−−−
align_float: posnat
% ValueRange
% −−−−−−−−−−−−−
% subset of numberso that we can eventuallyformalisenot−a−thing
% and +− infinityvalues
% proof status:−)
% range_float_TCC1: TCCObligation
range_float: non_empty_finite_set [extended_real]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_float)]

dt_float_exists: Axiom
Exists (dt_float: (pod_data_type ?[(range_float)])) : True
% proof status:−)
% dt_float_TCC1: TCCObligation
dt_float: (pod_data_type ?[(range_float)])
End Cpp_float
% 3.9 pt 8 Double
% =================
Cpp_double: Theory

Begin

Importing Cpp_float, Extended_Real
% Alignment
% −−−−−−−−−−−
align_double: posnat
% ValueRange
% −−−−−−−−−−−−−
% subset of numberso that we can eventuallyformalisenot−a−thing
% and +− infinityvalues
range_double: non_empty_finite_set [extended_real]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_double)]
dt_double_exists: Axiom
Exists (dt_double: (pod_data_type ?[(range_double)])) : True
% proof status:−)
% dt_double_TCC1: TCCObligation
dt_double: (pod_data_type ?[(range_double)])
% 3.9.1 pt 8 precisionfloat <= double<= long double
% float valuesis subset of doublevaluesis subset of
% long doublevalues
double_precision: Axiom
Forall (f : (range_float)) : real?(f) Implies range_double(f)

End Cpp_double

% 3.9 pt 8 Long Double

% ======================
Cpp_longdouble: Theory

Begin

Importing Cpp_double, Extended_Real
% Alignment
% −−−−−−−−−−−
align_longdouble: posnat
% ValueRange
% −−−−−−−−−−−−−
% subset of numberso that we can eventuallyformalisenot−a−thing
% and +− infinityvalues
range_longdouble: non_empty_finite_set [extended_real]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_longdouble)]
dt_longdouble_exists: Axiom
Exists (dt_longdouble: (pod_data_type ?[(range_longdouble)])) : True
% proof status:−)
% dt_longdouble_TCC1: TCCObligation
dt_longdouble: (pod_data_type ?[(range_longdouble)])
% 3.9.1 pt 8 precisionfloat <= double<= long double
% float valuesis subset of doublevaluesis subset of
% long doublevalues
longdouble_precision: Axiom
Forall (f : (range_double)) : real?(f) Implies range_longdouble(f)
End Cpp_longdouble

% 3.9.1 pt 6 Bool
% =================
Cpp_bool: Theory

Begin

Importing Cpp_Deep_Types
% Alignment
% −−−−−−−−−−−
align_bool: posnat
% !! To do:
% I (Marcus) read the standardas follows; you have bool objects which
% are at least bytealigned. Then there are bitfieldswhere single bits

% can representa bool. The above is onlyfor the objects of typebool.
% Compilersthat pack multiplebools in one bytemake use of bitfields.
% proof status:−)
% range_bool_TCC1: TCCObligation
% ValueRange
% −−−−−−−−−−−−−
range_bool: non_empty_finite_set [bool] = fullset[bool]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[bool]
dt_bool_exists: Axiom
Exists (dt_bool: (pod_data_type ?[bool])) : True
% proof status:−)
% dt_bool_TCC1: TCCObligation
dt_bool: (pod_data_type ?[bool])
% 3.9.1 pt 6 bool
% bool valuesbehavesas integraltype(true < false)
min_value(typ : (bool?)) : bool = true
max_value(typ : (bool?)) : bool = false
End Cpp_bool

% 3.9.1 pt 5 Wchar_t
% ====================
Cpp_wchar_t: Theory

Begin

Importing Cpp_char, Cpp_longlong
% Alignment
% −−−−−−−−−−−
align_wchar_t: posnat
% 3.9.1 pt 5 "Typewchar_tshallhave the same size, signednessand alignment
% requirementsas one other the other integraltypes, calledits
% underlyingtype."
% signed typeshave the same alignmentas theircorrespondingunsignedtypes
wchar_t_alignment: Axiom
align_wchar_t= align_charOr
align_wchar_t= align_shortOr
align_wchar_t= align_intOr
align_wchar_t= align_longOr
align_wchar_t= align_longlong

B.32 types.pvs

% proof status:−)
% range_wchar_t_TCC1: TCCObligation
% ValueRange
% −−−−−−−−−−−−−
range_wchar_t: non_empty_finite_set [int]
% (Un)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−
Importing Interpreted_Data[(range_wchar_t )]
dt_wchar_t_exists : Axiom
Exists (dt_wchar_t: (pod_data_type ?[(range_wchar_t )])) : True
% proof status:−)
% dt_wchar_t_TCC1: TCCObligation
dt_wchar_t: (pod_data_type ?[(range_wchar_t )])
% proof status:−)
% value_bitmask_wchar_t_TCC1 : TCCObligation
value_bitmask_wchar_t : {l : list[Byte] | length(l) = size(uidt(dt_wchar_t ))}
% 3.9.1 pt 5 "Typewchar_tshallhave the same size, signednessand alignment
% requirementsas one other the other integraltypes, calledits
% underlyingtype."
% signed typeshave the same size as theircorrespondingunsignedtypes
dt_wchar_t_size : Axiom
size(uidt(dt_wchar_t )) = size(uidt(dt_char)) Or
size(uidt(dt_wchar_t )) = size(uidt(dt_short)) Or
size(uidt(dt_wchar_t )) = size(uidt(dt_int)) Or
size(uidt(dt_wchar_t )) = size(uidt(dt_long)) Or
size(uidt(dt_wchar_t )) = size(uidt(dt_longlong))
End Cpp_wchar_t
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% A Deep Embeddingof non union; non class C++ Types

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% The primaryuses of the followingdeep embeddingof C++ datatypesare
% − thepolymorphicspecificaitonof expressionson fundamentaltypes,
% − the polymorphicspecificationof pointersand of references

%

% The below deep embeddingdoes not formaliseclass and unionmembersas these
% give rise to unlimitedrecursion. The followingexampleillustratesthis
% recursion:

%

% structA {
% A∗ pt_A;
% };

Cpp_Deep_Types: THEORY

BEGIN

Importing More_List_Props
Access_Specifier: Type = {public, private, protected}
Cpp_Type_: DATATYPE

BEGIN

% fundamentaltypes(3.9.1)
% −−−−−−−−−−−−−−−−−−−−−−−−−−−
uchar : uchar?
schar : schar?
char : char?
short : short?
int : int?
long : long?
longlong : longlong?
ushort : ushort?
uint : uint?
ulong : ulong?
ulonglong : ulonglong?
wchar_t: wchar_t?
bool : bool?
float : float?
double : double?
longdouble : longdouble?
void : void?
% compoundtypes(3.9.2)
% −−−−−−−−−−−−−−−−−−−−−−−−
% arraytypes(8.3.4)
% 8.3.4 pt 1 [...]If the constant−expressionis present, it shallbe an
% integralconstantexpressionand its valueshallbe greater
% than zero. [...])
% Thus, it is possibleto encode arraysof unknownsize as arraysof size 0
array_type(typ : Cpp_Type_, size : nat) : array?
% functiontypes(8.3.5)
function_type(ret_typ: Cpp_Type_,
args_typ: list[Cpp_Type_],

var_args: bool) : function?
% member_function: bool) : function?
% pointertypes(8.3.1)
pointer(typ : Cpp_Type_) : pointer?
% referencetypes(8.3.2)
reference(typ : Cpp_Type_) : reference?
% classes (clause 9)
class(name : string,
abstract : bool) : class?
% unions(9.5)
union(name : string) : union?
% members: posnat,
% mutable: [below[members] −> bool],
% access_spec: [below[members] −> Access_Specifier]) : union?
% 3.9.2 pt 1. static members
% "Static class membersare objects or functions, and pointersto them
% are ordinarypointersto objects or functions"
% => Static membersare allocatedat an object−independentaddress.
% Thus, there is no need to includestatic membersinto the deep
% embeddingof classes and unions

% Bit fieldsare addressedrelativeto an allocationunit. An Address
% (e.g., a const referenceto a bit field) identifiesthis allocationunit,
% the bit_offsetaddressesthe firstbits withinthis allocationunitand
% the bit_sizethe size of the bitfield. Therefore, size(uidt(dt_bitf))
% correspondsto the size of the allocationunit. We modifya bitfieldby
% readingits allocationunit, settingthe modifiedbits (as determinedby
% the mask obtainedfrom to_byte(dt_bitf) and by writingthe allocation
% unit. Readingand writingof the allocationunitis by read list; reading
% may be omittedif the mask modifiesall bits in the allocationunit.
% Allocationunitsmay overlap. We translateunnamedbit fieldsand padding
% into "holes"in the respectiveallocationunits.
% bit field (9.6)
bitfield (typ : Cpp_Type_, % integralor enum
bit_offset: nat, bit_size: posnat) : bitfield?
% enumerations(7.2)
enum(name : string,
typ : Cpp_Type_, % integral
members : posnat,
constant_value: [below[members] −> int]) : enum?
% proof status:−)
% Cpp_Type__pointer_to_member_eta_TCC1 : TCCObligation

% proof status:−)
% Cpp_Type__pointer_to_member_eta_TCC2 : TCCObligation
% proof status:−)
% Cpp_Type__typ_pointer_to_member_TCC1 : TCCObligation
% pointer−to−member(8.3.3)
pointer_to_member (typ : (class?),
member_typ: Cpp_Type_) : pointer_to_member ?
% CVqualifiers(3.9.3)
% −−−−−−−−−−−−−−−−−−−−−−−
% 3.9.3 pt 1 const and volatilequalifiedtypesdefine distinctC++ types
% ...
const (typ : Cpp_Type_) : const? % not class, union, arrayor
% function
volatile (typ : Cpp_Type_) : volatile? % −> semanticcompilersets cv
% for memberaccesses from
% withina cv function
END Cpp_Type_
% Propertiesof the subtermrelation
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
% proof status:−)
subterm_less: Lemma
Forall (t1, t2 : Cpp_Type_) :
subterm(t1, t2) And t1 /= t2 Implies t1 << t2
% proof status:−)
subterm_transitive: Lemma
Forall (t1, t2, t3 : Cpp_Type_) :
subterm(t1, t2) And subterm(t2, t3) Implies subterm(t1, t3)
% Classificationof Types
% =========================
% proof status:−)
% c_TCC1: TCCObligation
% a possiblycv qualifiedtype
c(p : PRED[Cpp_Type_])(typ : Cpp_Type_) : bool =
p(typ) Or (const?(typ) And p(typ(typ)))
% proof status:−)
% v_TCC1: TCCObligation
v(p : PRED[Cpp_Type_])(typ : Cpp_Type_) : bool =
p(typ) Or (volatile?(typ) And p(typ(typ)))
% proof status:−)
% cv_TCC1: TCCObligation

% proof status:−)
% cv_TCC2: TCCObligation
cv(p : PRED[Cpp_Type_])(typ : Cpp_Type_) : bool =
c(p)(typ) Or v(p)(typ) Or
(const?(typ) And volatile?(typ(typ)) And p(typ(typ(typ))))
% proof status:−)
cv_implied: Lemma
Forall (p1, p2 : PRED[Cpp_Type_], typ : Cpp_Type_) :
subset?(p1, p2) And cv(p1)(typ) Implies cv(p2)(typ)
% incompletetypes(3.9 pt 6)
incomplete_type?(typ : Cpp_Type_) : bool =
% a class may become completewhilethe typeremainsthe same
% (class?(typ) Andsize(typ) = 0) Or
(array?(typ) And size(typ) = 0) Or
void?(typ)
% object_types(3.9 pt 9)
object_type?(typ : Cpp_Type_) : bool =
Not cv(function?)(typ) And Not cv(reference?)(typ) And Not cv(void?)(typ)
% FundamentalTypes
% −−−−−−−−−−−−−−−−−−−
% signed integertypes(3.9.1 pt 2)
signed_integer?(typ : Cpp_Type_) : bool =
schar?(typ) Or short?(typ) Or int?(typ) Or long?(typ) Or longlong?(typ)
% unsignedintegertypes(3.9.1 pt 3)
unsigned_integer?(typ : Cpp_Type_) : bool =
uchar?(typ) Or ushort?(typ) or uint?(typ) or ulong?(typ) or ulonglong?(typ)
% integraltypes(3.9.1 pt 7)
% we handlebool separatelybecause the standarddefinesseveral
% specialcases for bool expressions.
non_bool_integral ?(typ : Cpp_Type_) : bool =
char?(typ) Or wchar_t?(typ) Or
signed_integer?(typ) Or unsigned_integer?(typ)
integral?(typ : Cpp_Type_) : bool =
bool?(typ) Or non_bool_integral ?(typ)
% floatingpointtypes(3.9.1 pt 8)
floating_point?(typ : Cpp_Type_) : bool =
float?(typ) Or double?(typ) Or longdouble?(typ)
% arithmetictypes(3.9.1 pt 8)
arithmetic?(typ : Cpp_Type_) : bool =
integral?(typ) Or floating_point?(typ)

fundamental?(typ : Cpp_Type_) : bool =
arithmetic?(typ) Or void?(typ)
% scalartypes(3.9 p10)
scalar?(typ : Cpp_Type_) : bool =
arithmetic?(typ) Or enum?(typ) Or
pointer?(typ) Or pointer_to_member ?(typ)
% pod stuct / uniontypes(3.9 pt 10)
pod_struct?(typ : (class?)) : bool
pod_union?(typ : (class?)) : bool
% proof status:−)
% pod?_TCC1: TCCObligation
% pod types(3.9 pt 10)
pod?(t : Cpp_Type_) : bool =
scalar?(t) Or
(class?(t) And (pod_struct?(t) Or pod_union?(t))) Or
(array?(t) And (scalar?(typ(t)) Or
(class?(typ(t)) Implies (pod_struct?(typ(t)) Or pod_union?(typ(t))))))
% FurtherClassifications
% −−−−−−−−−−−−−−−−−−−−−−−−−
non_bool_integral_enum ?(t : Cpp_Type_) : bool =
non_bool_integral ?(t) Or enum?(t)
% cpp typesfor whichwe define an interpreteddata type
% − void, functions, arrays, classes and unionsremainuninterpreted
interpreted?(t : Cpp_Type_) : bool =
scalar?(t) Or reference?(t) Or bitfield?(t)
% Rangeof Values
% =================
% We use the PVS typenumber(more preciselypredicatesof this type)
% to encode the valuerange of fundamentaltypes. Realsdo not suffice
% because bool is an integraltypeand we do not want to define
% a real constantfor true and false and because floatingpointtypes
% may encode positiveand negativeinfinityand not−a−thingvalues
% 3.9.1 pt 9 void
range_void: finite_set[int] = emptyset[int]
Importing Uninterpreted_Data
% proof status:−)
% uidt_void_TCC1: TCCObligation
uidt_void: (uninterpreted_data_type ?) =

B.32 types.pvs

(# size := 0, valid? := Lambda (l : list[Byte], a : Address) : False #)
End Cpp_Deep_Types
% To do: don’t we need a theoryinstantiationof the above theoriesrather
% than theirimporting?
Cpp_Integral_Types: Theory

Begin

Importing Interpreted_Data,
Cpp_ushort, Cpp_uint, Cpp_ulong, Cpp_ulonglong,
Cpp_longdouble, Cpp_bool, Cpp_wchar_t ,
finite_sets@finite_sets_minmax [real, <=]
% proof status:−)
% range_integral_TCC1: TCCObligation
% proof status:−)
% range_integral_TCC2: TCCObligation
% proof status:−)
% range_integral_TCC3: TCCObligation
% proof status:−)
% range_integral_TCC4: TCCObligation
% proof status:−)
% range_integral_TCC5: TCCObligation
% proof status:−)
% range_integral_TCC6: TCCObligation
range_integral(typ : (non_bool_integral ?)) : non_empty_finite_set [int] =
Cases typ Of
uchar : range_uchar,
schar : range_schar,
char : range_char,
short : range_short,
int : range_int,
long : range_long,
longlong : range_longlong,
ushort : range_ushort,
uint : range_uint,
ulong : range_ulong,
ulonglong : range_ulonglong,
wchar_t: range_wchar_t

EndCases

% proof status:−)
% range_floating_point_TCC1 : TCCObligation
range_floating_point (typ : (floating_point?)) :
non_empty_finite_set [extended_real] =
Cases typ Of
float : range_float,
double : range_double,
longdouble : range_longdouble

EndCases

% proof status:−)
% dt_integral_TCC1: TCCObligation
% proof status:−)
% dt_integral_TCC2: TCCObligation
% proof status:−)
% dt_integral_TCC3: TCCObligation
% proof status:−)
% dt_integral_TCC4: TCCObligation
% proof status:−)
% dt_integral_TCC5: TCCObligation
% proof status:−)
% dt_integral_TCC6: TCCObligation
% proof status:−)
% dt_integral_TCC7: TCCObligation
% proof status:−)
% dt_integral_TCC8: TCCObligation
% proof status:−)
% dt_integral_TCC9: TCCObligation
% proof status:−)
% dt_integral_TCC10: TCCObligation
% proof status:−)
% dt_integral_TCC11: TCCObligation
% proof status:−)
% dt_integral_TCC12: TCCObligation
dt_integral(typ : (non_bool_integral ?)) :
(pod_data_type ?[(range_integral(typ))]) =
Cases typ Of
uchar : dt_uchar,

schar : dt_schar,
char : dt_char,
short : dt_short,
int : dt_int,
long : dt_long,
longlong : dt_longlong,
ushort : dt_ushort,
uint : dt_uint,
ulong : dt_ulong,
ulonglong : dt_ulonglong,
wchar_t: dt_wchar_t

EndCases

% proof status:−)
% dt_floating_point_TCC1 : TCCObligation
% proof status:−)
% dt_floating_point_TCC2 : TCCObligation
% proof status:−)
% dt_floating_point_TCC3 : TCCObligation
dt_floating_point (typ : (floating_point?)) :
(pod_data_type ?[(range_floating_point (typ))]) =
Cases typ Of
float : dt_float,
double : dt_double,
longdouble : dt_longdouble

EndCases

% proof status:−)
% range_integral_unsigned_TCC1 : TCCObligation
% proof status:−)
range_integral_unsigned: Judgement
range_integral(typ : (unsigned_integer?)) Has_Type
non_empty_finite_set [nat]

% proof status:−)
% max_value_TCC1: TCCObligation
% proof status:−)
% max_value_TCC2: TCCObligation
% 3.9.1 pt 8 "...numeric_limitsshallspecifythe maximumand minimumvalues
% for each arithmetrictype..."
max_value(typ : (non_bool_integral ?)) : int =
max(range_integral(typ))

% proof status:−)
% min_value_TCC1: TCCObligation
min_value(typ : (non_bool_integral ?)) : int =
min(range_integral(typ))
% proof status:−)
max_value_unsigned: Judgement
max_value(typ : (unsigned_integer?)) Has_Typenat
% proof status:−)
min_value_unsigned: Judgement
min_value(typ : (unsigned_integer?)) Has_Typenat
% proof status:−)
% max_value_bits_TCC1 : TCCObligation
% proof status:−)
% max_value_bits_TCC2 : TCCObligation
% proof status:−)
% max_value_bits_TCC3 : TCCObligation
% proof status:−)
% max_value_bits_TCC4 : TCCObligation
% proof status:−)
% max_value_bits_TCC5 : TCCObligation
% proof status:−)
% max_value_bits_TCC6 : TCCObligation
max_value_bits (typ : (cv(unsigned_integer?))) : Recursive posnat =
Cases typ Of
uchar : max_value_bits_uchar ,
ushort : max_value_bits_ushort ,
uint : max_value_bits_uint ,
ulong : max_value_bits_ulong ,
ulonglong : max_value_bits_ulonglong ,
const(t) : max_value_bits (t),
volatile(t) : max_value_bits (t)

EndCases

Measure typ by <<
End Cpp_Integral_Types

Cpp_Deep_Type_Wellformedness : Theory

Begin

Importing Cpp_Integral_Types

% Constraintson RecursiveDefinitionof Types
% ==============================================
% proof status:−)
% no_pointers_to_bitfield ?_TCC1: TCCObligation
% Pointers
% −−−−−−−−−−
% 8.3.1 pt 4 no pointersto bitfields
no_pointers_to_bitfield ?(t : Cpp_Type_) : bool =
Not (pointer?(t) And cv(bitfield?)(typ(t)))
% 8.3.2 pt 4 no pointersto ref
no_pointers_to_references ?(t : Cpp_Type_) : bool =
Not (pointer?(t) And reference?(typ(t)))
% References
% −−−−−−−−−−−−
% proof status:−)
% no_cv_references?_TCC1: TCCObligation
% 8.3.2 pt 1 no cv(ref)
no_cv_references ?(t : Cpp_Type_) : bool =
Not ((const?(t) Or volatile?(t)) And reference?(typ(t)))
% proof status:−)
% no_reference_to_reference ?_TCC1: TCCObligation
% 8.3.2 pt 4 no ref to ref
no_reference_to_reference ?(t : Cpp_Type_) : bool =
Not (reference?(t) And reference?(typ(t)))
% 9.6 pt 1 "Bit fieldsare packedinto some addressableallocationunit"
% no ref to bitfield
no_reference_to_bitfields ?(t : Cpp_Type_) : bool =
Not (reference?(t) And cv(bitfield?)(typ(t)))
% 8.3.2 pt 4 "A referenceshallbe initialisedto pointto a validobject"
% 3.9.1 pt 9 "An object−typeis a [...]typethat is not [...]a voidtype."
% We take this to mean no referencesto void.
% >> 3.9.1 pt 9 declaresfunctionsare no objects, however,
% gcc allowsint (& bar)(...)
no_reference_to_void ?(t : Cpp_Type_) : bool =
Not (reference?(t) And cv(void?)(typ(t)))
% PointerTo Member
% −−−−−−−−−−−−−−−−−−−
% 8.3.3 pt 3 no pointer_to_memberto static members(trivial)

% 8.3.3 pt 3 no pointer_to_memberto reference
no_pointer_to_member_to_reference ?(t : Cpp_Type_) : bool =
Not (pointer_to_member ?(t) And reference?(member_typ(t)))
% 8.3.3 pt 3 no pointer_to_memberto cv void
no_pointer_to_member_to_cv_void ?(t : Cpp_Type_) : bool =
Not (pointer_to_member ?(t) And cv(void?)(member_typ(t)))
% proof status:−)
% no_array_of_references ?_TCC1: TCCObligation
% Arrays
% −−−−−−−−
% 8.3.2 pt 4 and 8.3.4 pt 1 no arrayof ref
no_array_of_references ?(t : Cpp_Type_) : bool =
array?(t) Implies Not reference?(typ(t))
% 8.3.4 pt 1 no arrayto cv void
no_array_of_cv_void ?(t : Cpp_Type_) : bool =
array?(t) Implies Not cv(void?)(typ(t))
% 8.3.4 pt 1 no arrayto function
no_array_of_function ?(t : Cpp_Type_) : bool =
array?(t) Implies Not function?(typ(t))
% 8.3.4 pt 1 no arrayof abstractclass type
no_array_of_abstract_class ?(t : Cpp_Type_) : bool =
array?(t) Implies Not (class?(typ(t)) And abstract(typ(t)))
% struct{ int []: 5 }; is ill formed
no_array_of_bitfields ?(t : Cpp_Type_) : bool =
array?(t) Implies Not cv(bitfield?)(typ(t))
% Functions
% −−−−−−−−−−−
% 8.3.5 pt 4 cv(function) onlyfor nonstaticmemberfunctions
% Cvmemberfunctionsaccess membersas if theywere cv qualified
% we handlethis situationin the semanticscompilerby declar
% membersaccessed withina cv functionto have cv type.
% We can thereforeforbitcv(function)
no_cv_function ?(t : Cpp_Type_) : bool =
Not ((const?(t) Or volatile?(t)) And function?(typ(t)))
% To do: semanticscompiler: membersaccessed withincv functionmust
% have cv type
% 8.3.5 pt 2 no voidfunctionparameter
% f(void) is equivalentto f() withan emptylist
no_cv_void_parameter ?(t : Cpp_Type_) : bool =
function?(t) Implies
every(Lambda (p : Cpp_Type_) : not cv(void?)(p))(args_typ(t))

% proof status:−)
% no_pointer_or_ref_to_incomplete_array_parameter ?_TCC1: TCCObligation
% proof status:−)
% no_pointer_or_ref_to_incomplete_array_parameter ?_TCC2: TCCObligation
% proof status:−)
% no_pointer_or_ref_to_incomplete_array_parameter ?_TCC3: TCCObligation
% proof status:−)
% no_pointer_or_ref_to_incomplete_array_parameter ?_TCC4: TCCObligation
% proof status:−)
% no_pointer_or_ref_to_incomplete_array_parameter ?_TCC5: TCCObligation
% proof status:−)
% no_pointer_or_ref_to_incomplete_array_parameter ?_TCC6: TCCObligation
% 8.3.5 pt 6 no functionparametersof type:
% pointerto arrayof unknownbound; referenceto arrayof unknownbound
no_pointer_or_ref_to_incomplete_array_parameter ?(t : Cpp_Type_) : bool =
function?(t) Implies every(Lambda (p : Cpp_Type_) :
Not ((pointer?(p) Or reference?(p)) And
(array?(typ(p)) And size(typ(p)) > 0)) And
Not ((const?(p) Or volatile?(p)) And pointer?(typ(p)) And
(array?(typ(typ(p))) And size(typ(typ(p))) > 0)) And
Not (const?(p) And volatile?(typ(p)) And pointer?(typ(typ(p))) And
(array?(typ(typ(typ(p)))) And size(typ(typ(typ(p)))) > 0))
)(args_typ(t))
% 8.3.5 pt 6 no returntypearrayor function
no_array_return_type ?(t : Cpp_Type_) : bool =
Not (function?(t) And array?(ret_typ(t)))
no_function_return_type ?(t : Cpp_Type_) : bool =
Not (function?(t) And function?(ret_typ(t)))
% To do:
% 8.3.5 pt 6 no incompletetypesin returntypeor function
% (exceptfor memberfunctions)
% Classesand Unions
% −−−−−−−−−−−−−−−−−−−−
% no restrictionson elementtypes
% Bit Fields
% −−−−−−−−−−−−
% 9.6 pt 3 bit−field shallhave integralor enumerationtype
% proof status:−)

% bitfield_underlying_integral_or_enum_type ?_TCC1: TCCObligation
% >> we deviatefrom the standardby disallowingbools to be stored
% directlyin a bitfield; use bool_to_intconversionsinstead
bitfield_underlying_integral_or_enum_type ?(t : Cpp_Type_) : bool =
bitfield?(t) Implies (non_bool_integral_enum ?(typ(t)))
% Enums
% −−−−−−−
% 7.2 "The underlyingtype[...]is an integraltypethat can
% representall the [enum] values"
% proof status:−)
% enum_underlying_integral ?_TCC1: TCCObligation
enum_underlying_integral ?(t : Cpp_Type_) : bool =
enum?(t) Implies non_bool_integral ?(typ(t))
% proof status:−)
% enum_constants?_TCC1: TCCObligation
% proof status:−)
% enum_constants?_TCC2: TCCObligation
enum_constants?(e : (enum_underlying_integral ?)) : bool =
enum?(e) Implies
Forall (m : below[members(e)]) :
range_integral(typ(e))(constant_value(e)(m))
% CVQualifiers
% −−−−−−−−−−−−−−−
% proof status:−)
% const_volatile?_TCC1: TCCObligation
% 3.9.3 pt 1 const(volatile(typ)) = volatile(const(typ))
% (rule out the latter)
const_volatile?(t : Cpp_Type_) : bool =
volatile?(t) Implies Not const?(typ(t))
% proof status:−)
% const_stutter?_TCC1: TCCObligation
const_stutter?(t : Cpp_Type_) : bool =
const?(t) Implies Not const?(typ(t))
volatile_stutter?(t : Cpp_Type_) : bool =
volatile?(t) Implies Not volatile?(typ(t))
% proof status:−)
% cv_array?_TCC1: TCCObligation

% 3.9.3 pt 2 cv(array(typ)) = array(cv(typ)) rule out the first
cv_array?(t : Cpp_Type_) : bool =
(volatile?(t) Or const?(t)) Implies Not array?(typ(t))
% 3.9.3 pt 3 cv(class(t1, ..., tn)) =>
% cv(t1) .. cv(tn) providedti is not a reference
% 3.9.3 pt 3 const(class(t1, ..., tn)) =>
% const(t1) .. const(tn) providedti is not mutable
% We handlethis case in the semanticscompiler.
no_cv_class ?(t : Cpp_Type_) : bool =
Not ((const?(t) Or volatile?(t)) And class?(typ(t)))
no_cv_union ?(t : Cpp_Type_) : bool =
Not ((const?(t) Or volatile?(t)) And union?(typ(t)))
no_cv_void ?(t : Cpp_Type_) : bool =
Not ((const?(t) Or volatile?(t)) And void?(typ(t)))
% To do: semanticscompilercv(class(t1,...tn))) => cv(ti)
% Combinationof individualconstraintsin a single predicativesubtype
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
Cpp_Type?(typ : Cpp_Type_) : bool =
Forall (t : Cpp_Type_) : subterm(t, typ) Implies
no_pointers_to_bitfield ?(t) And no_pointers_to_references ?(t) And
no_cv_references ?(t) And no_reference_to_reference ?(t) And
no_reference_to_bitfields ?(t) And
no_pointer_to_member_to_reference ?(t) And
no_pointer_to_member_to_cv_void ?(t) And no_cv_void_parameter ?(t) And
no_array_of_references ?(t) And no_array_of_cv_void ?(t) And
no_array_of_function ?(t) And no_array_of_abstract_class ?(t) And
no_pointer_or_ref_to_incomplete_array_parameter ?(t) And
no_array_return_type ?(t) And no_function_return_type ?(t) And
bitfield_underlying_integral_or_enum_type ?(t) And cv_array?(t) And
enum_underlying_integral ?(t) And enum_constants?(t) And
const_volatile?(t) And
const_stutter?(t) And volatile_stutter?(t) And no_cv_class ?(t) And
no_cv_union ?(t) And no_cv_function ?(t) And no_reference_to_void ?(t) And
no_cv_void ?(t) And
no_array_of_bitfields ?(t)
Cpp_Type: Type = (Cpp_Type?)
Cpp_Subtype(P : [Cpp_Type_−> bool]) : Type = {typ : Cpp_Type| P(typ)}

% proof status:−)
% cv_base_TCC1: TCCObligation
% proof status:−)
% cv_base_TCC2: TCCObligation

% proof status:−)
% cv_base_TCC3: TCCObligation
% proof status:−)
% cv_base_TCC4: TCCObligation
% proof status:−)
% cv_base_TCC5: TCCObligation
% Reducecv qualifiednessfrom a type
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
cv_base(typ : Cpp_Type) : Recursive Cpp_Type=
Cases typ Of
const(t) : cv_base(t),
volatile(t) : cv_base(t)

Else

typ EndCases

Measure typ by <<
% proof status:−)
subterm_cv_base: Lemma
Forall (typ : Cpp_Type) :
subterm(cv_base(typ), typ)
% proof status:−)
cv_base_result: Lemma
Forall (P : {Q : PRED[Cpp_Type_] | subset?(Q, interpreted?)},
typ : Cpp_Subtype(cv(P))) :
P(cv_base(typ))
% proof status:−)
cv_base_result2: Lemma
Forall (typ : Cpp_Type) :
Not const?(typ) And Not volatile?(typ)

Implies

cv_base(typ) = typ
% proof status:−)
cv_base_not_const : Lemma
Forall (typ : Cpp_Type) :
Not const?(cv_base(typ))
% proof status:−)
cv_base_not_volatile : Lemma
Forall (typ : Cpp_Type) :
Not volatile?(cv_base(typ))
% proof status:−)
cv_base_cv: Lemma
Forall (P : PRED[Cpp_Type_], typ : Cpp_Type) :

subset?(P, interpreted?) Implies
(P(cv_base(typ)) IFF cv(P)(typ))
% LayoutCompatibility
% ======================
% proof status:−)
% layout_compatible ?_TCC1: TCCObligation
% (3.9 pt 11) [reflexive] same typesare layoutcompatible
% symmetric, transitivefollows from natureof layout_compatibility ?
layout_compatible? : equivalence[Cpp_Type]
% proof status:−)
% layout_compatible_enums_TCC1 : TCCObligation
% proof status:−)
% layout_compatible_enums_TCC2 : TCCObligation
% 7.2 pt 7 "Two enumerationtypesare layoutcompatibleif the have the
% same underlyingtype."
layout_compatible_enums: Axiom
Forall (e1, e2 : Cpp_Subtype(enum?)) :
layout_compatible?(e1, e2) IFF typ(e1) = typ(e2)
% 3.9.3 pt 1 "The cv−qualifiedor cv−unqualifiedversionof a type[...]
% shallhave the same representationand alignmentrequirement"
% We take this to mean theyare layoutcompatible.
layout_compatible_cv: Axiom
Forall (t : Cpp_Type) :
(Cpp_Type?(const(t)) Implies layout_compatible?(t, const(t))) And
(Cpp_Type?(volatile(t)) Implies layout_compatible?(t, volatile(t))) And
(Cpp_Type?(const(volatile(t))) Implies
layout_compatible?(t, const(volatile(t))))
End Cpp_Deep_Type_Wellformedness
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%

% CompoundTypes

%

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% 7.2 Enumerations
% ==================
Cpp_enum: Theory

Begin

Importing Cpp_Deep_Type_Wellformedness
e : Var Cpp_Subtype(enum?)
% Alignment

% −−−−−−−−−−−
align_enum(e) : posnat
% ValueRange
% −−−−−−−−−−−−−
% proof status:−)
% valid_range?_TCC1: TCCObligation
% proof status:−)
% valid_range?_TCC2: TCCObligation
% 7.2 pt 5 "The underlyingtypeof an enumerationis an integraltypethat
% can representall the enumeratorvalues"
valid_range?(e)(r : non_empty_finite_set [int]) : bool =
subset?(r, range_integral(typ(e))) And
Forall (member : below[members(e)]) : r(constant_value(e)(member))
% To do: ?
% Currentlythe smallestrange of an enum is comprisedonlyof the discrete
% enum constants. However, 7.2 pt 6 allowsall valuesbetweenemin and emax
% or more preciselyin the surroundingbitfieldbmin, bmax.
% 7.2 pt 6 bitfield
% bmin<= emin <= emax <= bmaxfor a bitfieldb
% proof status:−)
% range_enum_TCC1: TCCObligation
range_enum(e) : (valid_range?(e))
% (Un−)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−−
dt_enum_exists: Axiom
Exists (dt : (pod_data_type ?[(range_enum(e))])) : true
% Remark: the datatypeof the underlyingtype−−− dt(typ(e)) −−− shouldbe
% a validmodel for dt(e) and all possibleranges.
% proof status:−)
% dt_enum_TCC1: TCCObligation
dt_enum(e) : (pod_data_type ?[(range_enum(e))])
% proof status:−)
% value_bitmask_enum_TCC1 : TCCObligation
value_bitmask_enum (e) : {l : list[Byte] | length(l) = size(uidt(dt_enum(e)))}
% proof status:−)
% enum_size_TCC1: TCCObligation

% proof status:−)
% enum_size_TCC2: TCCObligation
% 7.2 pt 5 "The valueof sizeof() appliedto an enumerationtype[...]is
% the valueof sizeof() appliedto the unterlyingtype. "
enum_size: Axiom
size(uidt(dt_enum(e))) = size(uidt(dt_integral(typ(e))))
End Cpp_enum

Cpp_pointer: Theory

Begin

Importing Cpp_Deep_Type_Wellformedness
p : Var Cpp_Subtype(pointer?)
i : Var int
% Alignment
% −−−−−−−−−−−
align_ptr(p) : posnat
% ValueRange
% −−−−−−−−−−−−−
Pointer_Base_Type: Type
% Alternativemodels:
% ~~~~~~~~~~~~~~~~~~~~~
% 1) Pointer_Base_Type= Memory_Address
% − no boundschecking; + no hiddenbits required;
% + size = l2(Max_Address) possible

%

% 2) Pointer_Base_Type=
% [# base : Memory_Address , size : posnat, offset : int #]
% + boundscheckingpossible;
% − requireshiddenbits or size > l2(Max_Address)
% To do: implementthe above two models
% 3.9.2 pt 3 pointervalueis addressof a bytein memoryor a nullpointer
range_pointer(p) : PRED[lift[Pointer_Base_Type ]]
null?(ptr_val: lift[Pointer_Base_Type ]) : bool = bottom?(ptr_val)
% we assert that the nullpointeris in the semanticsrange of any pointer
null_every_range: Axiom
Forall (p) : range_pointer(p)(bottom)
% (Un−)interpretedDatatype
% ===========================

dt_pointer_exists: Axiom
Exists (dt : (pod_data_type ?[(range_pointer(p))])) : true
% proof status:−)
% dt_pointer_TCC1: TCCObligation
dt_pointer(p) : (pod_data_type ?[(range_pointer(p))])
% proof status:−)
% pointers_to_layout_compatible_range_TCC1 : TCCObligation
% proof status:−)
% pointers_to_layout_compatible_range_TCC2 : TCCObligation
% proof status:−)
% pointers_to_layout_compatible_range_TCC3 : TCCObligation
% proof status:−)
% pointers_to_layout_compatible_range_TCC4 : TCCObligation
% 3.9.2 pt 3 pointersto layout−compatible(possiblycv_qualified) types
% shallhave the same valuerepresentationand alignment
% requirements
pointers_to_layout_compatible_range : Axiom
Forall (p1, p2 : Cpp_Subtype(pointer?)) :
layout_compatible?(typ(p1), typ(p2)) Implies
range_pointer(p1) = range_pointer(p2)
% proof status:−)
% pointers_to_layout_compatible_dt_TCC1 : TCCObligation
pointers_to_layout_compatible_dt : Axiom
Forall (p1, p2 : Cpp_Subtype(pointer?)) :
layout_compatible?(typ(p1), typ(p2)) Implies
dt_pointer(p1) = dt_pointer(p2)
pointers_to_layout_compatible_alignment : Axiom
Forall (p1, p2 : Cpp_Subtype(pointer?)) :
layout_compatible?(typ(p1), typ(p2)) Implies
align_ptr(p1) = align_ptr(p2)
% 3.9.2 pt 4 "cv? void∗ and void∗ shallhave the same representation
% and alignmentrequirementsas a cv? char∗"
void_pointer_char_pointer_range : Axiom
Forall (p1, p2 : Cpp_Subtype(pointer?)) :
void?(typ(p1)) And char?(typ(p2))

Implies

range_pointer(p1) = range_pointer(p2)
% proof status:−)
% void_pointer_char_pointer_dt_TCC1 : TCCObligation

B.32 types.pvs

void_pointer_char_pointer_dt : Axiom
Forall (p1, p2 : Cpp_Subtype(pointer?)) :
void?(typ(p1)) And char?(typ(p2))

Implies

dt_pointer(p1) = dt_pointer(p2)
void_pointer_char_pointer_alignment : Axiom
Forall (p1, p2 : Cpp_Subtype(pointer?)) :
void?(typ(p1)) And char?(typ(p2))

Implies

align_ptr(p1) = align_ptr(p2)
% PointerArithmetic
% ====================
% Addressof Pointerand Arithmetic
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
ptyp : Var Cpp_Subtype(cv(pointer?))
not_null?(ptyp)(ptr_val: (range_pointer(cv_base(ptyp)))) : bool = Not null?(ptr_val)
address_of(ptyp)(ptr_val: (range_pointer(cv_base(ptyp)))) : lift[Memory_Address]
address_of_spec: Axiom
Forall (ptr_val: (range_pointer(cv_base(ptyp)))) : not_null?(ptyp)(ptr_val)
Implies up?(address_of(ptyp)(ptr_val))
address_of_spec2: Axiom
Forall (ptr_val: (range_pointer(cv_base(ptyp)))) :
null?(ptr_val) Implies bottom?(address_of(ptyp)(ptr_val))
% proof status:−)
% add_TCC1: TCCObligation
% Integeradditionfor pointers
add(ptyp)(ptr_val: (range_pointer(cv_base(ptyp))), i : int) : (range_pointer(cv_base(ptyp)))
add_spec: Axiom
Forall (ptr_val: (range_pointer(cv_base(ptyp)))) :
not_null?(ptyp)(ptr_val) Iff not_null?(ptyp)(add(ptyp)(ptr_val, i))
% proof status:−)
% add_spec2_TCC1: TCCObligation
% proof status:−)
% add_spec2_TCC2: TCCObligation
add_spec2: Axiom
Forall (ptr_val: (range_pointer(cv_base(ptyp)))) :
not_null?(ptyp)(ptr_val)

Implies

down(address_of(ptyp)(add(ptyp)(ptr_val, i))) =
down(address_of(ptyp)(ptr_val)) + i
% proof status:−)
add_simplification: Lemma
Forall (ptr_val: (range_pointer(cv_base(ptyp))), i, j : int) :
address_of(ptyp)(add(ptyp)(add(ptyp)(ptr_val, i), j)) =
address_of(ptyp)(add(ptyp)(ptr_val, i + j))
% Pointersubstraction
% 5.7 pt 6 definessubstractiononlyfor pointersof the same arrayobject.
% 5.9 pt 2 pointersto the same arrayare comparable
same_array(ptyp)(ptr_val1, ptr_val2: (range_pointer(cv_base(ptyp)))) : bool
same_array_spec: Axiom
Forall (ptr_val1, ptr_val2: (range_pointer(cv_base(ptyp)))) :
not_null?(ptyp)(ptr_val1) And not_null?(ptyp)(ptr_val2)

Implies

(same_array(ptyp)(ptr_val1, ptr_val2) IFF ptr_val1= ptr_val2)
same_array_spec2: Axiom
Forall (ptr_val1, ptr_val2: (range_pointer(cv_base(ptyp)))) :
null?(ptr_val1) Or null?(ptr_val2)

Implies

same_array(ptyp)(ptr_val1, ptr_val2) = false
% ArrayBoundsChecking(RequiresModel 2)
% ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
check_bounds(ptyp)(ptr_val: (range_pointer(cv_base(ptyp)))) : bool
check_bounds_spec: Axiom
Forall (ptr_val: (range_pointer(cv_base(ptyp)))) :
null?(ptr_val)

Implies

check_bounds(ptyp)(ptr_val) = false
% Respectivemodel (2) implementationsof these functionsare:
% ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

%

% − add(p)(ptr_val, i) = ‘offset += i
% − address_of(p)(ptr_val) = base + offset
% − check_bounds(p)(ptr_val) = 0 <= offset < size
% proof status:−)
% void_pointer_other_pointer_value_TCC1 : TCCObligation
% proof status:−)
% void_pointer_other_pointer_value_TCC2 : TCCObligation
% 3.9.2 pt 4 "A void∗ shallbe able to hold hold any object pointer."
void_pointer_other_pointer_value : Axiom

Forall (p1, p2 : Cpp_Subtype(cv(pointer?)), ptr_val1: (range_pointer(cv_base(p1)))) :
void?(typ(cv_base(p1))) And not_null?(p1)(ptr_val1)

Implies

Exists (ptr_val2: (range_pointer(cv_base(p2)))) :
not_null?(p2)(ptr_val2) And
down(address_of(p1)(ptr_val1)) = down(address_of(p2)(ptr_val2))
End Cpp_pointer
% 8.3.2 Reference
% =================
Cpp_reference: Theory

Begin

Importing Cpp_Deep_Type_Wellformedness
r : Var Cpp_Subtype(reference?)
% Alignment
% −−−−−−−−−−−
align_ref(r) : posnat
% ValueRange
% −−−−−−−−−−−−−
address_range(r) : PRED[Memory_Address]
% 8.3.2 pt 3 "It is unspecifiedwhetheror not a referencerequiresstorage"
Reference_Type: Datatype

Begin

% Referencesstored in an allocatedreferencevariable
alloc (ref_variable: Address) : alloc?
% Referencesthat are not allocated
nonalloc (target : Memory_Address) : nonalloc?
End Reference_Type
range_reference(r) : PRED[Reference_Type] =
Lambda (rt : Reference_Type) :
Cases rt Of
alloc(ref_var) : divides(align_ref(r), offset(ref_var)),
nonalloc(target) : address_range(r)(target)

EndCases

alloc_range(r)(rt : Reference_Type) : bool =
range_reference(r)(rt) And alloc?(rt)

% To do: alignmentof references
% 3.9 pt 5 objects are allocatedat an addressthat meets the alignment
% requirements
% reference_to_aligned_object: Axiom

% Forall(r : Reference, addr: (address_range(r))) :
% divides?(alignment(typ(r)), offset(addr))
% (Un−)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−−
dt_ref_exists: Axiom
Exists (dt : (pod_data_type ?[(alloc_range(r))])) : true
% proof status:−)
% dt_reference_TCC1: TCCObligation
dt_reference(r) : (pod_data_type ?[(alloc_range(r))])
End Cpp_reference
% 9 Class/ Union
% =================
Cpp_class: Theory

Begin

Importing Cpp_Deep_Type_Wellformedness
c : Var Cpp_Subtype(class?)
% Alignment
% −−−−−−−−−−−
align_class(c) : posnat
% UninterpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−
% We define no semanticdomainfor classes and unions
% proof status:−)
% uidt_class_TCC1: TCCObligation
uidt_class(c) : {uidt : (uninterpreted_data_type ?) | size(uidt) > 0}
End Cpp_class
Cpp_union: Theory

Begin

Importing Cpp_Deep_Type_Wellformedness
u : Var Cpp_Subtype(union?)
% Alignment
% −−−−−−−−−−−
align_union(u) : posnat
% UninterpretedDatatype

% −−−−−−−−−−−−−−−−−−−−−−−−
% We define no semanticdomainfor classes and unions
% proof status:−)
% uidt_union_TCC1: TCCObligation
uidt_union(u) : {uidt : (uninterpreted_data_type ?) | size(uidt) > 0}
End Cpp_union

% 8.3.4 Array
% =============
Cpp_array: Theory

Begin

Importing Cpp_Deep_Type_Wellformedness
a : Var Cpp_Subtype(array?)
% Alignment
% −−−−−−−−−−−
align_arr(a) : posnat
% UninterpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−
% We define no semanticdomainfor arrays
% proof status:−)
% uidt_array_TCC1: TCCObligation
uidt_array(a) : (uninterpreted_data_type ?)
% 8.3.4 pt 6 subscriptE1[E2] = ∗((E1) + (E2))
End Cpp_array

% 8.3.5 Functions
% =================
Cpp_function: Theory

Begin

Importing Cpp_Deep_Type_Wellformedness
% Functions
% −−−−−−−−−−−
% 8.3.5 pt 2 variablenumberof argumentsf(const char∗, [],...)
% To do :
% handlein semanticscompilerby creatingand passingvarargs object

% 8.3.6
% We handledefaultargumentsin the semanticscompilerby generating
% appropriatecall stubs
% To do:
% − pointerto function
% − recursivefunctions
% proof status:−)
% uidt_function_TCC1: TCCObligation
uidt_function(f : Cpp_Subtype(function?)) : (uninterpreted_data_type ?) =
(# size := 0, valid? := Lambda (l : list[Byte], a : Address) : False #)
% VirtualFunctions
% −−−−−−−−−−−−−−−−−−−
c : Var Cpp_Subtype(class?)
Vtable : Type+
vtable(c) : Vtable
vtable_idt_exists: Axiom
Exists (idt : (interpreted_data_type ?[(singleton(vtable(c)))])) : true
% proof status:−)
% dt_vtable_TCC1: TCCObligation
dt_vtable(c) : (interpreted_data_type ?[(singleton(vtable(c)))])
End Cpp_function

% 9.6 Bit Fields
% ================

%

% We do not considerbit fieldsto directlyparticipatein
% expressions. The integralpromotion(§ 4.5 pt 3) and integral
% conversion(§ 4.7 pt 2 and pt 3) rulesfor bit fieldsallowbit fields
% to be regardedas signed or unsignedintegersfor the purposeof
% arithmeticoperations.
Cpp_bitfield: Theory

Begin

Importing Cpp_enum
b : Var Cpp_Subtype(bitfield?)
% Alignment
% −−−−−−−−−−−
align_bitfield(b) : posnat

% 9.6 pt 1 "Alignmentof bit−fieldsis implementation−defined."
% proof status:−)
% range_bitfield_TCC1: TCCObligation
% ValueRange
% −−−−−−−−−−−−−
% 9.6 pt 3 "It is implementationdefinedwhethera plain[...]char, short,
% int or long bit−field is signed or unsigned."

%

% We take this to mean that bit fieldstakingviewerbits than the value
% represantationof the typecan be signed or unsigned. Thus, we can define
% range(b) to be a subset of range(typ(b)).
range_bitfield(b) : non_empty_finite_set [int]
% proof status:−)
% bitfield_range_underlying_TCC1 : TCCObligation
% proof status:−)
% bitfield_range_underlying_TCC2 : TCCObligation
% proof status:−)
% bitfield_range_underlying_TCC3 : TCCObligation
bitfield_range_underlying: Axiom
If enum?(typ(b)) Then
subset?(range_bitfield(b), range_enum(typ(b)))

Else

subset?(range_bitfield(b), range_integral(typ(b)))

Endif

% (Un−)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−−
dt_bitfield_exists: Axiom
Exists (idt : (interpreted_data_type ?[(range_bitfield(b))])) : True
% proof status:−)
% dt_bitfield_TCC1: TCCObligation
dt_bitfield(b) : (interpreted_data_type ?[(range_bitfield(b))])
% the bitfieldis containedin the allocationunit
bitfield_bits: Axiom
bit_offset(b) + bit_size(b) <= size(uidt(dt_bitfield(b))) ∗ bits_per_byte
% To do:
% − bit_masked(mask, n)
% − mask(to_byte(dt))
% − write_data(with_mask)
% − axiomsassertingthat non−bitfield_masksare full

% onlybits in the bitfieldare masked
bitfield_mask: Axiom
Forall (n : nat, data : (range_bitfield(b)), a : Address) :
n < size(uidt(dt_bitfield(b))) ∗ bits_per_byteAnd
bit_set?(n, to_mask(dt_bitfield(b))(data, a))

Implies

(bit_offset(b) <= n And n < bit_offset(b) + bit_size(b))
End Cpp_bitfield

% 8.3.3 Pointerto Member
% =========================
Cpp_pointer_to_member : Theory

Begin

Importing Cpp_Deep_Type_Wellformedness
p : Var Cpp_Subtype(pointer_to_member ?)
% Alignment
% −−−−−−−−−−−
align_pointer_to_member (p) : posnat
% ValueRange
% −−−−−−−−−−−−−
% The offsets of all class membersof that type. Emptysetif no such member
% is containedin the class. The pointercan at most be initialisedwitha
% memberof a base class but not witha memberof a derivedclass.
range_ptm(p) : finite_set[nat]
% To do:
% class membersprovidedwe could define an Axiomalong the lines:
% range(p) = {n : nat | Exists(m : member(typ(p))) :
% member_typ(p) = typ(p)(m) Impliesn = offset(m)}
% (Un−)interpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−−−−
dt_pointer_to_member_exists : Axiom
Exists (dt : (pod_data_type ?[(range_ptm(p))])) : True
% proof status:−)
% dt_ptm_TCC1: TCCObligation
dt_ptm(p) : (pod_data_type ?[(range_ptm(p))])
End Cpp_pointer_to_member

Cpp_const_volatile [Data : Type] : Theory

B.32 types.pvs

Begin

Assuming

Importing Cpp_Deep_Type_Wellformedness
idt_exists: Assumption
Exists (idt : (interpreted_data_type ?[Data])) : True

EndAssuming

% VolatileDatatypes
% ====================
% 3.9.3 pt 1 "The cv−qualifiedor cv−unqualifiedversionsof a type...
% shallhave the same representationand alignmentrequirements"

%

% In the presentspecificationthe behaviourof all writeaccesses is that
% of volatileaccesses.

%

% The approachcurrentlyunderdiscussionis to add a store−bufferlike
% unit−−− the compilerlayerfor volatileaccesses −−− as an additional
% memorylayer. Non volatilewritesmay be bufferedin this layer. Because
% of 3.9.3 pt 1 non volatilereads of volatilewrittendata shouldsucceed
% and returnthe same value. Therefore, we "have to (???)"use hiddenbits
% to signala volatileaccess to the store buffer.

%

% Because hiddenbits are not architectuallyjustified, we providetwo
% models:

%

% − Model 1: whichcannot distinguishvolatilefrom non−volatileaccesses
% and whichneeds no hiddenbits, and,
% − Model 2: in whichvolatileaccesses can be distinguishedfrom
% non−volatileaccesses using hiddenbits
% proof status:−)
% dt_volatile_TCC1: TCCObligation
dt_volatile(idt : (interpreted_data_type ?[Data])) :
(interpreted_data_type ?[Data])
dt_volatile_size: Axiom
Forall (idt : (interpreted_data_type ?[Data])) :
size(uidt(dt_volatile(idt))) = size(uidt(idt))
dt_volatile_pod: Axiom
Forall (idt : (pod_data_type ?[Data])) :
pod_data_type ?[Data](dt_volatile(idt))
dt_volatile_spec_model_1 : Axiom
Forall (idt : (interpreted_data_type ?[Data])) :
dt_volatile(idt) = idt

% >> MV: The side effect cannot change the object representationfrom
% dt(volatile(int)) to dt(int) because the typeinformationis
% lost at this level. We can onlyadd or removehiddenbits
% that are set / reset in dt(volatile(int)) and not in dt(int)
% and whichdo not participatein the valuerepresentation.
dt_volatile_spec_model_2 : Axiom
Forall (idt : (interpreted_data_type ?[Data])) :
dt_volatile(idt) /= idt And bits_per_byte> min_bits_per_byte
% >> shouldn’t we insteaduse somethinglike:
% >> − member(volatile_bit, hidden_bits_per_byte ) and
% >> − bits_per_byte= min_bits_per_byte+ card(hidden_bits_per_byte )
% ConstDatatypes
% =================
dt_const(idt : (interpreted_data_type ?[Data])) :
(interpreted_data_type ?[Data])
dt_const_size: Axiom
Forall (idt : (interpreted_data_type ?[Data])) :
size(uidt(dt_const(idt))) = size(uidt(idt))
dt_const_pod: Axiom
Forall (idt : (pod_data_type ?[Data])) :
pod_data_type ?[Data](dt_const(idt))
dt_const_spec_model_1 : Axiom
Forall (idt : (interpreted_data_type ?[Data])) :
dt_const(idt) = idt
dt_const_spec_model_2 : Axiom
Forall (idt : (interpreted_data_type ?[Data])) :
dt_const(idt) /= idt And bits_per_byte> min_bits_per_byte
End Cpp_const_volatile

Cpp_Types: Theory

Begin

Importing Cpp_class, Cpp_union, Min_Max_Extension ,
Cpp_function, Cpp_array, Cpp_bitfield, Cpp_pointer_to_member ,
Cpp_reference, Cpp_pointer, Cpp_const_volatile
% ConstVolatileQualifiers
% 3.9.3 pt 1 "The cv−qualifiedor cv−unqualifiedversionsof a type...
% shallhave the same representationand alignmentrequirements"
% Alignment(3.9 pt 5)
% ======================

% proof status:−)
% alignment_TCC1: TCCObligation
% proof status:−)
% alignment_TCC2: TCCObligation
% proof status:−)
% alignment_TCC3: TCCObligation
% proof status:−)
% alignment_TCC4: TCCObligation
% proof status:−)
% alignment_TCC5: TCCObligation
% proof status:−)
% alignment_TCC6: TCCObligation
% proof status:−)
% alignment_TCC7: TCCObligation
% proof status:−)
% alignment_TCC8: TCCObligation
% proof status:−)
% alignment_TCC9: TCCObligation
% proof status:−)
% alignment_TCC10: TCCObligation
% proof status:−)
% alignment_TCC11: TCCObligation
% proof status:−)
% alignment_TCC12: TCCObligation
% proof status:−)
% alignment_TCC13: TCCObligation
alignment(typ : Cpp_Type) : Recursive nat =
Cases typ Of
uchar : align_uchar,
schar : align_schar,
char : align_char,
short : align_short,
int : align_int,
long : align_long,
longlong : align_longlong,
ushort : align_ushort,
uint : align_uint,
ulong : align_ulong,
ulonglong : align_ulonglong,

wchar_t: align_wchar_t ,
bool : align_bool,
float : align_float,
double : align_double,
longdouble : align_longdouble,
void : 0,
array_type(t, s) : align_arr(typ),
function_type(r, a, v) : 0,
pointer(t) : align_ptr(typ),
reference(t) : align_ref(typ),
class(n, a) : align_class(typ),
union(n) : align_union(typ),
bitfield(t, bo, s) : align_bitfield(typ),
enum(n, t, m, c) : align_enum(typ),
pointer_to_member (t, m) : align_pointer_to_member (typ),
const (t) : alignment(t),
volatile (t) : alignment(t)

EndCases

Measure typ By <<
% proof status:−)
% pointer_to_aligned_object_TCC1 : TCCObligation
% proof status:−)
% pointer_to_aligned_object_TCC2 : TCCObligation
% proof status:−)
% pointer_to_aligned_object_TCC3 : TCCObligation
% Pointer
% −−−−−−−−−
% 3.9 pt 5 Objectsare allocatedat an addressthat meets the alignment
% requirements
pointer_to_aligned_object : Axiom
Forall (p : Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(p)))) :
not_null?(p)(ptr_val) Implies
divides(alignment(typ(cv_base(p))), offset(down(address_of(p)(ptr_val))))
% proof status:−)
% align_array_of_type_TCC1 : TCCObligation
% proof status:−)
% align_array_of_type_TCC2 : TCCObligation
% Arrays
% −−−−−−−−
align_array_of_type : Axiom
Forall (a : Cpp_Subtype(array?)) :
divides(alignment(a), alignment(typ(a)))

% SmallSuper Typefor IntegralC++ Types
% =========================================
% proof status:−)
% range_TCC1: TCCObligation
% proof status:−)
% range_TCC2: TCCObligation
% proof status:−)
% range_TCC3: TCCObligation
% proof status:−)
% range_TCC4: TCCObligation
% proof status:−)
% range_TCC5: TCCObligation
% proof status:−)
% range_TCC6: TCCObligation
% proof status:−)
% range_TCC7: TCCObligation
% this range does not includethe not allocatedreferences
range(typ : Cpp_Subtype(cv(non_bool_integral_enum ?))) : Recursive
non_empty_finite_set [int] =
Cases typ Of
enum(n, t, m, c) : range_enum(typ),
const(t) : range(t),
volatile(t) : range(t)

Else

range_integral(typ)

EndCases

Measure typ By <<
% proof status:−)
% range_cv_base_TCC1: TCCObligation
% proof status:−)
range_cv_base: Lemma
Forall (typ : Cpp_Subtype(cv(non_bool_integral_enum ?))) :
range(typ) = range(cv_base(typ))
% (Un−)interpretedDatatype
% ===========================
Importing Interpreted_Data_Lift
% To do:
% − we probablyneed hiddenbits to detect const modificationthrough
% an alias and to distinguishvolatilefrom non−volatileaccesses
% − Hendrik’s idea: use separatedatatypefor t and const(t);

B PVS Theory Sources

% semanticscompilerensuresno assignmentswithconst(t)
% proof status:−)
% dt_non_bool_integral_enum_TCC1 : TCCObligation
% proof status:−)
% dt_non_bool_integral_enum_TCC2 : TCCObligation
% proof status:−)
% dt_non_bool_integral_enum_TCC3 : TCCObligation
% proof status:−)
% dt_non_bool_integral_enum_TCC4 : TCCObligation
% InterpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−
dt_non_bool_integral_enum (typ : Cpp_Subtype(non_bool_integral_enum ?)) :
(interpreted_data_type ?[(range(typ))]) =
Cases typ Of
enum(n, t, m, c) : dt_enum(typ)

Else

dt_integral(typ)

EndCases

% proof status:−)
dt_non_bool_integral_enum_pod : Judgement
dt_non_bool_integral_enum (typ : Cpp_Subtype(non_bool_integral_enum ?))
Has_Type(pod_data_type ?[(range(typ))])
% proof status:−)
% dt_TCC1: TCCObligation
% proof status:−)
% dt_TCC2: TCCObligation
% proof status:−)
% dt_TCC3: TCCObligation
% proof status:−)
% dt_TCC4: TCCObligation
% proof status:−)
% dt_TCC5: TCCObligation
% GenericDatatypeModel
% ========================
dt(typ : Cpp_Subtype(cv(non_bool_integral_enum ?))) : Recursive
(interpreted_data_type ?[(range(typ))]) =
Cases typ Of
const(t) : dt_const(dt(t)),
volatile(t) : dt_volatile(dt(t))

Else

dt_non_bool_integral_enum (typ)

EndCases

Measure typ by <<
% proof status:−)
dt_pod: Judgement
dt(typ : Cpp_Subtype(cv(non_bool_integral_enum ?))) Has_Type
(pod_data_type ?[(range(typ))])
% proof status:−)
% dt_cv_pointer_TCC1 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC2 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC3 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC4 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC5 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC6 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC7 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC8 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC9 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC10 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC11 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC12 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC13 : TCCObligation
% proof status:−)
% dt_cv_pointer_TCC14 : TCCObligation
% proof status:−)

% dt_cv_pointer_TCC15 : TCCObligation
dt_cv_pointer (typ : Cpp_Subtype(cv(pointer?))) : Recursive
(interpreted_data_type ?[(range_pointer(cv_base(typ)))]) =
Cases typ Of
const(t) : dt_const(dt_cv_pointer (t)),
volatile(t) : dt_volatile(dt_cv_pointer (t))

Else

dt_pointer(typ)

EndCases

Measure typ by <<
% proof status:−)
% dt_cv_bitfield_TCC1 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC2 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC3 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC4 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC5 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC6 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC7 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC8 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC9 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC10 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC11 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC12 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC13 : TCCObligation
% proof status:−)

% dt_cv_bitfield_TCC14 : TCCObligation
% proof status:−)
% dt_cv_bitfield_TCC15 : TCCObligation
dt_cv_bitfield (typ : Cpp_Subtype(cv(bitfield?))) : Recursive
(interpreted_data_type ?[(range_bitfield(cv_base(typ)))]) =
Cases typ Of
const(t) : dt_const(dt_cv_bitfield (t)),
volatile(t) : dt_volatile(dt_cv_bitfield (t))

Else

dt_bitfield(typ)

EndCases

Measure typ by <<
% proof status:−)
% dt_cv_ptm_TCC1: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC2: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC3: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC4: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC5: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC6: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC7: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC8: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC9: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC10: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC11: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC12: TCCObligation
% proof status:−)

% dt_cv_ptm_TCC13: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC14: TCCObligation
% proof status:−)
% dt_cv_ptm_TCC15: TCCObligation
dt_cv_ptm (typ : Cpp_Subtype(cv(pointer_to_member ?))) : Recursive
(interpreted_data_type ?[(range_ptm(cv_base(typ)))]) =
Cases typ Of
const(t) : dt_const(dt_cv_ptm (t)),
volatile(t) : dt_volatile(dt_cv_ptm (t))

Else

dt_ptm(typ)

EndCases

Measure typ by <<
% proof status:−)
% dt_cv_float_TCC1: TCCObligation
% proof status:−)
% dt_cv_float_TCC2: TCCObligation
% proof status:−)
% dt_cv_float_TCC3: TCCObligation
% proof status:−)
% dt_cv_float_TCC4: TCCObligation
% proof status:−)
% dt_cv_float_TCC5: TCCObligation
% proof status:−)
% dt_cv_float_TCC6: TCCObligation
% proof status:−)
% dt_cv_float_TCC7: TCCObligation
% proof status:−)
% dt_cv_float_TCC8: TCCObligation
% proof status:−)
% dt_cv_float_TCC9: TCCObligation
% proof status:−)
% dt_cv_float_TCC10: TCCObligation
% proof status:−)
% dt_cv_float_TCC11: TCCObligation
% proof status:−)

% dt_cv_float_TCC12: TCCObligation
% proof status:−)
% dt_cv_float_TCC13: TCCObligation
% proof status:−)
% dt_cv_float_TCC14: TCCObligation
% proof status:−)
% dt_cv_float_TCC15: TCCObligation
dt_cv_float (typ : Cpp_Subtype(cv(floating_point?))) : Recursive
(interpreted_data_type ?[(range_floating_point (cv_base(typ)))]) =
Cases typ Of
const(t) : dt_const(dt_cv_float (t)),
volatile(t) : dt_volatile(dt_cv_float (t))

Else

dt_floating_point (typ)

EndCases

Measure typ by <<
% Dt is pod judgements
% −−−−−−−−−−−−−−−−−−−−−−
% To do (if required)
% proof status:−)
% uidt_TCC1: TCCObligation
% proof status:−)
% uidt_TCC2: TCCObligation
% proof status:−)
% uidt_TCC3: TCCObligation
% proof status:−)
% uidt_TCC4: TCCObligation
% proof status:−)
% uidt_TCC5: TCCObligation
% proof status:−)
% uidt_TCC6: TCCObligation
% proof status:−)
% uidt_TCC7: TCCObligation
% proof status:−)
% uidt_TCC8: TCCObligation
% proof status:−)
% uidt_TCC9: TCCObligation

% proof status:−)
% uidt_TCC10: TCCObligation
% proof status:−)
% uidt_TCC11: TCCObligation
% proof status:−)
% uidt_TCC12: TCCObligation
% proof status:−)
% uidt_TCC13: TCCObligation
% proof status:−)
% uidt_TCC14: TCCObligation
% proof status:−)
% uidt_TCC15: TCCObligation
% proof status:−)
% uidt_TCC16: TCCObligation
% proof status:−)
% uidt_TCC17: TCCObligation
% proof status:−)
% uidt_TCC18: TCCObligation
% proof status:−)
% uidt_TCC19: TCCObligation
% proof status:−)
% uidt_TCC20: TCCObligation
% proof status:−)
% uidt_TCC21: TCCObligation
% proof status:−)
% uidt_TCC22: TCCObligation
% proof status:−)
% uidt_TCC23: TCCObligation
% proof status:−)
% uidt_TCC24: TCCObligation
% proof status:−)
% uidt_TCC25: TCCObligation
% proof status:−)
% uidt_TCC26: TCCObligation
% proof status:−)

% uidt_TCC27: TCCObligation
% proof status:−)
% uidt_TCC28: TCCObligation
% proof status:−)
% uidt_TCC29: TCCObligation
% proof status:−)
% uidt_TCC30: TCCObligation
% proof status:−)
% uidt_TCC31: TCCObligation
% proof status:−)
% uidt_TCC32: TCCObligation
% proof status:−)
% uidt_TCC33: TCCObligation
% proof status:−)
% uidt_TCC34: TCCObligation
% proof status:−)
% uidt_TCC35: TCCObligation
% proof status:−)
% uidt_TCC36: TCCObligation
% proof status:−)
% uidt_TCC37: TCCObligation
% proof status:−)
% uidt_TCC38: TCCObligation
% proof status:−)
% uidt_TCC39: TCCObligation
% proof status:−)
% uidt_TCC40: TCCObligation
% proof status:−)
% uidt_TCC41: TCCObligation
% UninterpretedDatatype
% −−−−−−−−−−−−−−−−−−−−−−−−
uidt(typ : Cpp_Type) : Recursive (uninterpreted_data_type ?) =
Cases typ Of
void : uidt_void,
array_type(t, s) : uidt_array(typ),
function_type(r, a, v) : uidt_function(typ),
class(n, a) : uidt_class(typ),

union(n) : uidt_union(typ),
% interpretedtypes
pointer(t) : uidt(dt_cv_pointer (typ)),
reference(t) : uidt(dt_reference(typ)),
pointer_to_member (c, t) : uidt(dt_cv_ptm (typ)),
bitfield(t, bo, s) : uidt(dt_cv_bitfield (typ)),
bool : uidt(dt_bool),
% qualifiers
const(t) :
Cases t Of
bool : uidt(dt_bool),
pointer(t1) : uidt(dt_cv_pointer (typ)),
pointer_to_member (c, t1) : uidt(dt_cv_ptm (typ)),
bitfield(t1, bo, s) : uidt(dt_cv_bitfield (typ)),
volatile(t1) : uidt(t)

Else

Cond

floating_point?(t) −> uidt(dt_cv_float (typ)),
non_bool_integral_enum ?(t) −> uidt(dt(typ))

EndCond

EndCases,
volatile(t) :
Cases t Of
bool : uidt(dt_bool),
pointer(t1) : uidt(dt_cv_pointer (typ)),
pointer_to_member (c, t1) : uidt(dt_cv_ptm (typ)),
bitfield(t1, bo, s) : uidt(dt_cv_bitfield (typ))

Else

Cond

floating_point?(t) −> uidt(dt_cv_float (typ)),
non_bool_integral_enum ?(t) −> uidt(dt(typ))

EndCond EndCases

Else

Cond

floating_point?(typ) −> uidt(dt_cv_float (typ)),
non_bool_integral_enum ?(typ) −> uidt(dt(typ))

EndCond EndCases

Measure typ by <<
% Array
% −−−−−−−
% 8.3.4 pt 1 contiguouslyallocatedset of N objects
array_size: Axiom
Forall (a : Cpp_Subtype(array?)) :
size(uidt(a)) = size(a) ∗ size(uidt(typ(a)))

% Size Of (3.9 pt 4)
% −−−−−−−−−−−−−−−−−−−−−−
size_of(typ : Cpp_Type) : nat = size(uidt(typ))
% ModuloArithmetic/ FloatingPointValues
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
% arithmetictypes(exceptbool), enums and bitfieldsmay follow the rules
% of arithmeticmodulo2^n where n is the numberof bits in the value
% representation. Floatingpointvaluesmay have to be adjustedto a
% representablehigheror lower value. Pointerseffectivelywraparound,
% althoughthe standardleavesthis behaviourundefined:
% (e.g., char ∗ p = &0 xffffffffp++ = 0).

%

% We thereforeallowvaluemodificationsfor any interpretedtype.

%

% Completingthe specificationof the below underspecifiedfunction
% shouldallowus to add this functionality. Forexample
% mod(typ: cv(unsigned))(n) = n mod 2^max_value_bits (typ)
mod(typ : Cpp_Subtype(cv(non_bool_integral_enum ?)))(n : int) : int
mod_range: Axiom
Forall (typ : Cpp_Subtype(cv(non_bool_integral_enum ?)), n : (range(typ))) :
mod(typ)(n) = n
% proof status:−)
% mod_float_TCC1: TCCObligation
mod_float(typ : Cpp_Subtype(cv(floating_point?)))(n : extended_real) :

extended_real

mod_float_range: Axiom
Forall (typ : Cpp_Subtype(cv(floating_point?)),
n : (range_floating_point (cv_base(typ)))) :
mod_float(typ)(n) = n
% proof status:−)
% value_bitmask_TCC1: TCCObligation
% bits in valuerepresentation
value_bitmask(typ : Cpp_Subtype(cv(non_bool_integral_enum ?))) : Recursive
list[Byte] =
Cases typ Of
char : value_bitmask_char ,
schar : value_bitmask_schar ,
uchar : value_bitmask_uchar ,
short : value_bitmask_short ,
ushort : value_bitmask_ushort ,
int : value_bitmask_int ,
uint : value_bitmask_uint ,
long : value_bitmask_long ,

ulong : value_bitmask_ulong ,
longlong : value_bitmask_longlong ,
ulonglong : value_bitmask_ulonglong ,
wchar_t: value_bitmask_wchar_t ,
enum(n,t,m,c) : value_bitmask_enum (typ),
const(t) : value_bitmask(t),
volatile(t) : value_bitmask(t)

EndCases

Measure typ by <<
Auto_Rewrite− Cpp_Type?
End Cpp_Types

B.33 vfiasco-prelude.pvs

Unit : Datatype
% the unittype(aka semanticof void)

Begin

unit : unit?
End Unit
More_Divides: Theory

Begin

n,m : Var nat
% proof status:−)
expt_divides: Lemma Forall(a : posnat) : a > 1 And n <= m Implies
divides(expt(a, n), expt(a, m))
% proof status:−)
divides_expt_gt: Lemma Forall(i, j : nat) :
j <= i And divides(expt(2, i), n) Implies divides(expt(2, j), n)
End More_Divides

Expt_Lemmas: Theory

Begin

m, n: VAR nat
n0x : VAR nzreal
gt1x, gt1y: VAR {r: posreal | r > 1}
% proof status:−)
both_sides_expt_gt1_le : LEMMA
m <= n IFF expt(gt1x, m) <= expt(gt1x, n)
% proof status:−)
expt_plus: Lemma Forall(n0x : nzreal, m, n : nat) :
expt(n0x, m) ∗ expt(n0x, n) = expt(n0x, m + n)

B.33 vfiasco-prelude.pvs

End Expt_Lemmas

Posnat_induction: Theory

Begin

p: VAR pred[posnat]
i, j : VAR posnat
% proof status:−)
posnat_induction: Lemma
(p(1) And (Forall j: p(j) Implies p(j+1)))
Implies (Forall i: p(i))
End Posnat_induction

Number_Props: Theory

Begin

Importing More_Divides, Expt_Lemmas

% proof status:−)
number_split: Lemma Forall(x : int, a : posnat) :
x = a ∗ ndiv(x, a) + rem(a)(x)
% proof status:−)
number_split_less: Lemma Forall(a, b, p, q : nat) :
a < p Implies
(a + b ∗ p < p ∗ q IFF b < q)
% proof status:−)
bit_split_less: Lemma Forall(q, r, j, k : nat) :
r < expt(2, k) Implies
(q ∗ expt(2, k) + r < expt(2, k + j) IFF
q < expt(2, j))
% proof status:−)
rem_def_pos: Lemma Forall(b : posnat, x : nat) :
Forall(r : mod(b)): rem(b)(x) = r IFF Exists(q : nat): x = b ∗ q + r
% proof status:−)
rem_rem: Lemma Forall(a, b : posnat, x : int) :
divides(a, b) Implies
rem(a)(rem(b)(x)) = rem(a)(x)
% proof status:−)
divides_times: Lemma Forall(i : posnat, j, k : int) :
divides(i ∗ j, k) IFF divides(i, k) And divides(j, ndiv(k, i))
% proof status:−)

ndiv_floor: Lemma Forall(a : int, b : posnat) : ndiv(a,b) = floor(a/b)
% proof status:−)
ndiv_self: Lemma Forall(a : posnat) : ndiv(a,a) = 1
% proof status:−)
ndiv_plus_1: Lemma Forall(a, b : int, c : posnat) :
divides(c, a) Implies
ndiv(a + b, c) = ndiv(a,c) + ndiv(b,c)
% proof status:−)
ndiv_plus_2: Lemma Forall(a, b : int, c : posnat) :
divides(c, b) Implies
ndiv(a + b, c) = ndiv(a,c) + ndiv(b,c)
% proof status:−)
ndiv_plus_mod: Lemma Forall(a : int, c : posnat, b : mod(c)) :
divides(c, a) Implies
ndiv(a + b, c) = ndiv(a, c)
% proof status:−)
ndiv_plus_mod_2 : Lemma Forall(a : int, c : posnat, b1, b2 : mod(c)) :
divides(c, a) Implies
ndiv(a + b1, c) = ndiv(a + b2, c)
% proof status:−)
ndiv_minus_2: Lemma Forall(a, b : int, c : posnat) :
divides(c, b) Implies
ndiv(a − b, c) = ndiv(a,c) − ndiv(b,c)
% ndiv_minus_1is much harder, because it might
% ndiv(a − b, c) = ndiv(a,c) − ndiv(b,c) −1
% if rem(c)(b) > 0 or mightit not??
% proof status:−)
ndiv_times_divident_1 : Lemma Forall(a, b : int, c : posnat) :
divides(c, a) Implies
ndiv(a ∗ b, c) = ndiv(a,c) ∗ b
% proof status:−)
ndiv_times_divident_2 : Lemma Forall(a, b : int, c : posnat) :
divides(c, b) Implies
ndiv(a ∗ b, c) = a ∗ ndiv(b,c)
% proof status:−)
rem_prod_3: Lemma Forall(b1, b2 : posnat, x : int) :
rem(b1 ∗ b2)(x) = rem(b1)(x) + rem(b2)(ndiv(x, b1)) ∗ b1
% proof status:−)
ndiv_times_2: Lemma Forall(a : int, b, c : posnat) :
ndiv(a, b ∗ c) = ndiv(ndiv(a, b), c)

% proof status:−)
both_sides_ndiv_lt1 : Lemma Forall(a, b : int, c : posnat) :
a < b And divides(c, b) Implies
ndiv(a,c) < ndiv(b,c)
% proof status:−)
rem_ndiv: Lemma Forall(a : posnat, b : int, c : posnat) :
rem(a)(ndiv(b, c)) = ndiv(rem(c ∗ a)(b), c)
% proof status:−)
mod_rem: Lemma Forall(i : int, b : posnat) :
mod(i, b) = rem(b)(i)
% proof status:−)
% ndiv_rem_divisible_TCC1 : TCCObligation
% proof status:−)
ndiv_rem_divisible: Lemma Forall(a, c : posnat, b : int) :
divides(c, a) And c <= a Implies
ndiv(rem(a)(b), c) = rem(ndiv(a, c))(ndiv(b,c))
% proof status:−)
expt_2_8: Lemma expt(2, 8) = 256
% proof status:−)
ndiv_0: Lemma Forall(b : posnat) : ndiv(0, b) = 0
% proof status:−)
ndiv_1: Lemma Forall(i : int) : ndiv(i, 1) = i
% proof status:−)
ndiv_bigger: Lemma Forall(n : nat, m : posnat) :
n < m Implies ndiv(n, m) = 0
% proof status:−)
ndiv_reduce: Lemma Forall(a : int, b : posnat, c : int, d : posnat) :
a ∗ d = b ∗ c Implies
ndiv(a,b) = ndiv(c,d)
% proof status:−)
% ndiv_expt_expt_TCC1 : TCCObligation
% proof status:−)
ndiv_expt_expt: Lemma Forall(a : posnat, n, m : nat) :
a > 1 Implies
ndiv(expt(a, n), expt(a, m)) =
IF n < m Then 0
Else expt(a, n − m)

Endif

% Floor: x − rem(x / b)
% ========================

floor(b : posnat)(x : int) : int =
x − rem(b)(x)
% proof status:−)
% min_plus1_TCC1: TCCObligation
% proof status:−)
min_plus1: Lemma
Forall (P : (nonempty?[nat])) :
Not P(0) Implies
min(P) = min(Lambda (n : nat) : P(n + 1)) + 1
% proof status:−)
min_member: Lemma
Forall (P : (nonempty?[nat]), n : nat) :
min(P) = n Implies P(n)
End Number_Props

Extended_Real: Theory

Begin

% The purposeof this theoryis to define arithmeticon real numbers
% that can possiblycontaininfinityvalues(as e.g., in x / oo = 0),
% not−a−thingvalues(e.g., x / 0 = NAT) and exceptionvalues(not
% currentlysupported, i.e., no exceptionwillbe generated).
extended_real? : PRED[number]
extended_real_superset_of_number_fields : Axiom
Forall (n : number_field) : extended_real?(n)
extended_real: Type = (extended_real?)
extended_real_number: Judgement
extended_realSubtype_Ofnumber
% proof status:−)
number_field_extended: Judgement
number_fieldSubtype_Ofextended_real
% extendedreal ops
% −−−−−−−−−−−−−−−−−−−
x, y : Var extended_real
% proof status:−)
% er_plus_TCC1: TCCObligation
% proof status:−)
% er_neg_TCC1: TCCObligation

er_plus(x, y) : extended_real
er_minus(x, y) : extended_real
er_times(x, y) : extended_real
er_div(x, y) : extended_real
er_neg(x) : extended_real
% on numberfieldsthese ops behavelike the numberfield ops
% −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
a, b : Var number_field
er_plus_ax: Axiom
er_plus(a, b) = number_fields.+(a, b)
er_minus_ax: Axiom
er_minus(a, b) = number_fields.−(a, b)
er_times_ax: Axiom
er_times(a, b) = number_fields.∗(a, b)
er_div_ax: Axiom
b /= 0 Implies er_div(a, b) = number_fields./(a, b)
er_neg_ax: Axiom
er_neg(a) = number_fields.−(a)
% Judgements:
% −−−−−−−−−−−−−
% number_field
% ~~~~~~~~~~~~~~
% proof status:−)
er_plus_number_field : Judgement
er_plus(a, b : number_field) Has_Typenumber_field
% proof status:−)
er_minus_number_field : Judgement
er_minus(a, b : number_field) Has_Typenumber_field
% proof status:−)
er_times_number_field : Judgement
er_times(a, b : number_field) Has_Typenumber_field
% proof status:−)
er_div_number_field : Judgement
er_div(a : number_field, b : nznum) Has_Typenumber_field
% proof status:−)
er_neg_number_field : Judgement
er_neg(a : number_field) Has_Typenumber_field
% real

% ~~~~~~
% proof status:−)
er_plus_real: Judgement
er_plus(a, b : real) Has_Typereal
% proof status:−)
er_minus_real: Judgement
er_minus(a, b : real) Has_Typereal
% proof status:−)
er_times_real: Judgement
er_times(a, b : real) Has_Typereal
% proof status:−)
er_div_real: Judgement
er_div(a : real, b : nzreal) Has_Typereal
% proof status:−)
er_neg_real: Judgement
er_neg(a : real) Has_Typereal
% rational
% ~~~~~~~~~~
% proof status:−)
er_plus_rational: Judgement
er_plus(a, b : rational) Has_Typerational
% proof status:−)
er_minus_rational: Judgement
er_minus(a, b : rational) Has_Typerational
% proof status:−)
er_times_rational: Judgement
er_times(a, b : rational) Has_Typerational
% proof status:−)
er_div_rational: Judgement
er_div(a : rational, b : nzrat) Has_Typerational
% proof status:−)
er_neg_rational: Judgement
er_neg(a : rational) Has_Typerational
% integers
% ~~~~~~~~~~
% proof status:−)
er_plus_integer: Judgement
er_plus(a, b : int) Has_Typeint
% proof status:−)
er_minus_integer: Judgement
er_minus(a, b : int) Has_Typeint

% proof status:−)
er_times_integer: Judgement
er_times(a, b : int) Has_Typeint
% proof status:−)
er_neg_integer: Judgement
er_neg(a : int) Has_Typeint
End Extended_Real

More_Sets_Lemmas [T: TYPE]: THEORY

BEGIN

a, b, c : VAR set[T]
% % (auto−rewrite
% % "subset_equal""union_subset1""union_subset3"
% % "union_left""union_right""subset_singleton"
% % "subset_bigger_union_right ""subset_bigger_union_left "
% % "union_left""union_right")
% proof status:−)
subset_equal: Lemma
a = b Implies subset?(a, b)
% proof status:−)
union_subset3: LEMMA subset?(a, union(b, a))
% proof status:−)
subset_bigger_union_left : Lemma
subset?(a, b) Implies subset?(a, union(b, c))
% proof status:−)
subset_bigger_union_right : Lemma
subset?(a, c) Implies subset?(a, union(b, c))
% proof status:−)
union_empty_left: Lemma
union(emptyset, a) = a
% proof status:−)
union_left: Lemma Forall (e : T) :
a(e) Implies union(a, b)(e)
% proof status:−)
union_right: Lemma Forall (e : T) :
b(e) Implies union(a, b)(e)
% proof status:−)
subset_of_differences: Lemma
subset?(a, b) Implies subset?(difference(c, b), difference(c, a))

% proof status:−)
difference_disjoint_3 : LEMMA disjoint?(difference(b, a), a)
% proof status:−)
subset_singleton: Lemma Forall(e : T) :
subset?(singleton(e), a) = a(e)
% proof status:−)
subset_member: Lemma Forall(e : T) :
a(e) And subset?(a, b) Implies b(e)
% proof status:−)
disjoint_symmetric: Lemma
disjoint?(a, b) = disjoint?(b, a)
% proof status:−)
disjoint_mono: Lemma Forall(a1, a2, b1, b2 : set[T]) :
subset?(a1, a2) And subset?(b1, b2) And
disjoint?(a2, b2) Implies
disjoint?(a1, b1)
% proof status:−)
disjoint_subset_difference: Lemma
subset?(a, b) And disjoint?(a, c) Implies
subset?(a, difference(b, c))
End More_Sets_Lemmas

Set_Lift[Data1, Data2 : Type] : Theory

Begin

set_lift(P : PRED[Data1], inj : [Data1 −> Data2]) : PRED[Data2] =
Lambda (d2 : Data2) : Exists (d1 : (P)) : inj(d1) = d2
End Set_Lift

Alignment : Theory

Begin

Importing Number_Props
n,m : Var nat
aligned?(n) : PRED[nat] = { a : nat | divides(expt(2,n), a) }
aligned(n) : Type = (aligned?(n))
% proof status:−)
aligned_zero: Lemma aligned?(n)(0)

% proof status:−)
zero_aligned: Lemma aligned?(0)(n)
% proof status:−)
aligned_bigger: Lemma Forall(n1, n2 : nat) :
n2 <= n1 And aligned?(n1)(m) Implies aligned?(n2)(m)
% aligned_add: Judgement+( a:aligned(n), b:aligned(m))
% HAS_TYPEaligned(min(n,m))
% proof status:−)
aligned_plus: Lemma
Forall(a : aligned(n), b : aligned(m)) : aligned?(min(n,m))(a + b)
% proof status:−)
aligned_plus_n: Lemma
Forall(a, b : aligned(n)) : aligned?(n)(a + b)
% proof status:−)
% aligned_minus_TCC1: TCCObligation
% proof status:−)
aligned_minus: Lemma
Forall(a : aligned(n), b : aligned(m)) :
a >= b Implies aligned?(min(n,m))(a − b)
% proof status:−)
aligned_mult_expt_2 : Lemma
Forall(a : aligned(n)) : aligned?(n + m)(a ∗ expt(2, m))
% proof status:−)
aligned_rem: Lemma Forall(i : nat) :
aligned?(n)(m) Implies aligned?(n)(rem(expt(2, i))(m))
% aligned_minus_rem: LemmaForall(i : nat) :
% aligned?(i)(n − rem(expt(2, i))(n))
% >> (use "rem_def2")(expand"aligned?")(smash)
% proof status:−)
aligned_add_below: Lemma Forall (n, m, i, k : nat) :
i <= k And n < expt(2, k) And aligned?(i)(n) And m < expt(2, i) Implies
n + m < expt(2, k)
End Alignment

More_List_Props [T : Type] : Theory

Begin

% proof status:−)
length_is_cons: Lemma Forall(l : list[T]) :
length(l) > 0 Implies cons?(l)

% proof status:−)
cons_length: Lemma
Forall(l : (cons?[T])) : length(l) > 0
% proof status:−)
% length_cdr_TCC1: TCCObligation
% proof status:−)
length_cdr: Lemma Forall(l : list[T]) :
length(l) > 0 Implies
length(cdr(l)) = length(l) − 1
% proof status:−)
conslist_induction: Lemma
Forall(p: [(cons?[T]) −> boolean]):
(Forall(t : T) : p(cons(t, null))) And
(Forall(t : T, tail : (cons?[T])): p(tail) Implies p(cons(t, tail)))

Implies

Forall (l : (cons?[T])): p(l)
% proof status:−)
% head_TCC1: TCCObligation
% proof status:−)
% head_TCC2: TCCObligation
% proof status:−)
% head_TCC3: TCCObligation
head(l : list[T], n : upto(length(l))) : Recursive list[T] =
If n = 0 Then

null Else

cons(car(l), head(cdr(l), n − 1))

Endif

Measure n
tail(l : list[T], n : upto(length(l))) : Recursive list[T] =
If n = 0 Then

l Else

tail(cdr(l), n − 1)

Endif

Measure n
% proof status:−)
head_tail: Lemma Forall (l : list[T], n : nat) :
n <= length(l) Implies
append(head(l, n), tail(l, n)) = l
% proof status:−)

length_head: Lemma Forall (l : list[T], n : nat) :
n <= length(l) Implies length(head(l, n)) = n
% proof status:−)
length_tail: Lemma Forall (l : list[T], n : nat) :
n <= length(l) Implies length(tail(l, n)) = length(l) − n
% proof status:−)
% nth_head_TCC1: TCCObligation
% proof status:−)
% nth_head_TCC2: TCCObligation
% proof status:−)
nth_head: Lemma Forall(l : list[T], n, i : nat) :
n <= length(l) And i < n Implies
nth(head(l, n), i) = nth(l, i)
% proof status:−)
% nth_tail_TCC1: TCCObligation
% proof status:−)
% nth_tail_TCC2: TCCObligation
% proof status:−)
nth_tail: Lemma Forall(l : list[T], n, i : nat) :
n <= length(l) And i + n < length(l) Implies
nth(tail(l, n), i) = nth(l, n + i)
% proof status:−)
% car_head_TCC1: TCCObligation
% proof status:−)
% car_head_TCC2: TCCObligation
% proof status:−)
car_head: Lemma Forall(l : list[T], n : upto(length(l))) :
n > 0 Implies
car(head(l, n)) = car(l)
% proof status:−)
cons_tail: Lemma Forall(l : list[T], n : upto(length(l))) :
n < length(l) Implies
cons?(tail(l, n))
% proof status:−)
% car_tail_TCC1: TCCObligation
% proof status:−)
car_tail: Lemma Forall(l : list[T], n : upto(length(l))) :
n < length(l) Implies
car(tail(l, n)) = nth(l, n)

% proof status:−)
% cdr_tail_TCC1: TCCObligation
% proof status:−)
cdr_tail: Lemma Forall(l : list[T], n : upto(length(l))) :
n < length(l) Implies
cdr(tail(l, n)) = tail(l, n+1)

% proof status:−)
every_implied: Lemma Forall(l : list[T], P, Q : PRED[T]) :
(Forall (t : T) : P(t) Implies Q(t)) And
every(P)(l)

Implies

every(Q)(l)
% proof status:−)
every_conjunct_left: Lemma Forall(l : list[T], P, Q : PRED[T]) :
every(P)(l) And every(Q)(l) Implies every(lambda(t : T) : P(t) And Q(t))(l)
% proof status:−)
every_iff_forall: Lemma Forall (l : list[T], P : PRED[T]) :
every(P)(l) IFF (Forall (t : T) : member(t, l) Implies P(t))
% proof status:−)
some_iff_exists: Lemma Forall (l : list[T], P : PRED[T]) :
some(P)(l) IFF (Exists (t : T) : member(t, l) And P(t))

% proof status:−)
% list_extensionality_TCC1 : TCCObligation
% proof status:−)
list_extensionality: Lemma Forall(l1, l2 : list[T]) :
l1 = l2 IFF
(length(l1) = length(l2) AND
Forall(i : below(length(l1))) : nth(l1,i) = nth(l2,i))

% proof status:−)
% list_remove_TCC1: TCCObligation
% proof status:−)
% list_remove_TCC2: TCCObligation
list_remove(x : T, l : list[T]) : Recursive list[T] =
Cases l OF
null : null,
cons(car, cdr) :
IF x = car Then list_remove(x, cdr)
Else cons(car, list_remove(x, cdr))

B.33 vfiasco-prelude.pvs

Endif EndCases

Measure length(l)
% proof status:−)
list_remove_commutative: Lemma
Forall(x, y : T, l : list[T]) :
list_remove(x, list_remove(y, l)) = list_remove(y, list_remove(x, l))
% proof status:−)
member_list_remove: Lemma
Forall(x, y : T, l : list[T]) :
member(x, list_remove(y, l)) =
IF x = y then false
Else member(x, l)

EndIF

% proof status:−)
nth_member: Lemma
Forall(x : T, l : list[T]) :
member(x, l) IFF
Exists(i : below(length(l))) : nth(l, i) = x
% proof status:−)
% flatten_TCC1: TCCObligation
flatten(ll : list[list[T]]) : Recursive list[T] =
Cases ll OF
null : null,
cons(car, cdr) : append(car, flatten(cdr))

EndCases

Measure length(ll)
% proof status:−)
member_append: Lemma
Forall(x : T, l1, l2 : list[T]) :
member(x, append(l1, l2)) IFF
member(x, l1) OR member(x, l2)
% proof status:−)
member_flatten: Lemma
Forall(x : T, ll : list[list[T]]) :
member(x, flatten(ll)) IFF
Exists(l : list[T]) :
member(l, ll) And member(x, l)
% proof status:−)

% map2_TCC1: TCCObligation
map2(f : [T, T −> T])(l1, l2 : list[T]) : Recursive list[T] =
Cases l1 Of
null : null,
cons(h1, t1) :
Cases l2 Of
null : null,
cons(h2, t2) : cons(f(h1, h2), map2(f)(t1, t2))

EndCases EndCases

Measure length(l1)
% proof status:−)
map2_property: Lemma
Forall (P : PRED[T], f : [T, T −> T], l1, l2 : list[T]) :
(Forall (t1, t2 : T) : P(f(t1, t2))) Implies
every(P)(map2(f)(l1, l2))
End More_List_Props

More_List_Props_2 [A, B : Type] : Theory

Begin

% proof status:−)
member_map: Lemma
Forall(b : B, f : [A −> B], l : list[A]) :
member(b, map(f)(l)) IFF
Exists(a : A) : member(a, l) And f(a) = b
End More_List_Props_2

More_More_List_Props [T : Type+] : Theory

Begin

% proof status:−)
list_all_length: Lemma Forall (n : nat) :
Exists (l : list[T]) : length(l) = n
End More_More_List_Props

Even_More_List_Props [T : Type, S : Type From T] : Theory

Begin

% proof status:−)
every_extend: Lemma
Forall (l : list[S], P : PRED[T]) :
every(Lambda (t : T) : P(t))(l) Implies every(Lambda (s : S) : P(s))(l)

End Even_More_List_Props

More_Relations[T : Type] : Theory

Begin

Importing More_List_Props% for cons_length
R : Var PRED[[T,T]]
% Zorn’s lemma(I missedit in the prelude)
% proof status:−)
zorn_lr: Lemma
well_founded?(R) Implies
Not Exists (f : [nat −> T]) : Forall (n : nat) : R(f(n+1), f(n))
End More_Relations

More_Function[Domain, Range : Type] : Theory
% some more stuff on functions

Begin

f : Var [Domain −> Range]
% proof status:−)
% restrict_to_image_TCC1 : TCCObligation
restrict_to_image (f) : [Domain −> (image(f, fullset[Domain]))] = f
% proof status:−)
surjective_restrict_to_image : Lemma
surjective?(restrict_to_image (f))
% proof status:−)
bijective_restrict_to_image : Lemma
injective?(f) Implies bijective?(restrict_to_image (f))
End More_Function

Finite_Set_Reduce [T : Type] : Theory

Begin

Importing More_List_Props% for nth_member
S : Var finite_set[T]
% proof status:−)
% list_of_finite_set_TCC1 : TCCObligation
% proof status:−)
% list_of_finite_set_TCC2 : TCCObligation

list_of_finite_set (S) : Recursive list[T] =
IF empty?(S) Then null
Else cons(choose(S), list_of_finite_set (rest(S)))

Endif

Measure card(S)
% proof status:−)
length_list_of_finite_set : Lemma
length(list_of_finite_set (S)) = card(S)
% proof status:−)
member_list_of_finite_set : Lemma
Forall(x : T) :
member(x, S) = member(x, list_of_finite_set (S))
% proof status:−)
unique_member_list_of_finite_set : Lemma
Forall(i, j : below(length(list_of_finite_set (S)))) :
nth(list_of_finite_set (S), i) = nth(list_of_finite_set (S), j) Implies
i = j
End Finite_Set_Reduce

Min_Max_Extension [T : Type, S : Type From T, <= : (total_order?[T])] : Theory

Begin

Importing finite_sets@finite_sets_minmax
% proof status:−)
% max_stable_under_extension_TCC1 : TCCObligation
% proof status:−)
max_stable_under_extension : Lemma
Forall (P : non_empty_finite_set [S]) :
max[T, <=](extend[T, S, bool, false](P)) = max[S, <=](P)
% proof status:−)
min_stable_under_extension : Lemma
Forall (P : non_empty_finite_set [S]) :
min[T, <=](extend[T, S, bool, false](P)) = min[S, <=](P)
End Min_Max_Extension

C Proof scripts

Contents for Appendix C

C.1 Proofs for Abstract_Read_Write (abstract_data.pvs) . . . . . . . . . . . . . . . . . . . . 489
C.1.1 read_data_valid_in_mem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
C.2 Proofs for Abstract_Read_Write_Plain (plain_memory.pvs) . . . . . . . . . . . . . . . . 489
C.3 Proofs for Address_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . 489
C.3.1 address_data_type_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
C.4 Proofs for Address_Helpers (constants.pvs). . . . . . . . . . . . . . . . . . . . . . . . . 489
C.4.1 type_add_rewrite. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
C.4.2 offset_add_rewrite. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
C.4.3 type_add_memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
C.4.4 address_add_zero. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
C.4.5 address_add_sum. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
C.4.6 reg_size_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
C.4.7 reg_size_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
C.5 Proofs for Address_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . . . . 491
C.5.1 address_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
C.5.2 address_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
C.5.3 address_to_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
C.5.4 address_from_byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
C.5.5 address_from_byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
C.5.6 address_from_byte_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493
C.5.7 address_from_byte_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493
C.5.8 address_from_byte_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493
C.5.9 address_model_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
C.5.10 address_valid_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
C.5.11 address_is_pod. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
C.6 Proofs for Address_Util (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
C.6.1 address_block_subset_1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
C.6.2 address_block_subset_2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
C.6.3 blocks_disjoint_disjoint. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
C.6.4 blocks_disjoint_symmetric. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499
C.6.5 blocks_in_larger_set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499
C.6.6 blocks_pairwise_disjoint_add . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499
C.6.7 blocks_pairwise_disjoint_remove . . . . . . . . . . . . . . . . . . . . . . . . . . 503
C.6.8 subset_block_is_free . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503
C.6.9 block_is_free_add. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504
C.7 Proofs for Alignment (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . 504
C.7.1 aligned_zero. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504
C.7.2 zero_aligned. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504
C.7.3 aligned_bigger. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
C.7.4 aligned_plus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
C.7.5 aligned_plus_n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506

C Proof scripts

C.7.6 aligned_minus_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
C.7.7 aligned_minus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
C.7.8 aligned_mult_expt_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
C.7.9 aligned_rem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
C.7.10 aligned_add_below. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510
C.8 Proofs for Allocation_Info (allocators.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . 511
C.8.1 consistent_allocator_state_change. . . . . . . . . . . . . . . . . . . . . . . . . 511
C.8.2 consistent_allocator_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 512
C.8.3 consistent_allocator_read. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 512
C.8.4 consistent_allocator_write_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . 512
C.8.5 consistent_allocator_write. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513
C.8.6 consistent_allocator_alloc_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 513
C.8.7 consistent_allocator_alloc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514
C.8.8 consistent_allocator_free_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . 516
C.8.9 consistent_allocator_free_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . 516
C.8.10 consistent_allocator_free. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 517
C.9 Proofs for Allocation_Table (allocators.pvs). . . . . . . . . . . . . . . . . . . . . . . . . 522
C.9.1 allocation_finite_tree. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522
C.9.2 allocation_subnodes_allocated_and_free . . . . . . . . . . . . . . . . . . . . . . 522
C.9.3 allocation_subnodes_disjoint. . . . . . . . . . . . . . . . . . . . . . . . . . . . 523
C.9.4 allocation_roots_disjoint. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523
C.9.5 allocation_private_memory_disjoint . . . . . . . . . . . . . . . . . . . . . . . . 523
C.9.6 allocation_consistent_allocator. . . . . . . . . . . . . . . . . . . . . . . . . . . 524
C.9.7 allocation_allocated_allocation_point. . . . . . . . . . . . . . . . . . . . . . . 524
C.9.8 allocation_allocation_point_in_memory_pool . . . . . . . . . . . . . . . . . . . 524
C.9.9 allocators_different_in_hierachy. . . . . . . . . . . . . . . . . . . . . . . . . . 525
C.9.10 uppath_memory_pool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525
C.9.11 uppath_memory_pool_allocated_and_free_TCC1 . . . . . . . . . . . . . . . . . 526
C.9.12 uppath_memory_pool_allocated_and_free . . . . . . . . . . . . . . . . . . . . . 527
C.9.13 allocation_memory_pools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527
C.9.14 allocation_info_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532
C.9.15 member_allocation_info . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533
C.9.16 allocation_consistent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533
C.9.17 allocation_alloc_other_private_memory_TCC1 . . . . . . . . . . . . . . . . . . 536
C.9.18 allocation_alloc_other_private_memory_TCC2 . . . . . . . . . . . . . . . . . . 537
C.9.19 allocation_alloc_other_private_memory . . . . . . . . . . . . . . . . . . . . . . 537
C.9.20 allocation_alloc_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538
C.9.21 allocation_alloc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538
C.10 Proofs for Allocator (allocators.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550
C.10.1 null_address_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550
C.10.2 allocator?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550
C.10.3 allocator?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550
C.10.4 allocator?_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
C.10.5 allocator?_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
C.10.6 allocator?_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
C.10.7 allocator?_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555
C.10.8 allocator?_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556
C.10.9 allocator?_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
C.10.10 allocator_subset_private_memory_plain_memory . . . . . . . . . . . . . . . . . 560
C.10.11 allocator_private_memory_in_plain_memory . . . . . . . . . . . . . . . . . . . 560
C.10.12 allocator_subset_allocated_memory_pool . . . . . . . . . . . . . . . . . . . . . 560
C.10.13 allocator_alloc_disjoint. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561

Contents for Appendix C

C.10.14 allocator_allocated_alloc_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . 561
C.10.15 allocator_allocated_alloc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561
C.10.16 allocator_memory_pool_alloc . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562
C.10.17 allocator_subset_address_block_alloc_allocated . . . . . . . . . . . . . . . . . . 562
C.10.18 allocator_free_freed_size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
C.10.19 allocator_allocated_free_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
C.10.20 allocator_allocated_free_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
C.10.21 allocator_allocated_free. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
C.10.22 allocator_memory_pool_free. . . . . . . . . . . . . . . . . . . . . . . . . . . . 564
C.10.23 allocator_const_private_memory_memory_pool . . . . . . . . . . . . . . . . . . 564
C.10.24 allocator_const_private_memory_allocated . . . . . . . . . . . . . . . . . . . . 565
C.10.25 allocator_next_state_alloc_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 565
C.10.26 allocator_next_state_alloc. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565
C.10.27 allocator_next_state_free_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 566
C.10.28 allocator_next_state_free . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
C.10.29 allocator_only_changes_alloc_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 566
C.10.30 allocator_only_changes_alloc . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567
C.10.31 allocator_only_changes_free_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 567
C.10.32 allocator_only_changes_free. . . . . . . . . . . . . . . . . . . . . . . . . . . . 568
C.10.33 allocator_allocated_memory_read_TCC1 . . . . . . . . . . . . . . . . . . . . . 568
C.10.34 allocator_allocated_memory_read. . . . . . . . . . . . . . . . . . . . . . . . . 568
C.10.35 allocator_memory_pool_memory_read . . . . . . . . . . . . . . . . . . . . . . . 569
C.10.36 allocator_stays_unchanged_memory_write_private_mem_TCC1 . . . . . . . . . 570
C.10.37 allocator_stays_unchanged_memory_write_private_mem_TCC2 . . . . . . . . . 570
C.10.38 allocator_stays_unchanged_memory_write_private_mem . . . . . . . . . . . . . 571
C.10.39 allocator_allocated_memory_write . . . . . . . . . . . . . . . . . . . . . . . . . 571
C.10.40 allocator_memory_pool_memory_write . . . . . . . . . . . . . . . . . . . . . . 572
C.10.41 allocator_subset_address_block_alloc_memory_pool . . . . . . . . . . . . . . . 572
C.11 Proofs for ArithmeticExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . 572
C.11.1 mod_impl_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 572
C.11.2 div_impl_pos_range_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573
C.11.3 plus_ptr_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573
C.11.4 plus_ptr_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 574
C.11.5 plus_ptr_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
C.11.6 plus_ptr_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
C.11.7 plus_ptr_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578
C.11.8 plus_ptr_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578
C.11.9 postinc_ptr_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578
C.11.10 postinc_ptr_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578
C.11.11 postinc_ptr_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579
C.11.12 postinc_ptr_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579
C.11.13 subscript_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580
C.11.14 subscript_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580
C.11.15 subscript_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 584
C.11.16 subscript_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 584
C.11.17 ptr_to_nonzero_object_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 584
C.11.18 ptr_to_nonzero_object_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 585
C.11.19 ptr_to_nonzero_object_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . 586
C.11.20 ptr_to_nonzero_object. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 586
C.11.21 minus_ptr_typ_is_Cpp_Type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 615
C.11.22 minus_ptr_typ_is_Cpp_Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615
C.11.23 minus_ptr_ptr_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619

C.11.24 minus_ptr_ptr_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619
C.11.25 minus_ptr_ptr_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620
C.11.26 minus_ptr_ptr_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620
C.11.27 minus_ptr_ptr_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622
C.11.28 minus_ptr_ptr_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623
C.11.29 minus_ptr_ptr_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624
C.11.30 minus_ptr_ptr_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
C.11.31 minus_ptr_ptr_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
C.11.32 minus_ptr_ptr_TCC10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
C.11.33 cmp_pointer_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627
C.11.34 cmp_pointer_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627
C.12 Proofs for AssemblerStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 628
C.13 Proofs for AssignmentExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . 628
C.13.1 assign_times_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 628
C.13.2 assign_plus_ptr_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 628
C.13.3 assign_plus_ptr_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 628
C.14 Proofs for AssignmentExpressions2 (expressions.pvs) . . . . . . . . . . . . . . . . . . . 629
C.15 Proofs for Bitlist_ops (bits.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629
C.15.1 binary_not_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629
C.15.2 binary_and_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629
C.15.3 binary_or_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
C.15.4 binary_xor_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
C.15.5 singleton_zero_mask. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
C.15.6 bit_set?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
C.15.7 bit_set?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
C.16 Proofs for Bitops (bits.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
C.16.1 bit_set_zero_mask . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
C.16.2 bit_set_ndiv_expt2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636
C.16.3 bit_set_full_mask_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636
C.16.4 bit_set_full_mask. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636
C.16.5 bits_equal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639
C.16.6 bits_equal2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 640
C.16.7 bits_equal3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641
C.16.8 bits_equal4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 648
C.16.9 clear_bit_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 648
C.16.10 change_bit_single_bit_op . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 649
C.16.11 change_bit_result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
C.16.12 change_bits_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
C.16.13 change_bits_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668
C.16.14 change_bits_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668
C.16.15 change_bits_unchanged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669
C.16.16 change_bits_below_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670
C.16.17 change_bits_below . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670
C.16.18 binary_not_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672
C.16.19 binary_not_not. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672
C.16.20 binary_and_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673
C.16.21 binary_and_not. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673
C.16.22 binary_and_full_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673
C.16.23 binary_and_full. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674
C.16.24 binary_and_zero_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
C.16.25 binary_and_zero. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
C.16.26 binary_or_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676

C.16.27 binary_or_not. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676
C.16.28 binary_xor_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677
C.16.29 binary_xor_self. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677
C.16.30 binary_or_full. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678
C.16.31 binary_or_zero . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679
C.17 Proofs for Bits (bits.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679
C.17.1 bool_to_nat_below. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679
C.17.2 nat_bool_iso. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 680
C.17.3 cut_bit_zero. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 680
C.17.4 cut_bits_below . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 680
C.17.5 cut_bits_aligned. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 680
C.17.6 aligned_cut_bits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 681
C.17.7 aligned_add_cut_bits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 681
C.17.8 cut_bit_bits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 682
C.17.9 cut_bits_zero. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683
C.17.10 zero_cut_bits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683
C.17.11 cut_bits_cut_bits_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683
C.17.12 cut_bits_cut_bits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683
C.17.13 cut_bit_cut_bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686
C.17.14 shift_bits_left_less_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687
C.17.15 shift_bits_left_less . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687
C.17.16 aligned_shift_bits_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688
C.17.17 aligned_shift_bits_reduce_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 688
C.17.18 aligned_shift_bits_reduce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688
C.17.19 overwrite_bits_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
C.17.20 overwrite_bits_less. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
C.17.21 overwrite_bit_less. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690
C.17.22 overwrite_bool_bit_less . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691
C.17.23 overwrite_shift_bits_less. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691
C.17.24 aligned_overwrite_shift_bits_more . . . . . . . . . . . . . . . . . . . . . . . . . 691
C.17.25 aligned_overwrite_shift_bits_less_TCC1 . . . . . . . . . . . . . . . . . . . . . . 694
C.17.26 aligned_overwrite_shift_bits_less . . . . . . . . . . . . . . . . . . . . . . . . . . 695
C.17.27 cut_bits_shift_bits_left_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 698
C.17.28 cut_bits_shift_bits_left_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 698
C.17.29 cut_bits_shift_bits_left . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 699
C.17.30 cut_bits_shift_bits_left_outside . . . . . . . . . . . . . . . . . . . . . . . . . . . 700
C.17.31 cut_bits_shift_bits_left_overlap_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 701
C.17.32 cut_bits_shift_bits_left_overlap . . . . . . . . . . . . . . . . . . . . . . . . . . . 701
C.17.33 cut_bits_shift_bits_left_in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701
C.17.34 overwrite_shift_bits_zero . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 702
C.17.35 zero_overwrite_shift_bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703
C.17.36 bit_split_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703
C.17.37 bit_split . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704
C.17.38 shift_bits_left_cut_bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705
C.17.39 cut_bits_0_to_below . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707
C.17.40 cut_bits_overwrite_bits_disjoined . . . . . . . . . . . . . . . . . . . . . . . . . 707
C.17.41 cut_bits_overwrite_bool_bit_disjoined . . . . . . . . . . . . . . . . . . . . . . . 715
C.17.42 cut_bits_overwrite_bits_contained . . . . . . . . . . . . . . . . . . . . . . . . . 715
C.17.43 cut_bits_overwrite_shift_bits_disjoint . . . . . . . . . . . . . . . . . . . . . . . 724
C.17.44 cut_bits_overwrite_shift_bits_contained_TCC1 . . . . . . . . . . . . . . . . . . 724
C.17.45 cut_bits_overwrite_shift_bits_contained . . . . . . . . . . . . . . . . . . . . . . 724
C.17.46 cut_bit_overwrite_shift_bits_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 725

C.17.47 cut_bit_overwrite_shift_bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725
C.17.48 cut_bit_overwrite_bool_bit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726
C.17.49 overwrite_shift_bits_merge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728
C.18 Proofs for BitwiseExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . 733
C.19 Proofs for Block_Disjoint_Rewrites (plain_memory_rewrites.pvs) . . . . . . . . . . . . . 733
C.19.1 different_registers_blocks_disjoint. . . . . . . . . . . . . . . . . . . . . . . . . 733
C.20 Proofs for BooleanConversions (conversions.pvs) . . . . . . . . . . . . . . . . . . . . . . 733
C.20.1 pointer_to_bool_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733
C.21 Proofs for CatchAux (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733
C.22 Proofs for Challenge_Device_Memory (device_memory.pvs) . . . . . . . . . . . . . . . . 733
C.22.1 pm_dev_plain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733
C.22.2 pm_dev_states. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734
C.22.3 pm_dev_read. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734
C.22.4 pm_dev_write. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 735
C.22.5 pm_dev_read_side_effect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 735
C.22.6 pm_dev_write_side_effect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 736
C.22.7 pm_dev_ro_rw_addr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 736
C.22.8 device_plain_transformers_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . 737
C.22.9 device_plain_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . 738
C.22.10 device_plain_unchanged_memory_invariant_write . . . . . . . . . . . . . . . . 758
C.22.11 device_plain_unchanged_memory_write_invariant . . . . . . . . . . . . . . . . 762
C.22.12 device_plain_changed_memory_invariant . . . . . . . . . . . . . . . . . . . . . 767
C.22.13 device_plain_read_side_effect_unchanged . . . . . . . . . . . . . . . . . . . . . 768
C.22.14 device_plain_write_side_effect_unchanged . . . . . . . . . . . . . . . . . . . . . 771
C.22.15 device_plain_transformers_ok2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 775
C.22.16 device_memory_plain_memory . . . . . . . . . . . . . . . . . . . . . . . . . . . 786
C.23 Proofs for Challenge_Random_Device (random_device.pvs). . . . . . . . . . . . . . . . 788
C.23.1 IMP_Random_Device_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788
C.23.2 in_blessed_memory_disjoint_device . . . . . . . . . . . . . . . . . . . . . . . . 788
C.23.3 in_blessed_memory_not_device_address . . . . . . . . . . . . . . . . . . . . . . 789
C.23.4 random_side_effects_unchanged_invariant . . . . . . . . . . . . . . . . . . . . . 790
C.23.5 random_side_effects_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . 797
C.23.6 random_side_effects_side_effect_content_unchanged_read . . . . . . . . . . . . 819
C.23.7 random_side_effects_side_effect_content_unchanged_write . . . . . . . . . . . . 824
C.23.8 random_device_plain_memory . . . . . . . . . . . . . . . . . . . . . . . . . . . 829
C.23.9 unaligned_fails_write. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 830
C.23.10 unaligned_fails_read. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 831
C.24 Proofs for CommaExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . 835
C.25 Proofs for Composition_Lifted_Statement_Lifted_Expression (state-transformer.pvs) . . 835
C.26 Proofs for Composition_Lifted_Statement_Lifted_Statement (state-transformer.pvs) . . 835
C.27 Proofs for Composition_Lifted_Statement_Simple_Expression (state-transformer.pvs) . 835
C.28 Proofs for Composition_Lifted_Statement_Simple_Statement (state-transformer.pvs) . . 835
C.29 Proofs for Composition_Simple_Expression_Data_Expression (state-transformer.pvs) . . 836
C.29.1 super_comp_expr_expr_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 836
C.29.2 super_comp_expr_expr_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 836
C.29.3 super_comp_expr_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836
C.30 Proofs for Composition_Simple_Expression_Data_Statement (state-transformer.pvs) . . 837
C.31 Proofs for Composition_Simple_Expression_Simple_Expression (state-transformer.pvs) . 837
C.31.1 comp_expr_forget_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837
C.31.2 super_comp_expr_forget_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . 837
C.31.3 comp_simple_expr_simple_expr_TCC1 . . . . . . . . . . . . . . . . . . . . . . 838
C.31.4 comp_simple_expr_simple_expr . . . . . . . . . . . . . . . . . . . . . . . . . . 838

C.31.5 comp_simple_expr_simple_expr_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . 838
C.31.6 comp_simple_expr_simple_expr_ok . . . . . . . . . . . . . . . . . . . . . . . . . 839
C.31.7 comp_simple_expr_simple_expr_data_TCC1 . . . . . . . . . . . . . . . . . . . 839
C.31.8 comp_simple_expr_simple_expr_data . . . . . . . . . . . . . . . . . . . . . . . 839
C.31.9 comp_simple_expr_simple_expr_state_TCC1 . . . . . . . . . . . . . . . . . . . 839
C.31.10 comp_simple_expr_simple_expr_state . . . . . . . . . . . . . . . . . . . . . . . 840
C.32 Proofs for Composition_Simple_Statement_Lifted_Expression (state-transformer.pvs) . 840
C.33 Proofs for Composition_Simple_Statement_Lifted_Statement (state-transformer.pvs) . . 840
C.34 Proofs for Composition_Simple_Statement_Simple_Expression (state-transformer.pvs) . 841
C.34.1 comp_simple_stmt_simple_expr_TCC1 . . . . . . . . . . . . . . . . . . . . . . 841
C.34.2 comp_simple_stmt_simple_expr . . . . . . . . . . . . . . . . . . . . . . . . . . 841
C.34.3 comp_simple_stmt_simple_expr_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . 841
C.34.4 comp_simple_stmt_simple_expr_ok . . . . . . . . . . . . . . . . . . . . . . . . 842
C.34.5 comp_simple_stmt_simple_expr_data_TCC1 . . . . . . . . . . . . . . . . . . . 842
C.34.6 comp_simple_stmt_simple_expr_data . . . . . . . . . . . . . . . . . . . . . . . 842
C.34.7 comp_simple_stmt_simple_expr_state_TCC1 . . . . . . . . . . . . . . . . . . . 843
C.34.8 comp_simple_stmt_simple_expr_state . . . . . . . . . . . . . . . . . . . . . . . 843
C.35 Proofs for Composition_Simple_Statement_Simple_Statement (state-transformer.pvs) . 843
C.36 Proofs for ConditionalExpression (expressions.pvs) . . . . . . . . . . . . . . . . . . . . 844
C.37 Proofs for Control_Register_Datatype (paging-data.pvs). . . . . . . . . . . . . . . . . . 844
C.37.1 cr0_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 844
C.37.2 cr2_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 844
C.37.3 cr4_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 844
C.38 Proofs for Control_Register_Types (paging-data.pvs). . . . . . . . . . . . . . . . . . . 844
C.39 Proofs for Conversions (conversions.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . 845
C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs). . . . . . . . . . . . . . . . . . 845
C.40.1 no_pointers_to_bitfield?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 845
C.40.2 no_cv_references?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 845
C.40.3 no_reference_to_reference?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 845
C.40.4 no_array_of_references?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 846
C.40.5 no_pointer_or_ref_to_incomplete_array_parameter?_TCC1 . . . . . . . . . . . . 846
C.40.6 no_pointer_or_ref_to_incomplete_array_parameter?_TCC2 . . . . . . . . . . . . 847
C.40.7 no_pointer_or_ref_to_incomplete_array_parameter?_TCC3 . . . . . . . . . . . . 847
C.40.8 no_pointer_or_ref_to_incomplete_array_parameter?_TCC4 . . . . . . . . . . . . 848
C.40.9 no_pointer_or_ref_to_incomplete_array_parameter?_TCC5 . . . . . . . . . . . . 848
C.40.10 no_pointer_or_ref_to_incomplete_array_parameter?_TCC6 . . . . . . . . . . . . 849
C.40.11 bitfield_underlying_integral_or_enum_type?_TCC1 . . . . . . . . . . . . . . . . 849
C.40.12 enum_underlying_integral?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 850
C.40.13 enum_constants?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850
C.40.14 enum_constants?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850
C.40.15 const_volatile?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850
C.40.16 const_stutter?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 851
C.40.17 cv_array?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 851
C.40.18 cv_base_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 851
C.40.19 cv_base_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852
C.40.20 cv_base_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852
C.40.21 cv_base_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852
C.40.22 cv_base_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 853
C.40.23 subterm_cv_base. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 853
C.40.24 cv_base_result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 858
C.40.25 cv_base_result2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860
C.40.26 cv_base_not_const . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860

C.40.27 cv_base_not_volatile. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864
C.40.28 cv_base_cv. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 868
C.40.29 layout_compatible?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 873
C.40.30 layout_compatible_enums_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . 873
C.40.31 layout_compatible_enums_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . 873
C.41 Proofs for Cpp_Deep_Types (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . 874
C.41.1 Cpp_Type__pointer_to_member_eta_TCC1 . . . . . . . . . . . . . . . . . . . . 874
C.41.2 Cpp_Type__pointer_to_member_eta_TCC2 . . . . . . . . . . . . . . . . . . . . 874
C.41.3 Cpp_Type__typ_pointer_to_member_TCC1 . . . . . . . . . . . . . . . . . . . . 874
C.41.4 subterm_less. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 875
C.41.5 subterm_transitive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 881
C.41.6 c_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885
C.41.7 v_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886
C.41.8 cv_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886
C.41.9 cv_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886
C.41.10 cv_implied. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 887
C.41.11 pod?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888
C.41.12 uidt_void_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889
C.42 Proofs for Cpp_Examples (cpp-examples.pvs) . . . . . . . . . . . . . . . . . . . . . . . 889
C.42.1 spec01 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889
C.42.2 PRECONDITION_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890
C.42.3 PRECONDITION_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891
C.42.4 PRECONDITION_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 892
C.42.5 PRECONDITION_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 892
C.42.6 POSTCONDITION_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893
C.42.7 spec02_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894
C.42.8 spec02 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894
C.42.9 spec03 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 895
C.42.10 spec04_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 897
C.42.11 spec04_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 897
C.42.12 spec04 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 898
C.42.13 spec05 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 900
C.42.14 spec06_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901
C.42.15 spec06_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 902
C.42.16 spec06_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 902
C.42.17 spec06_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 902
C.42.18 spec06 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 903
C.42.19 spec07 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 904
C.42.20 N_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 906
C.42.21 range_int_values_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 906
C.42.22 range_int_values. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 907
C.42.23 spec08_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 908
C.42.24 spec08 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 908
C.42.25 spec09 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 910
C.42.26 spec10_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 912
C.42.27 spec10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 912
C.43 Proofs for Cpp_Integral_Types (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . 913
C.43.1 range_integral_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 913
C.43.2 range_integral_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 914
C.43.3 range_integral_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 914
C.43.4 range_integral_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 914
C.43.5 range_integral_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 915

C.43.6 range_integral_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 915
C.43.7 range_floating_point_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 916
C.43.8 dt_integral_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 916
C.43.9 dt_integral_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 918
C.43.10 dt_integral_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 920
C.43.11 dt_integral_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 922
C.43.12 dt_integral_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 924
C.43.13 dt_integral_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 925
C.43.14 dt_integral_TCC7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 927
C.43.15 dt_integral_TCC8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 929
C.43.16 dt_integral_TCC9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 930
C.43.17 dt_integral_TCC10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 932
C.43.18 dt_integral_TCC11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 934
C.43.19 dt_integral_TCC12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 936
C.43.20 dt_floating_point_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 938
C.43.21 dt_floating_point_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 940
C.43.22 dt_floating_point_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 942
C.43.23 range_integral_unsigned_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . 943
C.43.24 range_integral_unsigned. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 944
C.43.25 max_value_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 945
C.43.26 max_value_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 946
C.43.27 min_value_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 946
C.43.28 max_value_unsigned. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 947
C.43.29 min_value_unsigned. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948
C.43.30 max_value_bits_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949
C.43.31 max_value_bits_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949
C.43.32 max_value_bits_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949
C.43.33 max_value_bits_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 950
C.43.34 max_value_bits_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 950
C.43.35 max_value_bits_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 950
C.44 Proofs for Cpp_Types (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 951
C.44.1 alignment_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 951
C.44.2 alignment_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 951
C.44.3 alignment_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 952
C.44.4 alignment_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 952
C.44.5 alignment_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 952
C.44.6 alignment_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 952
C.44.7 alignment_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953
C.44.8 alignment_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953
C.44.9 alignment_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953
C.44.10 alignment_TCC10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953
C.44.11 alignment_TCC11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954
C.44.12 alignment_TCC12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954
C.44.13 alignment_TCC13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954
C.44.14 pointer_to_aligned_object_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 955
C.44.15 pointer_to_aligned_object_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . 955
C.44.16 pointer_to_aligned_object_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . 958
C.44.17 align_array_of_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 958
C.44.18 align_array_of_type_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 958
C.44.19 range_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959
C.44.20 range_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959
C.44.21 range_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959

C.44.22 range_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 960
C.44.23 range_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 961
C.44.24 range_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 961
C.44.25 range_TCC7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 962
C.44.26 range_cv_base_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 962
C.44.27 range_cv_base. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 965
C.44.28 dt_non_bool_integral_enum_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 968
C.44.29 dt_non_bool_integral_enum_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . 968
C.44.30 dt_non_bool_integral_enum_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . 971
C.44.31 dt_non_bool_integral_enum_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . 971
C.44.32 dt_non_bool_integral_enum_pod . . . . . . . . . . . . . . . . . . . . . . . . . . 973
C.44.33 dt_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 978
C.44.34 dt_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 990
C.44.35 dt_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 992
C.44.36 dt_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 997
C.44.37 dt_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1000
C.44.38 dt_pod. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1000
C.44.39 dt_cv_pointer_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1013
C.44.40 dt_cv_pointer_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014
C.44.41 dt_cv_pointer_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014
C.44.42 dt_cv_pointer_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015
C.44.43 dt_cv_pointer_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015
C.44.44 dt_cv_pointer_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016
C.44.45 dt_cv_pointer_TCC7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016
C.44.46 dt_cv_pointer_TCC8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020
C.44.47 dt_cv_pointer_TCC9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020
C.44.48 dt_cv_pointer_TCC10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1021
C.44.49 dt_cv_pointer_TCC11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1021
C.44.50 dt_cv_pointer_TCC12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1021
C.44.51 dt_cv_pointer_TCC13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1022
C.44.52 dt_cv_pointer_TCC14. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1025
C.44.53 dt_cv_pointer_TCC15. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1026
C.44.54 dt_cv_bitfield_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027
C.44.55 dt_cv_bitfield_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027
C.44.56 dt_cv_bitfield_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1028
C.44.57 dt_cv_bitfield_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1028
C.44.58 dt_cv_bitfield_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1028
C.44.59 dt_cv_bitfield_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1029
C.44.60 dt_cv_bitfield_TCC7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1030
C.44.61 dt_cv_bitfield_TCC8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1033
C.44.62 dt_cv_bitfield_TCC9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1033
C.44.63 dt_cv_bitfield_TCC10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1034
C.44.64 dt_cv_bitfield_TCC11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1034
C.44.65 dt_cv_bitfield_TCC12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1035
C.44.66 dt_cv_bitfield_TCC13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1035
C.44.67 dt_cv_bitfield_TCC14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1039
C.44.68 dt_cv_bitfield_TCC15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1039
C.44.69 dt_cv_ptm_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1040
C.44.70 dt_cv_ptm_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1040
C.44.71 dt_cv_ptm_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1041
C.44.72 dt_cv_ptm_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042
C.44.73 dt_cv_ptm_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042

C.44.74 dt_cv_ptm_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042
C.44.75 dt_cv_ptm_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1043
C.44.76 dt_cv_ptm_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1047
C.44.77 dt_cv_ptm_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1047
C.44.78 dt_cv_ptm_TCC10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048
C.44.79 dt_cv_ptm_TCC11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048
C.44.80 dt_cv_ptm_TCC12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1049
C.44.81 dt_cv_ptm_TCC13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1049
C.44.82 dt_cv_ptm_TCC14. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1052
C.44.83 dt_cv_ptm_TCC15. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1053
C.44.84 dt_cv_float_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1054
C.44.85 dt_cv_float_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1054
C.44.86 dt_cv_float_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1055
C.44.87 dt_cv_float_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1055
C.44.88 dt_cv_float_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056
C.44.89 dt_cv_float_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056
C.44.90 dt_cv_float_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1057
C.44.91 dt_cv_float_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1061
C.44.92 dt_cv_float_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1061
C.44.93 dt_cv_float_TCC10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1062
C.44.94 dt_cv_float_TCC11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1062
C.44.95 dt_cv_float_TCC12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1063
C.44.96 dt_cv_float_TCC13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1064
C.44.97 dt_cv_float_TCC14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1067
C.44.98 dt_cv_float_TCC15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1068
C.44.99 uidt_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069
C.44.100 uidt_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069
C.44.101 uidt_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069
C.44.102 uidt_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1070
C.44.103 uidt_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1070
C.44.104 uidt_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1070
C.44.105 uidt_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
C.44.106 uidt_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
C.44.107 uidt_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
C.44.108 uidt_TCC10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071
C.44.109 uidt_TCC11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
C.44.110 uidt_TCC12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
C.44.111 uidt_TCC13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072
C.44.112 uidt_TCC14. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073
C.44.113 uidt_TCC15. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073
C.44.114 uidt_TCC16. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073
C.44.115 uidt_TCC17. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074
C.44.116 uidt_TCC18. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074
C.44.117 uidt_TCC19. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075
C.44.118 uidt_TCC20. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075
C.44.119 uidt_TCC21. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075
C.44.120 uidt_TCC22. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076
C.44.121 uidt_TCC23. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076
C.44.122 uidt_TCC24. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076
C.44.123 uidt_TCC25. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077
C.44.124 uidt_TCC26. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077
C.44.125 uidt_TCC27. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077

C.44.126 uidt_TCC28. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078
C.44.127 uidt_TCC29. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078
C.44.128 uidt_TCC30. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078
C.44.129 uidt_TCC31. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079
C.44.130 uidt_TCC32. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079
C.44.131 uidt_TCC33. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079
C.44.132 uidt_TCC34. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080
C.44.133 uidt_TCC35. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080
C.44.134 uidt_TCC36. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080
C.44.135 uidt_TCC37. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1081
C.44.136 uidt_TCC38. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1081
C.44.137 uidt_TCC39. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082
C.44.138 uidt_TCC40. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082
C.44.139 uidt_TCC41. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1083
C.44.140 mod_float_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1083
C.44.141 value_bitmask_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084
C.45 Proofs for Cpp_Verification (cpp-verification.pvs) . . . . . . . . . . . . . . . . . . . . . 1084
C.46 Proofs for Cpp_array (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084
C.46.1 uidt_array_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1084
C.47 Proofs for Cpp_bitfield (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1085
C.47.1 range_bitfield_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1085
C.47.2 bitfield_range_underlying_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1086
C.47.3 bitfield_range_underlying_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 1086
C.47.4 bitfield_range_underlying_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . 1086
C.47.5 dt_bitfield_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087
C.48 Proofs for Cpp_bool (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087
C.48.1 range_bool_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087
C.48.2 dt_bool_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49 Proofs for Cpp_char (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49.1 dt_char_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49.2 value_bitmask_char_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49.3 min_char. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088
C.49.4 max_char . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1089
C.49.5 char_binary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1091
C.50 Proofs for Cpp_class (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1094
C.50.1 uidt_class_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1094
C.51 Proofs for Cpp_const_volatile (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 1095
C.51.1 dt_volatile_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095
C.52 Proofs for Cpp_double (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095
C.52.1 dt_double_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095
C.53 Proofs for Cpp_enum (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
C.53.1 valid_range?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
C.53.2 valid_range?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
C.53.3 range_enum_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096
C.53.4 dt_enum_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1097
C.53.5 value_bitmask_enum_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098
C.53.6 enum_size_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
C.53.7 enum_size_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
C.54 Proofs for Cpp_float (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
C.54.1 range_float_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099
C.54.2 dt_float_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100
C.55 Proofs for Cpp_function (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100

C.55.1 uidt_function_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100
C.55.2 dt_vtable_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100
C.56 Proofs for Cpp_int (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1101
C.56.1 range_int_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1101
C.56.2 dt_int_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
C.56.3 value_bitmask_int_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
C.57 Proofs for Cpp_long (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
C.57.1 range_long_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1102
C.57.2 dt_long_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.57.3 value_bitmask_long_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.58 Proofs for Cpp_longdouble (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.58.1 dt_longdouble_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.59 Proofs for Cpp_longlong (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.59.1 range_longlong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103
C.59.2 dt_longlong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
C.59.3 value_bitmask_longlong_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
C.60 Proofs for Cpp_pointer (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
C.60.1 dt_pointer_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1104
C.60.2 pointers_to_layout_compatible_range_TCC1 . . . . . . . . . . . . . . . . . . . 1105
C.60.3 pointers_to_layout_compatible_range_TCC2 . . . . . . . . . . . . . . . . . . . 1105
C.60.4 pointers_to_layout_compatible_range_TCC3 . . . . . . . . . . . . . . . . . . . 1106
C.60.5 pointers_to_layout_compatible_range_TCC4 . . . . . . . . . . . . . . . . . . . 1106
C.60.6 pointers_to_layout_compatible_dt_TCC1 . . . . . . . . . . . . . . . . . . . . . 1106
C.60.7 void_pointer_char_pointer_dt_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 1107
C.60.8 add_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107
C.60.9 add_spec2_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107
C.60.10 add_spec2_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107
C.60.11 add_simplification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108
C.60.12 void_pointer_other_pointer_value_TCC1 . . . . . . . . . . . . . . . . . . . . . 1110
C.60.13 void_pointer_other_pointer_value_TCC2 . . . . . . . . . . . . . . . . . . . . . 1110
C.61 Proofs for Cpp_pointer_to_member (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1111
C.61.1 dt_ptm_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1111
C.62 Proofs for Cpp_reference (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112
C.62.1 dt_reference_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112
C.63 Proofs for Cpp_schar (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112
C.63.1 range_schar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112
C.63.2 dt_schar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113
C.63.3 schar_value_eq_uchar_value_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 1113
C.63.4 value_bitmask_schar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113
C.64 Proofs for Cpp_short (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114
C.64.1 range_short_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114
C.64.2 dt_short_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114
C.64.3 value_bitmask_short_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114
C.65 Proofs for Cpp_uchar (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
C.65.1 range_uchar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
C.65.2 dt_uchar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
C.65.3 value_bitmask_uchar_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115
C.66 Proofs for Cpp_uint (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1116
C.66.1 range_uint_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1116
C.66.2 dt_uint_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1116
C.66.3 uint_represenation_same_for_positive_int_TCC1 . . . . . . . . . . . . . . . . . 1116
C.66.4 value_bitmask_uint_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117

C.67 Proofs for Cpp_ulong (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117
C.67.1 range_ulong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117
C.67.2 dt_ulong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117
C.67.3 ulong_represenation_same_for_positive_long_TCC1 . . . . . . . . . . . . . . . 1118
C.67.4 value_bitmask_ulong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118
C.68 Proofs for Cpp_ulonglong (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118
C.68.1 range_ulonglong_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118
C.68.2 dt_ulonglong_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119
C.68.3 ulonglong_represenation_same_for_positive_longlong_TCC1 . . . . . . . . . . . 1119
C.68.4 value_bitmask_ulonglong_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1119
C.69 Proofs for Cpp_union (types.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
C.69.1 uidt_union_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
C.70 Proofs for Cpp_ushort (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
C.70.1 range_ushort_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120
C.70.2 dt_ushort_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1121
C.70.3 ushort_represenation_same_for_positive_short_TCC1 . . . . . . . . . . . . . . 1121
C.70.4 value_bitmask_ushort_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1121
C.71 Proofs for Cpp_wchar_t (types.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
C.71.1 range_wchar_t_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
C.71.2 dt_wchar_t_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
C.71.3 value_bitmask_wchar_t_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1122
C.72 Proofs for Datatype_Model (datatype_model.pvs). . . . . . . . . . . . . . . . . . . . . 1123
C.72.1 uidt_1_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
C.72.2 pod_1_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
C.72.3 pod_1_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
C.72.4 pod_1_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123
C.72.5 pod_1_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1124
C.72.6 uidt_2_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1124
C.72.7 pod_2_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1124
C.72.8 pod_2_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125
C.72.9 pod_2_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125
C.73 Proofs for Datatype_Model_2 (datatype_model.pvs). . . . . . . . . . . . . . . . . . . . 1125
C.73.1 uidt_bool_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125
C.73.2 pod_bool_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1126
C.73.3 pod_bool_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127
C.73.4 pod_bool_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127
C.73.5 pod_bool_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127
C.73.6 pod_bool_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127
C.73.7 pod_bool_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1128
C.73.8 uidt_Byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129
C.73.9 uidt_Byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129
C.73.10 pod_Byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129
C.73.11 pod_Byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130
C.73.12 pod_Byte_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130
C.73.13 pod_Byte_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130
C.73.14 pod_Byte_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1131
C.74 Proofs for DeclarationStatements1 (statements.pvs) . . . . . . . . . . . . . . . . . . . . 1131
C.75 Proofs for DeclarationStatements2 (statements.pvs) . . . . . . . . . . . . . . . . . . . . 1131
C.76 Proofs for Device_Memory (device_memory.pvs). . . . . . . . . . . . . . . . . . . . . . 1131
C.77 Proofs for EqualityExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . 1131
C.78 Proofs for Error_Code_Types (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 1131
C.79 Proofs for Even_More_List_Props (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . 1132

C.79.1 every_extend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1132
C.80 Proofs for Exception_type (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 1132
C.81 Proofs for Exception_type_adt (Exception_type_adt.pvs) . . . . . . . . . . . . . . . . . 1132
C.82 Proofs for Exception_type_adt_reduce (Exception_type_adt.pvs) . . . . . . . . . . . . . 1133
C.83 Proofs for Expand_State (device_memory.pvs). . . . . . . . . . . . . . . . . . . . . . . 1133
C.83.1 em_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133
C.83.2 em_transformer_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133
C.83.3 em_lift_singleton. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133
C.84 Proofs for Expand_State2 (device_memory.pvs) . . . . . . . . . . . . . . . . . . . . . . 1134
C.84.1 em_lift_expr_2_super . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1134
C.85 Proofs for Expand_State3 (device_memory.pvs) . . . . . . . . . . . . . . . . . . . . . . 1134
C.85.1 em_memory_read_transformers. . . . . . . . . . . . . . . . . . . . . . . . . . 1134
C.85.2 em_memory_write_transformers . . . . . . . . . . . . . . . . . . . . . . . . . . 1135
C.85.3 em_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . . . . . . 1137
C.85.4 em_changed_memory_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . 1137
C.85.5 em_const_unchanged_memory_invariant_TCC1 . . . . . . . . . . . . . . . . . 1139
C.85.6 em_const_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . . 1139
C.85.7 em_side_effect_content_unchanged . . . . . . . . . . . . . . . . . . . . . . . . . 1140
C.86 Proofs for ExprResult (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1140
C.87 Proofs for ExprResult_adt (ExprResult_adt.pvs). . . . . . . . . . . . . . . . . . . . . . 1140
C.88 Proofs for ExprResult_adt_map (ExprResult_adt.pvs) . . . . . . . . . . . . . . . . . . . 1140
C.89 Proofs for ExprResult_adt_reduce (ExprResult_adt.pvs) . . . . . . . . . . . . . . . . . . 1141
C.90 Proofs for ExpressionStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1141
C.91 Proofs for Expression_Composition_Rewrites (state-transformer.pvs) . . . . . . . . . . . 1141
C.91.1 comp_eval_if_ok_fexpr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141
C.92 Proofs for Expressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . 1141
C.93 Proofs for Expt_Lemmas (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1141
C.93.1 both_sides_expt_gt1_le . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141
C.93.2 expt_plus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
C.94 Proofs for Extended_Real (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . . 1142
C.94.1 number_field_extended. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
C.94.2 er_plus_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
C.94.3 er_neg_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142
C.94.4 er_plus_number_field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143
C.94.5 er_minus_number_field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143
C.94.6 er_times_number_field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143
C.94.7 er_div_number_field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143
C.94.8 er_neg_number_field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
C.94.9 er_plus_real. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
C.94.10 er_minus_real. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
C.94.11 er_times_real. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144
C.94.12 er_div_real. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145
C.94.13 er_neg_real . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145
C.94.14 er_plus_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145
C.94.15 er_minus_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145
C.94.16 er_times_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
C.94.17 er_div_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
C.94.18 er_neg_rational. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
C.94.19 er_plus_integer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146
C.94.20 er_minus_integer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147
C.94.21 er_times_integer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147
C.94.22 er_neg_integer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147

C.95 Proofs for Finite_Set_Reduce (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . 1147
C.95.1 list_of_finite_set_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147
C.95.2 list_of_finite_set_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1148
C.95.3 length_list_of_finite_set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1148
C.95.4 member_list_of_finite_set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1149
C.95.5 unique_member_list_of_finite_set . . . . . . . . . . . . . . . . . . . . . . . . . . 1151
C.96 Proofs for General (constants.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.96.1 Byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.96.2 less_than_max_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.97 Proofs for Graph (graph.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.97.1 path?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1156
C.97.2 path?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
C.97.3 path?_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
C.97.4 path?_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
C.97.5 nodes_path_start. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157
C.97.6 nodes_path_end. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1158
C.97.7 path_head_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1158
C.97.8 path_head. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1159
C.97.9 path_tail_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1159
C.97.10 path_tail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1160
C.97.11 path_cdr_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1160
C.97.12 path_cdr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1161
C.97.13 path_concat_path. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1161
C.97.14 trans_closure_char_graph . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1164
C.97.15 path_cycle_free. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1167
C.97.16 different_nodes_on_edge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171
C.97.17 tree_path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1172
C.97.18 root_path_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177
C.97.19 path_length_bound_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177
C.97.20 path_length_bound. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177
C.97.21 non_root_path. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1178
C.97.22 non_root_path_extend_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1180
C.97.23 non_root_path_extend. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1180
C.97.24 tree_path_to_root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1182
C.97.25 tree_unique_path_to_root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1187
C.97.26 root_path_singleton. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1196
C.97.27 path_to_root_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197
C.97.28 path_factor_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197
C.97.29 path_factor_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197
C.97.30 path_factor_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198
C.97.31 path_factor_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198
C.97.32 path_factor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199
C.97.33 node_pair_distinction_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1206
C.97.34 node_pair_distinction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1207
C.97.35 symmetric_node_pair_distinction_TCC1 . . . . . . . . . . . . . . . . . . . . . 1226
C.97.36 symmetric_node_pair_distinction. . . . . . . . . . . . . . . . . . . . . . . . . 1227
C.98 Proofs for Graph_Relations (graph.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
C.98.1 trans_closure_char_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
C.98.2 trans_closure_char_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
C.98.3 trans_closure_char_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1228
C.98.4 trans_closure_char. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1229
C.99 Proofs for Graph_Util (graph.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238

C.99.1 every_nth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238
C.99.2 nth_append_left_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1240
C.99.3 nth_append_left. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241
C.99.4 nth_append_right_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1242
C.99.5 nth_append_right. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1242
C.99.6 list_pred_card. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1243
C.99.7 path_start_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247
C.99.8 path_end_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247
C.99.9 path_list_induction_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247
C.99.10 path_list_induction_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1248
C.99.11 path_list_induction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1248
C.99.12 concat_path_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1249
C.99.13 concat_path_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1249
C.99.14 length_concat_path. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1250
C.100 Proofs for Hoare (hoare.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1250
C.100.1 valid_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1250
C.100.2 valid_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1251
C.100.3 valid_and . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1251
C.100.4 valid_implied . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1251
C.100.5 Valid_and . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.101 Proofs for IA32 (constants.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.101.1 max_linear_offset_val . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.101.2 mem_addr_4g_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.102 Proofs for Import_All (everything.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252
C.103 Proofs for IntegralConversions (conversions.pvs) . . . . . . . . . . . . . . . . . . . . . . 1252
C.104 Proofs for IntegralPromotions (conversions.pvs) . . . . . . . . . . . . . . . . . . . . . . 1253
C.104.1 int_conversion_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1253
C.104.2 int_conversion_spec_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1253
C.104.3 int_conversion_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1254
C.104.4 int_conversion_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1255
C.104.5 bool2int_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1255
C.104.6 bool2int_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1256
C.105 Proofs for Interpreted_Data (abstract_data.pvs). . . . . . . . . . . . . . . . . . . . . . 1256
C.105.1 interpreted_data_type?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1256
C.105.2 pod_is_interpreted_data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257
C.105.3 pod_size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257
C.105.4 data_type_length. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257
C.105.5 length_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257
C.105.6 valid_from_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
C.105.7 valid_iff_from_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
C.105.8 valid_to_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
C.105.9 up_from_byte_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258
C.105.10 from_byte_to_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259
C.105.11 in_blessed_memory_subset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259
C.106 Proofs for Interpreted_Data_Lift (abstract_data.pvs) . . . . . . . . . . . . . . . . . . . . 1259
C.107 Proofs for IterationStatements1 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1259
C.107.1 iterate_while_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259
C.107.2 iterate_while_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1260
C.107.3 while_termination_point?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1260
C.107.4 while_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1260
C.107.5 nonzero_min_while_termination_point . . . . . . . . . . . . . . . . . . . . . . . 1260
C.107.6 while_as_if_while. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1261

C.107.7 iterate_do_as_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1282
C.107.8 do_termination_point?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . 1283
C.107.9 termination_point_do_as_while_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 1283
C.107.10 termination_point_do_as_while . . . . . . . . . . . . . . . . . . . . . . . . . . . 1283
C.107.11 do_while_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1284
C.107.12 do_as_while. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1284
C.107.13 do_while_unroll. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287
C.108 Proofs for IterationStatements2 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1287
C.108.1 iterate_for_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287
C.108.2 iterate_for_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287
C.108.3 iterate_for_as_while_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1288
C.108.4 iterate_for_as_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1288
C.108.5 for_termination_point?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1290
C.108.6 termination_point_for_as_while_TCC1 . . . . . . . . . . . . . . . . . . . . . . 1291
C.108.7 termination_point_for_as_while . . . . . . . . . . . . . . . . . . . . . . . . . . 1292
C.108.8 min_termination_point_for_as_while_TCC1 . . . . . . . . . . . . . . . . . . . . 1292
C.108.9 min_termination_point_for_as_while_TCC2 . . . . . . . . . . . . . . . . . . . . 1292
C.108.10 min_termination_point_for_as_while_TCC3 . . . . . . . . . . . . . . . . . . . . 1294
C.108.11 min_termination_point_for_as_while . . . . . . . . . . . . . . . . . . . . . . . . 1295
C.108.12 nonzero_min_for_termination_point_TCC1 . . . . . . . . . . . . . . . . . . . . 1296
C.108.13 nonzero_min_for_termination_point . . . . . . . . . . . . . . . . . . . . . . . . 1297
C.108.14 for_as_while. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1297
C.108.15 for_unroll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1324
C.109 Proofs for IterationStatements3 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1325
C.109.1 do_while_inv_unroll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1325
C.110 Proofs for IterationStatements4 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . 1325
C.110.1 for_inv_unroll. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1325
C.111 Proofs for JumpStatements1 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1326
C.112 Proofs for JumpStatements2 (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1326
C.113 Proofs for LabeledStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . 1326
C.114 Proofs for Linear_Memory (linear_memory.pvs) . . . . . . . . . . . . . . . . . . . . . . 1326
C.114.1 xlat_idx_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1326
C.114.2 xlat_idx_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327
C.114.3 xlat_idx_pe_aligned_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327
C.114.4 xlat_idx_pe_aligned_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327
C.114.5 xlat_idx_pe_aligned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327
C.114.6 xlat_idx_memory_address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1331
C.114.7 xlat_idx_memory_address2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1332
C.114.8 xlat_ofs_memory_address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1333
C.114.9 xlat_ofs_memory_address2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1333
C.114.10 raise_fault_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1334
C.114.11 translate_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1335
C.114.12 translate_memory_address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1335
C.114.13 translate_memory_address2. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1340
C.114.14 translate_result_leaf_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1346
C.114.15 translate_result_leaf_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1346
C.114.16 translate_result_leaf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1346
C.114.17 translate_result_no_leaf_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1347
C.114.18 translate_result_no_leaf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1347
C.114.19 linear_resolve_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1348
C.114.20 linear_resolve_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1348
C.114.21 linear_resolve_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1349

C.114.22 linear_resolve_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1349
C.114.23 linear_resolve_TCC5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1350
C.114.24 linear_resolve_TCC6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1350
C.114.25 linear_resolve_TCC7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1351
C.114.26 linear_resolve_TCC8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1351
C.114.27 linear_resolve_memory_address. . . . . . . . . . . . . . . . . . . . . . . . . . 1352
C.114.28 linear_read_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
C.114.29 linear_read_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
C.114.30 linear_read_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361
C.114.31 linear_read_side_effect_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 1362
C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs). . . . . . . . . . . . . . . . . 1364
C.115.1 PTab_Address_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
C.115.2 pe_in_pdir_range?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
C.115.3 pe_in_ptab_range?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
C.115.4 pe_in_ptab_range?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364
C.115.5 pe_in_ptab_range?_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1365
C.115.6 pe_in_ptab_range?_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1365
C.115.7 pe_in_pt_range?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366
C.115.8 pe_in_pt_range?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366
C.115.9 pe_in_pt_range_aligned . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366
C.115.10 pe_in_pt_address_in_pt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1367
C.115.11 is_linear_plain_memory?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1369
C.115.12 is_linear_plain_memory?_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 1370
C.115.13 is_linear_plain_memory?_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . 1370
C.115.14 is_linear_plain_memory?_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . 1371
C.115.15 is_linear_plain_memory?_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . 1371
C.115.16 is_linear_plain_memory?_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . 1373
C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs) . . . . . . . . . . . 1377
C.116.1 linear_plain_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1377
C.116.2 linear_plain_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . 1409
C.116.3 linear_plain_unchanged_memory_invariant_write . . . . . . . . . . . . . . . . . 1472
C.116.4 linear_plain_unchanged_memory_write_invariant . . . . . . . . . . . . . . . . . 1488
C.116.5 linear_plain_transformer_invariant . . . . . . . . . . . . . . . . . . . . . . . . . 1509
C.116.6 linear_plain_changed_memory_invariant . . . . . . . . . . . . . . . . . . . . . . 1511
C.116.7 linear_plain_read_side_effect_unchanged . . . . . . . . . . . . . . . . . . . . . . 1538
C.116.8 linear_plain_write_side_effect_unchanged . . . . . . . . . . . . . . . . . . . . . 1551
C.116.9 linear_memory_plain_memory. . . . . . . . . . . . . . . . . . . . . . . . . . . 1562
C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs). . . . . . . . . . . . . . . . 1563
C.117.1 pm_read_linear. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1563
C.117.2 pm_write_linear. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1563
C.117.3 pm_read_side_effect_linear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1563
C.117.4 pm_write_side_effect_linear . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1564
C.117.5 pm_states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1564
C.117.6 pm_plain_phy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1564
C.117.7 pm_memory_addr_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
C.117.8 pm_memory_addr_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
C.117.9 pm_memory_addr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1565
C.117.10 pm_linear_blessed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1566
C.117.11 pm_linear_resolve_read_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 1566
C.117.12 pm_linear_resolve_read_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1566
C.117.13 pm_linear_resolve_write_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 1567
C.117.14 pm_linear_resolve_write_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1567

C.117.15 pm_linear_resolve_reg_transformers_other . . . . . . . . . . . . . . . . . . . . . 1567
C.117.16 pm_unchanged_singleton_linear_resolve_reg_transformers . . . . . . . . . . . . 1568
C.117.17 pm_address_in_pt_range_in_rw_addr . . . . . . . . . . . . . . . . . . . . . . . . 1572
C.117.18 address_block_in_memory_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 1572
C.117.19 address_block_in_memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1573
C.117.20 address_block_in_memory2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1574
C.117.21 raise_fault_transformer_invariant. . . . . . . . . . . . . . . . . . . . . . . . . 1574
C.117.22 raise_fault_unchanged_memory_invariant . . . . . . . . . . . . . . . . . . . . . 1577
C.117.23 apply_side_effects_pm_states . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1583
C.117.24 apply_side_effects_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1586
C.117.25 apply_side_effects_same_result_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 1589
C.117.26 apply_side_effects_same_result . . . . . . . . . . . . . . . . . . . . . . . . . . . 1589
C.117.27 apply_side_effects_unchanged. . . . . . . . . . . . . . . . . . . . . . . . . . . 1614
C.117.28 subset_ptab_address_rw_addr . . . . . . . . . . . . . . . . . . . . . . . . . . . 1626
C.117.29 translate_transformer_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . 1627
C.117.30 translate_unchanged_pm_phy_except_pe_TCC1 . . . . . . . . . . . . . . . . . 1637
C.117.31 translate_unchanged_pm_phy_except_pe_TCC2 . . . . . . . . . . . . . . . . . 1637
C.117.32 translate_unchanged_pm_phy_except_pe . . . . . . . . . . . . . . . . . . . . . 1638
C.117.33 translate_result_ok_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1658
C.117.34 translate_result_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1659
C.117.35 translate_result_as_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 1675
C.117.36 translate_result_as_read_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 1675
C.117.37 translate_result_as_read. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1676
C.117.38 translate_same_result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1676
C.117.39 xlat_pe_in_pdir_range_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1677
C.117.40 xlat_pe_in_pdir_range_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1677
C.117.41 xlat_pe_in_pdir_range_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1678
C.117.42 xlat_pe_in_pdir_range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1684
C.117.43 xlat_pe_in_pt_range_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1686
C.117.44 xlat_pe_in_pt_range_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1687
C.117.45 xlat_pe_in_pt_range_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1687
C.117.46 xlat_pe_in_pt_range_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1688
C.117.47 xlat_pe_in_pt_range_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1690
C.117.48 xlat_pe_in_pt_range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1704
C.117.49 linear_resolve_unchanged_pm_phy . . . . . . . . . . . . . . . . . . . . . . . . . 1734
C.117.50 linear_resolve_read_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . 1914
C.117.51 linear_resolve_write_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . 1914
C.117.52 linear_resolve_transformer_invariant . . . . . . . . . . . . . . . . . . . . . . . . 1915
C.117.53 linear_resolve_states_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1915
C.117.54 linear_resolve_states. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1916
C.117.55 linear_resolve_same_result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1916
C.117.56 delta_memory_address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2012
C.117.57 xlat_idx_same_page_address_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2014
C.117.58 xlat_idx_same_page_address_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . 2015
C.117.59 xlat_idx_same_page_address . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2015
C.117.60 xlat_ofs_same_page_address_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2028
C.117.61 xlat_ofs_same_page_address_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . 2028
C.117.62 xlat_ofs_same_page_address . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2029
C.117.63 translate_same_page_address_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2036
C.117.64 translate_same_page_address_result . . . . . . . . . . . . . . . . . . . . . . . . 2039
C.117.65 linear_resolve_same_page_address_ok_TCC1 . . . . . . . . . . . . . . . . . . . 2043
C.117.66 linear_resolve_same_page_address_ok . . . . . . . . . . . . . . . . . . . . . . . 2043

C.117.67 linear_resolve_same_page_address_TCC1 . . . . . . . . . . . . . . . . . . . . . 2079
C.117.68 linear_resolve_same_page_address . . . . . . . . . . . . . . . . . . . . . . . . . 2079
C.117.69 address_block_split_type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2079
C.117.70 same_page_address_block_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2083
C.117.71 same_page_address_block_read . . . . . . . . . . . . . . . . . . . . . . . . . . . 2083
C.117.72 same_page_address_block_write_TCC1 . . . . . . . . . . . . . . . . . . . . . . 2098
C.117.73 same_page_address_block_write . . . . . . . . . . . . . . . . . . . . . . . . . . 2099
C.117.74 split_linear_read_side_effects_states_TCC1 . . . . . . . . . . . . . . . . . . . . 2113
C.117.75 split_linear_read_side_effects_states . . . . . . . . . . . . . . . . . . . . . . . . 2114
C.117.76 split_linear_write_side_effects_states_TCC1 . . . . . . . . . . . . . . . . . . . . 2133
C.117.77 split_linear_write_side_effects_states . . . . . . . . . . . . . . . . . . . . . . . . 2134
C.117.78 split_linear_read_side_effects_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2155
C.117.79 split_linear_write_side_effects_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2178
C.117.80 split_linear_read_side_effects_data . . . . . . . . . . . . . . . . . . . . . . . . . 2202
C.117.81 split_linear_write_side_effects_data . . . . . . . . . . . . . . . . . . . . . . . . 2224
C.117.82 split_linear_read_side_effects_unchanged_memory . . . . . . . . . . . . . . . . 2250
C.117.83 split_linear_write_side_effects_unchanged_memory . . . . . . . . . . . . . . . . 2294
C.117.84 linear_unchanged_invariant . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2320
C.117.85 pm_phy_read_after_resolve_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2355
C.117.86 pm_phy_read_after_resolve_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . 2355
C.117.87 pm_resolve_address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2355
C.117.88 pm_resolve_address_write. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2358
C.118 Proofs for List_Split (linear_memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2361
C.118.1 split_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2361
C.118.2 split_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2361
C.118.3 split_pair_cross_size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2363
C.118.4 split_pair_concat. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2369
C.118.5 split_range. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2373
C.118.6 split_no_null. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2380
C.118.7 split_null. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2382
C.118.8 split_type_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2382
C.118.9 split_type_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2383
C.118.10 split_type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2383
C.119 Proofs for LogicalExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . 2385
C.120 Proofs for LvalueToRvalueConversion (conversions.pvs) . . . . . . . . . . . . . . . . . . 2385
C.121 Proofs for Memory (memory.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.1 memory_write_list_nse_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.2 memory_write_list_nse_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.3 memory_read_list_nse_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.4 memory_read_list_nse_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.5 memory_read_list_ok_length . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2386
C.121.6 memory_read_transformers_memory_read. . . . . . . . . . . . . . . . . . . . 2387
C.121.7 memory_read_transformers_mono . . . . . . . . . . . . . . . . . . . . . . . . . 2388
C.121.8 memory_read_transformers_union . . . . . . . . . . . . . . . . . . . . . . . . . 2388
C.121.9 memory_write_transformers_memory_write . . . . . . . . . . . . . . . . . . . . 2388
C.121.10 memory_write_transformers_mono. . . . . . . . . . . . . . . . . . . . . . . . 2389
C.121.11 memory_read_side_effect_super_transformers_memory_read_side_effect . . . . . 2389
C.121.12 memory_read_side_effect_super_transformers_mono . . . . . . . . . . . . . . . 2389
C.121.13 memory_write_side_effect_super_transformers_memory_write_side_effect …. 2390
C.121.14 memory_write_side_effect_super_transformers_mono . . . . . . . . . . . . . . . 2390
C.121.15 side_effect_content_unchanged_content . . . . . . . . . . . . . . . . . . . . . . 2390
C.121.16 side_effect_content_unchanged_mono . . . . . . . . . . . . . . . . . . . . . . . 2391

C.121.17 side_effect_content_unchanged_composition . . . . . . . . . . . . . . . . . . . . 2391
C.122 Proofs for Memory_Change (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2393
C.122.1 unchanged_memory_invariant?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2393
C.122.2 unchanged_memory_invariant_unchanged_TCC1 . . . . . . . . . . . . . . . . . 2394
C.122.3 unchanged_memory_invariant_unchanged . . . . . . . . . . . . . . . . . . . . . 2394
C.122.4 unchanged_memory_invariant_invariant . . . . . . . . . . . . . . . . . . . . . . 2394
C.122.5 unchanged_memory_invariant_mono. . . . . . . . . . . . . . . . . . . . . . . 2395
C.122.6 unchanged_memory_invariant_next_ok_TCC1 . . . . . . . . . . . . . . . . . . 2395
C.122.7 unchanged_memory_invariant_next_ok . . . . . . . . . . . . . . . . . . . . . . 2395
C.122.8 unchanged_memory_invariant_union_transformers . . . . . . . . . . . . . . . . 2396
C.122.9 unchanged_memory_invariant_union_addresses . . . . . . . . . . . . . . . . . . 2400
C.122.10 unchanged_memory_invariant_empty. . . . . . . . . . . . . . . . . . . . . . . 2401
C.122.11 unchanged_memory_invariant_all_transformers . . . . . . . . . . . . . . . . . . 2401
C.123 Proofs for Memory_Change_2 (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . 2402
C.123.1 unchanged_memory_write_invariant_mono_addresses . . . . . . . . . . . . . . 2402
C.123.2 unchanged_memory_write_invariant_transformer_invariant . . . . . . . . . . . 2403
C.123.3 unchanged_memory_write_invariant_unchanged_memory_invariant . . . . . . . 2404
C.123.4 unchanged_memory_invariant_union. . . . . . . . . . . . . . . . . . . . . . . 2408
C.123.5 transformer_invariant_write_list_nse . . . . . . . . . . . . . . . . . . . . . . . . 2409
C.123.6 transformer_invariant_write_list . . . . . . . . . . . . . . . . . . . . . . . . . . 2414
C.123.7 changed_memory_invariant?_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2416
C.123.8 changed_memory_invariant_mono . . . . . . . . . . . . . . . . . . . . . . . . . 2416
C.123.9 memory_read_list_nse_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2418
C.123.10 memory_read_list_nse_next_length_TCC1 . . . . . . . . . . . . . . . . . . . . . 2422
C.123.11 memory_read_list_nse_next_length_TCC2 . . . . . . . . . . . . . . . . . . . . . 2422
C.123.12 memory_read_list_nse_next_length . . . . . . . . . . . . . . . . . . . . . . . . . 2422
C.123.13 memory_read_list_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2428
C.123.14 memory_read_list_next_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . 2430
C.123.15 memory_read_list_next_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2430
C.123.16 unchanged_memory_read_list_nse_TCC1 . . . . . . . . . . . . . . . . . . . . . 2432
C.123.17 unchanged_memory_read_list_nse_TCC2 . . . . . . . . . . . . . . . . . . . . . 2433
C.123.18 unchanged_memory_read_list_nse_TCC3 . . . . . . . . . . . . . . . . . . . . . 2434
C.123.19 unchanged_memory_read_list_nse . . . . . . . . . . . . . . . . . . . . . . . . . 2435
C.123.20 unchanged_memory_read_list_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2450
C.123.21 unchanged_memory_read_list_TCC2 . . . . . . . . . . . . . . . . . . . . . . . 2451
C.123.22 unchanged_memory_read_list_TCC3 . . . . . . . . . . . . . . . . . . . . . . . 2451
C.123.23 unchanged_memory_read_list. . . . . . . . . . . . . . . . . . . . . . . . . . . 2452
C.123.24 unchanged_memory_invariant_unchanged_read_list_nse_TCC1 . . . . . . . . . 2457
C.123.25 unchanged_memory_invariant_unchanged_read_list_nse_TCC2 . . . . . . . . . 2458
C.123.26 unchanged_memory_invariant_unchanged_read_list_nse_TCC3 . . . . . . . . . 2459
C.123.27 unchanged_memory_invariant_unchanged_read_list_nse . . . . . . . . . . . . . 2459
C.123.28 memory_write_list_ok_nse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2466
C.123.29 memory_write_list_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2470
C.123.30 unchanged_memory_invariant_unchanged_write_list_nse_TCC1 . . . . . . . . . 2472
C.123.31 unchanged_memory_invariant_unchanged_write_list_nse_TCC2 . . . . . . . . . 2473
C.123.32 unchanged_memory_invariant_unchanged_write_list_nse_TCC3 . . . . . . . . . 2474
C.123.33 unchanged_memory_invariant_unchanged_write_list_nse . . . . . . . . . . . . . 2475
C.123.34 unchanged_memory_invariant_unchanged_write_list_TCC1 . . . . . . . . . . . 2484
C.123.35 unchanged_memory_invariant_unchanged_write_list_TCC2 . . . . . . . . . . . 2485
C.123.36 unchanged_memory_invariant_unchanged_write_list_TCC3 . . . . . . . . . . . 2488
C.123.37 unchanged_memory_invariant_unchanged_write_list . . . . . . . . . . . . . . . 2489
C.123.38 unchanged_memory_invariant_read_list . . . . . . . . . . . . . . . . . . . . . . 2493

C.123.39 unchanged_memory_read_list_write_list_nse_TCC1 . . . . . . . . . . . . . . . 2499
C.123.40 unchanged_memory_read_list_write_list_nse_TCC2 . . . . . . . . . . . . . . . 2500
C.123.41 unchanged_memory_read_list_write_list_nse . . . . . . . . . . . . . . . . . . . 2502
C.123.42 unchanged_memory_read_list_write_list_TCC1 . . . . . . . . . . . . . . . . . . 2538
C.123.43 unchanged_memory_read_list_write_list_TCC2 . . . . . . . . . . . . . . . . . . 2538
C.123.44 unchanged_memory_read_list_write_list . . . . . . . . . . . . . . . . . . . . . . 2545
C.124 Proofs for Memory_Change_3 (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . 2559
C.124.1 expr_unchanged_memory_invariant_unchanged_TCC1 . . . . . . . . . . . . . . 2559
C.124.2 expr_unchanged_memory_invariant_unchanged . . . . . . . . . . . . . . . . . . 2559
C.124.3 expr_unchanged_memory_invariant_next_ok_TCC1 . . . . . . . . . . . . . . . 2560
C.124.4 expr_unchanged_memory_invariant_next_ok . . . . . . . . . . . . . . . . . . . 2560
C.125 Proofs for Memory_Change_4 (memory.pvs). . . . . . . . . . . . . . . . . . . . . . . . 2560
C.125.1 expr_unchanged_memory_invariant_composition . . . . . . . . . . . . . . . . . 2560
C.125.2 fexpr_unchanged_memory_invariant_composition . . . . . . . . . . . . . . . . 2571
C.126 Proofs for Memory_Physical_Memory (physical_memory.pvs) . . . . . . . . . . . . . . . 2579
C.127 Proofs for Memory_access (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2579
C.128 Proofs for Memory_access_adt (Memory_access_adt.pvs) . . . . . . . . . . . . . . . . . . 2579
C.129 Proofs for Memory_access_adt_reduce (Memory_access_adt.pvs) . . . . . . . . . . . . . 2579
C.130 Proofs for Memory_access_util (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . 2579
C.131 Proofs for Memory_privilege (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . 2580
C.132 Proofs for Memory_privilege_adt (Memory_privilege_adt.pvs) . . . . . . . . . . . . . . . 2580
C.133 Proofs for Memory_privilege_adt_reduce (Memory_privilege_adt.pvs) . . . . . . . . . . . 2580
C.134 Proofs for Memory_privilege_util (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . 2580
C.134.1 bool_to_memory_privilege_iso . . . . . . . . . . . . . . . . . . . . . . . . . . . 2580
C.135 Proofs for Min_Max_Extension (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . 2580
C.135.1 max_stable_under_extension_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2580
C.135.2 max_stable_under_extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2580
C.135.3 min_stable_under_extension. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2581
C.136 Proofs for More_Divides (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2582
C.136.1 expt_divides. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2582
C.136.2 divides_expt_gt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2582
C.137 Proofs for More_Function (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . . 2583
C.137.1 restrict_to_image_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2583
C.137.2 surjective_restrict_to_image. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2583
C.137.3 bijective_restrict_to_image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2583
C.138 Proofs for More_List_Props (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . 2583
C.138.1 length_is_cons. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2583
C.138.2 cons_length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2584
C.138.3 length_cdr_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2584
C.138.4 length_cdr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2584
C.138.5 conslist_induction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2584
C.138.6 head_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2586
C.138.7 head_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2586
C.138.8 head_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2586
C.138.9 head_tail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2586
C.138.10 length_head. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2587
C.138.11 length_tail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2588
C.138.12 nth_head_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2589
C.138.13 nth_head_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2590
C.138.14 nth_head. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2590
C.138.15 nth_tail_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2591
C.138.16 nth_tail_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2591

C.138.17 nth_tail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2591
C.138.18 car_head_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2593
C.138.19 car_head_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2593
C.138.20 car_head. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2593
C.138.21 cons_tail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2593
C.138.22 car_tail_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2594
C.138.23 car_tail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2594
C.138.24 cdr_tail_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2595
C.138.25 cdr_tail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2595
C.138.26 every_implied . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2597
C.138.27 every_conjunct_left. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2598
C.138.28 every_iff_forall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2598
C.138.29 some_iff_exists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2599
C.138.30 list_extensionality_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2601
C.138.31 list_extensionality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2601
C.138.32 list_remove_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2604
C.138.33 list_remove_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2604
C.138.34 list_remove_commutative. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2604
C.138.35 member_list_remove. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2604
C.138.36 nth_member. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2605
C.138.37 flatten_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2607
C.138.38 member_append . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2607
C.138.39 member_flatten. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2607
C.138.40 map2_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2609
C.138.41 map2_property . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2609
C.139 Proofs for More_List_Props_2 (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . 2610
C.139.1 member_map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2610
C.140 Proofs for More_More_List_Props (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . 2611
C.140.1 list_all_length. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2611
C.141 Proofs for More_Relations (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . 2612
C.141.1 zorn_lr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2612
C.142 Proofs for More_Sets_Lemmas (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . 2613
C.142.1 subset_equal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2613
C.142.2 union_subset3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2613
C.142.3 subset_bigger_union_left. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2613
C.142.4 subset_bigger_union_right. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2613
C.142.5 union_empty_left. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2614
C.142.6 union_left . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2614
C.142.7 union_right . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2614
C.142.8 subset_of_differences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2614
C.142.9 difference_disjoint_3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2615
C.142.10 subset_singleton. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2615
C.142.11 subset_member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2615
C.142.12 disjoint_symmetric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2615
C.142.13 disjoint_mono. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2616
C.142.14 disjoint_subset_difference. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2616
C.143 Proofs for Number_Props (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . . 2616
C.143.1 number_split . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2616
C.143.2 number_split_less. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2616
C.143.3 bit_split_less. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2617
C.143.4 rem_def_pos. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2617
C.143.5 rem_rem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2618

C.143.6 divides_times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2619
C.143.7 ndiv_floor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2621
C.143.8 ndiv_self. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2621
C.143.9 ndiv_plus_1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2622
C.143.10 ndiv_plus_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2623
C.143.11 ndiv_plus_mod. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2623
C.143.12 ndiv_plus_mod_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2624
C.143.13 ndiv_minus_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2625
C.143.14 ndiv_times_divident_1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2627
C.143.15 ndiv_times_divident_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2629
C.143.16 rem_prod_3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2629
C.143.17 ndiv_times_2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2632
C.143.18 both_sides_ndiv_lt1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2632
C.143.19 rem_ndiv . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2633
C.143.20 mod_rem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2634
C.143.21 ndiv_rem_divisible_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2635
C.143.22 ndiv_rem_divisible. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2635
C.143.23 expt_2_8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2637
C.143.24 ndiv_0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2637
C.143.25 ndiv_1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2637
C.143.26 ndiv_bigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2638
C.143.27 ndiv_reduce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2638
C.143.28 ndiv_expt_expt_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2639
C.143.29 ndiv_expt_expt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2639
C.143.30 min_plus1_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2641
C.143.31 min_plus1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2642
C.143.32 min_member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2643
C.144 Proofs for Ok_Result_Rewrite (state-transformer.pvs). . . . . . . . . . . . . . . . . . . 2644
C.144.1 ok_result_q_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2644
C.144.2 ok_result_q_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2644
C.144.3 ok_result_q_state_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2644
C.144.4 ok_result_q_state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2644
C.144.5 ok_result_q_data_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2645
C.144.6 ok_result_q_data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2645
C.144.7 ok_result_elemination_1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2645
C.145 Proofs for PDBR_Data_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . 2646
C.145.1 pdbr_valid?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2646
C.145.2 pdbr_valid?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2646
C.145.3 pdbr_to_byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2646
C.145.4 pdbr_to_byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2646
C.145.5 pdbr_to_byte_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2647
C.145.6 pdbr_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2647
C.145.7 pdbr_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2648
C.145.8 pdbr_from_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2648
C.145.9 pdbr_from_byte_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2648
C.145.10 pdbr_from_byte_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2650
C.145.11 pdbr_model_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2650
C.145.12 pdbr_valid_to_byte. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2650
C.145.13 pdbr_is_pod. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2651
C.146 Proofs for PDBR_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2653
C.146.1 pdbr_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2653
C.147 Proofs for PDBR_Type (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2654

C.147.1 Pdbr_type_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.148 Proofs for PDE_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.148.1 pde_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.149 Proofs for PDE_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . . . . . . 2654
C.149.1 pde_valid?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.149.2 pde_valid?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2654
C.149.3 pde_valid?_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2655
C.149.4 pde_pte_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2655
C.149.5 pde_pte_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2655
C.149.6 pde_pte_to_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2656
C.149.7 pde_super_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2656
C.149.8 pde_super_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2657
C.149.9 pde_super_to_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2657
C.149.10 pde_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2658
C.149.11 pde_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2659
C.149.12 pde_4m_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2659
C.149.13 pde_4m_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2659
C.149.14 pde_4m_from_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2659
C.149.15 pde_4m_from_byte_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2660
C.149.16 pde_4m_from_byte_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2660
C.149.17 pde_4m_from_byte_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2660
C.149.18 pde_4k_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2661
C.149.19 pde_4k_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2662
C.149.20 pde_4k_from_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2662
C.149.21 pde_4k_from_byte_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2662
C.149.22 pde_4k_from_byte_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2663
C.149.23 pde_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2665
C.149.24 pde_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2665
C.149.25 pde_model_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2665
C.149.26 pde_valid_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2666
C.149.27 pde_is_pod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2666
C.150 Proofs for PF_EC_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . . . . 2671
C.150.1 pf_ec_valid?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2671
C.150.2 pf_ec_valid?_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2672
C.150.3 pf_ec_valid?_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2672
C.150.4 pf_ec_valid?_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2672
C.150.5 pf_ec_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2672
C.150.6 pf_ec_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2673
C.150.7 pf_ec_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2673
C.150.8 pf_ec_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2674
C.150.9 pf_ec_model_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2674
C.150.10 pf_ec_valid_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2674
C.150.11 pf_ec_is_pod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2674
C.151 Proofs for PF_Error_Code_Type (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . 2676
C.151.1 pf_ec_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2676
C.152 Proofs for PTE_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . . 2676
C.152.1 pte_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2676
C.153 Proofs for PTE_Model (paging-data-models.pvs). . . . . . . . . . . . . . . . . . . . . . 2677
C.153.1 pte_page_to_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2677
C.153.2 pte_page_to_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2677
C.153.3 pte_page_to_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2678
C.153.4 pte_to_byte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2678

C.153.5 pte_to_byte_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2678
C.153.6 pte_page_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2679
C.153.7 pte_page_from_byte_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2679
C.153.8 pte_page_from_byte_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2679
C.153.9 pte_page_from_byte_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2679
C.153.10 pte_page_from_byte_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2680
C.153.11 pte_page_from_byte_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2680
C.153.12 pte_from_byte_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2682
C.153.13 pte_model_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2682
C.153.14 pte_valid_to_byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2682
C.153.15 pte_is_pod. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2682
C.154 Proofs for Page_Directory_Types (paging-data.pvs). . . . . . . . . . . . . . . . . . . . 2686
C.154.1 Pde_pt_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2686
C.155 Proofs for Paging_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2686
C.155.1 paging_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2686
C.155.2 paging_data_type_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2686
C.155.3 paging_data_type_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2687
C.155.4 paging_data_type_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2691
C.155.5 paging_data_type_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2691
C.155.6 paging_data_type_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2691
C.155.7 paging_data_type_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2693
C.156 Proofs for Paging_type (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2693
C.157 Proofs for Paging_type_adt (Paging_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . . 2693
C.158 Proofs for Paging_type_adt_reduce (Paging_type_adt.pvs) . . . . . . . . . . . . . . . . . 2693
C.159 Proofs for Paging_type_helpers (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . 2694
C.159.1 range_pt_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.2 base_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.3 base_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.4 set_reference_range. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.5 set_reference_pdir_entry. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2694
C.159.6 set_reference_ptab_entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2695
C.159.7 set_reference_paging_type. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2695
C.159.8 set_reference_present. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2696
C.159.9 set_reference_base_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2698
C.159.10 set_reference_base. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2699
C.159.11 set_reference_accessible. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2703
C.159.12 set_reference_privileged . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2713
C.159.13 set_reference_leaf. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2724
C.160 Proofs for Pde_type (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2726
C.161 Proofs for Pde_type_adt (Pde_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . . . . . 2726
C.161.1 Pde_4m_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2726
C.162 Proofs for Pde_type_adt_reduce (Pde_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . 2726
C.163 Proofs for Phy_Mem_Blessing (challenge-phymem.pvs). . . . . . . . . . . . . . . . . . 2727
C.163.1 phy_mem_plain_memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2727
C.164 Proofs for Phy_Mem_Blessing_Data (challenge-phymem.pvs). . . . . . . . . . . . . . . 2731
C.164.1 in_memory_blessed_memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2731
C.165 Proofs for Phy_Mem_Challenge_Read_Other (challenge-phymem.pvs) . . . . . . . . . . 2731
C.165.1 read_write_other_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2731
C.165.2 read_write_other_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2732
C.165.3 read_write_other_res_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2732
C.165.4 read_write_other_res. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2733
C.165.5 read_read_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2733

C.165.6 read_read_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2734
C.165.7 read_read_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2734
C.165.8 read_read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2735
C.166 Proofs for Phy_Mem_Challenge_Read_Same (challenge-phymem.pvs) . . . . . . . . . . . 2735
C.166.1 read_write_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2735
C.166.2 read_write_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2736
C.166.3 read_write_res. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2736
C.167 Proofs for Phy_Mem_Properties (challenge-phymem.pvs). . . . . . . . . . . . . . . . . 2737
C.167.1 min_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2737
C.167.2 phy_mem_write_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . . 2737
C.167.3 phy_mem_read_transformers_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2737
C.167.4 phy_mem_read_side_effects_transformers_ok . . . . . . . . . . . . . . . . . . . 2737
C.167.5 phy_mem_write_side_effects_transformers_ok . . . . . . . . . . . . . . . . . . . 2738
C.167.6 phy_mem_unchanged_memory_invariant_read_transformers . . . . . . . . . . . 2738
C.167.7 phy_mem_unchanged_memory_invariant_read_side_effect_transformers . . . . . 2739
C.167.8 phy_mem_unchanged_memory_invariant_write_side_effect_transformers …. 2740
C.167.9 phy_mem_unchanged_memory_write_invariant . . . . . . . . . . . . . . . . . . 2741
C.167.10 phy_mem_changed_memory_invariant . . . . . . . . . . . . . . . . . . . . . . . 2742
C.168 Proofs for Physical_Memory (physical_memory.pvs). . . . . . . . . . . . . . . . . . . . 2742
C.169 Proofs for Physical_Memory_Corollaries (physical_memory.pvs) . . . . . . . . . . . . . . 2743
C.169.1 physical_read_ok_next_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2743
C.169.2 physical_read_ok_next_state . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2743
C.169.3 physical_write_ok_next_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2743
C.169.4 physical_write_ok_next_state . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2743
C.169.5 physical_read_ok_get_data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2744
C.170 Proofs for Physical_Memory_Properties (physical_memory.pvs) . . . . . . . . . . . . . . 2744
C.170.1 physical_read_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2744
C.170.2 physical_write_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2744
C.171 Proofs for Plain_Mem_Properties (plain_memory.pvs) . . . . . . . . . . . . . . . . . . . 2745
C.171.1 plain_mem_write_list_read_list_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2745
C.171.2 plain_mem_write_list_read_list . . . . . . . . . . . . . . . . . . . . . . . . . . . 2745
C.171.3 plain_mem_q_read_list_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2746
C.171.4 plain_mem_q_read_list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2746
C.172 Proofs for Plain_Mem_Properties_2 (plain_memory.pvs) . . . . . . . . . . . . . . . . . . 2746
C.172.1 plain_memory_inv_pred_write_data_TCC1 . . . . . . . . . . . . . . . . . . . . 2746
C.172.2 plain_memory_inv_pred_write_data . . . . . . . . . . . . . . . . . . . . . . . . 2747
C.172.3 plain_memory_read_data_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2747
C.172.4 plain_memory_write_data_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . 2749
C.172.5 plain_memory_write_data_valid_TCC1 . . . . . . . . . . . . . . . . . . . . . . 2750
C.172.6 plain_memory_write_data_valid . . . . . . . . . . . . . . . . . . . . . . . . . . 2751
C.172.7 plain_memory_transformers_ok_write_data . . . . . . . . . . . . . . . . . . . . 2752
C.172.8 plain_memory_transformer_invariant_write_data . . . . . . . . . . . . . . . . . 2753
C.172.9 plain_memory_transformer_invariant_read_data . . . . . . . . . . . . . . . . . 2754
C.172.10 plain_memory_unchanged_memory_invariant_write_data . . . . . . . . . . . . 2755
C.172.11 plain_memory_unchanged_memory_invariant_read_data . . . . . . . . . . . . . 2761
C.172.12 plain_memory_read_data_q_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2764
C.172.13 plain_memory_read_data_q_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . 2764
C.172.14 plain_memory_read_data_q_same_TCC1 . . . . . . . . . . . . . . . . . . . . . 2768
C.172.15 plain_memory_read_data_q_same_TCC2 . . . . . . . . . . . . . . . . . . . . . 2768
C.172.16 plain_memory_read_data_q_same . . . . . . . . . . . . . . . . . . . . . . . . . 2768
C.172.17 plain_memory_read_write_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2769
C.172.18 plain_memory_read_write_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . 2770

C.172.19 plain_memory_read_write_res . . . . . . . . . . . . . . . . . . . . . . . . . . . 2771
C.172.20 plain_memory_unchanged_memory_ok_result . . . . . . . . . . . . . . . . . . . 2773
C.173 Proofs for Plain_Mem_Properties_3 (plain_memory.pvs) . . . . . . . . . . . . . . . . . . 2775
C.173.1 plain_memory_read_write_other_ok . . . . . . . . . . . . . . . . . . . . . . . . 2775
C.173.2 plain_memory_read_write_other_res_TCC1 . . . . . . . . . . . . . . . . . . . . 2776
C.173.3 plain_memory_read_write_other_res_TCC2 . . . . . . . . . . . . . . . . . . . . 2777
C.173.4 plain_memory_read_write_other_res . . . . . . . . . . . . . . . . . . . . . . . . 2777
C.173.5 plain_memory_read_read_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2778
C.173.6 plain_memory_read_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 2781
C.173.7 plain_memory_read_read_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 2781
C.173.8 plain_memory_read_read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2782
C.173.9 plain_memory_unchanged_composition . . . . . . . . . . . . . . . . . . . . . . 2783
C.174 Proofs for Plain_Mem_Rewrites (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . . 2785
C.175 Proofs for Plain_Mem_Rewrites1 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2785
C.175.1 pm_q_prop_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2785
C.175.2 pm_q_prop_ok_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2785
C.176 Proofs for Plain_Mem_Rewrites2 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2786
C.176.1 in_blessed_memory_rw_ro . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2786
C.176.2 pm_q_prop_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2786
C.176.3 pm_q_prop_ok_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2786
C.176.4 pm_q_prop_single_read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2787
C.176.5 pm_q_prop_ok_result_single . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2787
C.176.6 plain_memory_write_ok_single . . . . . . . . . . . . . . . . . . . . . . . . . . . 2787
C.176.7 pm_q_prop_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2788
C.177 Proofs for Plain_Mem_Rewrites3 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2788
C.177.1 pm_q_prop_read_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2788
C.178 Proofs for Plain_Mem_Rewrites4 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2788
C.178.1 plain_memory_write_ok_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . . 2788
C.178.2 pm_q_prop_read_ok_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2789
C.178.3 pm_q_prop_read_pm_q_prop_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2789
C.178.4 pm_q_prop_read_write_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . 2790
C.178.5 pm_q_prop_ok_result_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2790
C.178.6 pm_q_prop_read_ok_result_single . . . . . . . . . . . . . . . . . . . . . . . . . 2790
C.178.7 plain_memory_read_write_q_data_expr_TCC1 . . . . . . . . . . . . . . . . . . 2791
C.178.8 plain_memory_read_write_q_data_expr . . . . . . . . . . . . . . . . . . . . . . 2791
C.178.9 pm_q_prop_read_write_other_single . . . . . . . . . . . . . . . . . . . . . . . . 2792
C.178.10 pm_q_prop_read_read_single . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2792
C.179 Proofs for Plain_Mem_Rewrites5 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2793
C.179.1 plain_memory_write_ok_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . 2793
C.179.2 pm_q_prop_read_ok_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2793
C.179.3 pm_q_prop_read_pm_q_prop_stmt . . . . . . . . . . . . . . . . . . . . . . . . . 2794
C.179.4 pm_q_prop_read_write_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . 2795
C.179.5 pm_q_prop_ok_result_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2795
C.179.6 plain_memory_read_write_q_data_stmt_TCC1 . . . . . . . . . . . . . . . . . . 2796
C.179.7 plain_memory_read_write_q_data_stmt . . . . . . . . . . . . . . . . . . . . . . 2796
C.179.8 pm_q_prop_single_write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2797
C.179.9 pm_q_prop_read_write_single . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2797
C.179.10 pm_q_prop_e2s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2797
C.179.11 pm_q_prop_stmt_e2s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2798
C.180 Proofs for Plain_Mem_Rewrites6 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2798
C.180.1 pm_q_prop_read_write_other_q_expr . . . . . . . . . . . . . . . . . . . . . . . . 2798
C.180.2 pm_q_prop_read_read_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . 2799

C.180.3 pm_q_prop_read_ok_result_q_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2801
C.180.4 plain_memory_read_read_q_data_expr_TCC1 . . . . . . . . . . . . . . . . . . . 2801
C.180.5 plain_memory_read_read_q_data_expr_TCC2 . . . . . . . . . . . . . . . . . . . 2801
C.180.6 plain_memory_read_read_q_data_expr . . . . . . . . . . . . . . . . . . . . . . . 2802
C.181 Proofs for Plain_Mem_Rewrites7 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2802
C.181.1 pm_q_prop_read_write_other_q_stmt . . . . . . . . . . . . . . . . . . . . . . . 2802
C.181.2 plain_memory_read_write_other_single_data_TCC1 . . . . . . . . . . . . . . . 2804
C.181.3 plain_memory_read_write_other_single_data_TCC2 . . . . . . . . . . . . . . . 2805
C.181.4 plain_memory_read_write_other_single_data . . . . . . . . . . . . . . . . . . . 2806
C.181.5 pm_q_prop_read_read_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . 2807
C.181.6 pm_q_prop_read_ok_result_q_stmt . . . . . . . . . . . . . . . . . . . . . . . . . 2807
C.181.7 plain_memory_read_write_other_q_data_stmt_TCC1 . . . . . . . . . . . . . . . 2808
C.181.8 plain_memory_read_write_other_q_data_stmt_TCC2 . . . . . . . . . . . . . . . 2808
C.181.9 plain_memory_read_write_other_q_data_stmt . . . . . . . . . . . . . . . . . . . 2809
C.181.10 plain_memory_read_read_q_data_stmt_TCC1 . . . . . . . . . . . . . . . . . . . 2809
C.181.11 plain_memory_read_read_q_data_stmt_TCC2 . . . . . . . . . . . . . . . . . . . 2810
C.181.12 plain_memory_read_read_q_data_stmt . . . . . . . . . . . . . . . . . . . . . . . 2810
C.181.13 pm_q_prop_read_e2s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2811
C.181.14 pm_q_prop_read_stmt_e2s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2811
C.182 Proofs for Plain_Mem_Rewrites8 (plain_memory_rewrites.pvs) . . . . . . . . . . . . . . 2812
C.182.1 plain_memory_read_write_other_q_data_expr_TCC1 . . . . . . . . . . . . . . . 2812
C.182.2 plain_memory_read_write_other_q_data_expr_TCC2 . . . . . . . . . . . . . . . 2812
C.182.3 plain_memory_read_write_other_q_data_expr . . . . . . . . . . . . . . . . . . . 2813
C.183 Proofs for Plain_Memory (plain_memory.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2814
C.183.1 plain_memory_invariant_read_transformers_ro_addr . . . . . . . . . . . . . . . 2814
C.183.2 plain_memory_invariant_read_transformers_rw_addr . . . . . . . . . . . . . . . 2814
C.183.3 plain_memory_invariant_read_transformers_ro_rw_addr . . . . . . . . . . . . . 2814
C.183.4 plain_memory_invariant_write_transformers_rw_addr . . . . . . . . . . . . . . 2815
C.183.5 plain_memory_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2815
C.183.6 plain_memory_unchanged_invariant . . . . . . . . . . . . . . . . . . . . . . . . 2816
C.183.7 plain_memory_unchanged_memory_invariant_write . . . . . . . . . . . . . . . 2817
C.183.8 plain_memory_unchanged_memory_write_invariant . . . . . . . . . . . . . . . 2817
C.183.9 plain_memory_changed_memory_invariant . . . . . . . . . . . . . . . . . . . . 2817
C.183.10 plain_memory_invariant_read_block . . . . . . . . . . . . . . . . . . . . . . . . 2818
C.183.11 plain_memory_invariant_write_block . . . . . . . . . . . . . . . . . . . . . . . 2818
C.183.12 plain_memory_transformer_invariant_read_side_effects . . . . . . . . . . . . . . 2818
C.183.13 plain_memory_transformer_invariant_write_side_effects . . . . . . . . . . . . . 2820
C.183.14 plain_memory_transformer_invariant_read_list_block . . . . . . . . . . . . . . . 2821
C.183.15 plain_memory_transformer_invariant_write_list_block . . . . . . . . . . . . . . 2821
C.183.16 plain_memory_transformers_ok_read_ro_rw . . . . . . . . . . . . . . . . . . . . 2821
C.183.17 plain_memory_transformers_ok_read_block . . . . . . . . . . . . . . . . . . . . 2822
C.183.18 plain_memory_transformers_ok_write_rw . . . . . . . . . . . . . . . . . . . . . 2823
C.183.19 plain_memory_transformers_ok_write_block . . . . . . . . . . . . . . . . . . . 2823
C.183.20 plain_memory_transformers_ok_read_side_effects_ro_rw . . . . . . . . . . . . . 2824
C.183.21 plain_memory_transformers_ok_read_side_effects_block . . . . . . . . . . . . . 2824
C.183.22 plain_memory_transformers_ok_write_side_effects_ro_rw . . . . . . . . . . . . . 2825
C.183.23 plain_memory_transformers_ok_write_side_effects_block . . . . . . . . . . . . . 2825
C.183.24 plain_memory_transformers_ok_read_list_block . . . . . . . . . . . . . . . . . . 2826
C.183.25 plain_memory_transformers_ok_write_list_block . . . . . . . . . . . . . . . . . 2826
C.183.26 plain_memory_unchanged_read_block_rw_addr . . . . . . . . . . . . . . . . . . 2826
C.183.27 plain_memory_unchanged_read_ro_rw_addr . . . . . . . . . . . . . . . . . . . . 2827
C.183.28 plain_memory_unchanged_read_block_ro_rw_addr . . . . . . . . . . . . . . . . 2827

C.183.29 plain_memory_unchanged_write_block_ro_addr . . . . . . . . . . . . . . . . . . 2828
C.183.30 plain_memory_unchanged_read_block . . . . . . . . . . . . . . . . . . . . . . . 2828
C.183.31 plain_memory_unchanged_read_side_effect_block_ro_rw . . . . . . . . . . . . . 2829
C.183.32 plain_memory_unchanged_read_side_effect_block . . . . . . . . . . . . . . . . . 2829
C.183.33 plain_memory_unchanged_write_side_effect_block_ro_rw . . . . . . . . . . . . . 2830
C.183.34 plain_memory_unchanged_write_side_effect_block . . . . . . . . . . . . . . . . 2830
C.183.35 plain_memory_unchanged_block . . . . . . . . . . . . . . . . . . . . . . . . . . 2831
C.183.36 plain_memory_changed_block. . . . . . . . . . . . . . . . . . . . . . . . . . . 2831
C.183.37 plain_memory_side_effect_content_unchanged_read_block . . . . . . . . . . . . 2832
C.183.38 plain_memory_side_effect_content_unchanged_write_block . . . . . . . . . . . . 2832
C.183.39 plain_memory_memory_read_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2832
C.183.40 plain_memory_states_memory_read_TCC1 . . . . . . . . . . . . . . . . . . . . 2833
C.183.41 plain_memory_states_memory_read . . . . . . . . . . . . . . . . . . . . . . . . 2833
C.183.42 plain_memory_memory_read_memory_read_TCC1 . . . . . . . . . . . . . . . . 2833
C.183.43 plain_memory_memory_read_memory_read_TCC2 . . . . . . . . . . . . . . . . 2834
C.183.44 plain_memory_memory_read_memory_read_TCC3 . . . . . . . . . . . . . . . . 2834
C.183.45 plain_memory_memory_read_memory_read . . . . . . . . . . . . . . . . . . . . 2835
C.183.46 plain_memory_memory_write_ok . . . . . . . . . . . . . . . . . . . . . . . . . 2835
C.183.47 plain_memory_states_memory_write_TCC1 . . . . . . . . . . . . . . . . . . . . 2835
C.183.48 plain_memory_states_memory_write . . . . . . . . . . . . . . . . . . . . . . . . 2836
C.183.49 plain_memory_memory_read_memory_write_other_TCC1 . . . . . . . . . . . . 2836
C.183.50 plain_memory_memory_read_memory_write_other_TCC2 . . . . . . . . . . . . 2837
C.183.51 plain_memory_memory_read_memory_write_other_TCC3 . . . . . . . . . . . . 2837
C.183.52 plain_memory_memory_read_memory_write_other . . . . . . . . . . . . . . . . 2837
C.183.53 stays_unchanged_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2839
C.183.54 stays_unchanged_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2839
C.183.55 stays_unchanged_unchanged_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2839
C.183.56 stays_unchanged_unchanged_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . 2840
C.183.57 stays_unchanged_unchanged. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2840
C.183.58 stays_unchanged_symmetric. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2840
C.183.59 stays_unchanged_mono. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2841
C.183.60 stays_unchanged_only_changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 2841
C.183.61 stays_unchanged_only_changes_disjoint . . . . . . . . . . . . . . . . . . . . . . 2842
C.183.62 only_changes_symmetric. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2843
C.183.63 only_changes_mono. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2843
C.183.64 only_changes_unchanged_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . 2844
C.183.65 only_changes_unchanged_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . 2844
C.183.66 only_changes_unchanged. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2844
C.183.67 plain_memory_stays_unchanged_memory_read_TCC1 . . . . . . . . . . . . . . 2845
C.183.68 plain_memory_stays_unchanged_memory_read . . . . . . . . . . . . . . . . . . 2845
C.183.69 plain_memory_stays_unchanged_memory_write_TCC1 . . . . . . . . . . . . . . 2846
C.183.70 plain_memory_stays_unchanged_memory_write . . . . . . . . . . . . . . . . . 2846
C.184 Proofs for PointerToMemberExpressions (expressions.pvs) . . . . . . . . . . . . . . . . 2846
C.184.1 ptm_member_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2846
C.184.2 ptm_arrow_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2847
C.185 Proofs for Posnat_induction (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . 2855
C.185.1 posnat_induction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2855
C.186 Proofs for PostfixExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2856
C.186.1 postinc_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2856
C.186.2 postinc_float_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2857
C.186.3 postinc_float_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2857
C.186.4 postinc_float_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2858

C.187 Proofs for PrimaryExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . 2858
C.188 Proofs for Pte_type (paging-data.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2858
C.189 Proofs for Pte_type_adt (Pte_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . 2858
C.189.1 Pte_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2858
C.190 Proofs for Pte_type_adt_reduce (Pte_type_adt.pvs) . . . . . . . . . . . . . . . . . . . . . 2858
C.191 Proofs for Random_Device (random_device.pvs). . . . . . . . . . . . . . . . . . . . . . 2858
C.191.1 base_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2858
C.191.2 rnd_seed_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2859
C.191.3 mem_cnt_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2859
C.191.4 rnd_val_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2860
C.191.5 increase_access_count_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2860
C.191.6 clear_counter_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2860
C.191.7 random_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2861
C.191.8 read_mem_cnt_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2861
C.191.9 read_mem_cnt_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2861
C.191.10 read_mem_cnt_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2862
C.191.11 read_seed_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2864
C.191.12 read_seed_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2864
C.191.13 read_seed_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2865
C.192 Proofs for Read_After_Write_Fails (datatype_model.pvs) . . . . . . . . . . . . . . . . . 2869
C.192.1 plain_mem_write_list_states_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2869
C.192.2 plain_mem_write_list_states . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2869
C.192.3 plain_mem_write_list_read_list_ok . . . . . . . . . . . . . . . . . . . . . . . . . 2871
C.192.4 Fatal_Result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2872
C.193 Proofs for Read_After_Write_Fails_2 (datatype_model.pvs) . . . . . . . . . . . . . . . . 2873
C.193.1 plain_mem_write_list_states_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2873
C.193.2 plain_mem_write_list_states . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2873
C.193.3 plain_mem_write_list_read_list_ok . . . . . . . . . . . . . . . . . . . . . . . . . 2875
C.193.4 Fatal_Result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2876
C.194 Proofs for Register_Id (constants.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2877
C.195 Proofs for Register_Id_adt (Register_Id_adt.pvs) . . . . . . . . . . . . . . . . . . . . . . 2877
C.196 Proofs for Register_Id_adt_reduce (Register_Id_adt.pvs) . . . . . . . . . . . . . . . . . . 2878
C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs). . . . . . . . . . . . . . . . . . . 2878
C.197.1 rewrite_test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2878
C.197.2 rewrite_test_data_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2878
C.197.3 rewrite_test_data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2879
C.197.4 rewrite_test_data_long_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2880
C.197.5 rewrite_test_data_long. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2882
C.197.6 rewrite_test_data_eval_if_ok_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 2884
C.197.7 rewrite_test_data_eval_if_ok_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2885
C.197.8 rewrite_test_data_eval_if_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2885
C.197.9 rewrite_test_data_eval_if_ok_ok_result_ok . . . . . . . . . . . . . . . . . . . . . 2886
C.197.10 rewrite_test_data_eval_if_ok_ok_result_TCC1 . . . . . . . . . . . . . . . . . . . 2887
C.197.11 rewrite_test_data_eval_if_ok_ok_result . . . . . . . . . . . . . . . . . . . . . . . 2887
C.198 Proofs for Search_Example (search-example.pvs). . . . . . . . . . . . . . . . . . . . . . 2888
C.198.1 value_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2888
C.198.2 Search_Pre_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2889
C.198.3 Search_Pre_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2889
C.198.4 Search_Pre_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2892
C.198.5 Search_Pre_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2893
C.198.6 Search_Pre_TCC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2893
C.198.7 Search_Pre_TCC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2894

C.198.8 Search_Pre_TCC7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2895
C.198.9 Search_Pre_TCC8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2895
C.198.10 Search_Pre_TCC9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2896
C.198.11 search_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2898
C.198.12 search_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2900
C.198.13 search_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2901
C.198.14 search_TCC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2901
C.198.15 deref_current_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2903
C.198.16 deref_current_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2904
C.198.17 read_array_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2904
C.198.18 read_array_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2904
C.198.19 read_array_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2905
C.198.20 not_found_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2905
C.198.21 not_found_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2905
C.198.22 not_found_TCC3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2906
C.198.23 not_found_TCC4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2906
C.198.24 found_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2907
C.198.25 found_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2907
C.198.26 found_TCC3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2908
C.198.27 uchar_range_values_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2909
C.198.28 uchar_range_values. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2910
C.198.29 search_terminates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2910
C.198.30 search_read_first. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2912
C.198.31 search_read_current. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2914
C.198.32 search_deref_current. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2915
C.198.33 search_read_last. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2917
C.198.34 search_read_array. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2919
C.198.35 search_not_found. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2921
C.198.36 search_found . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2922
C.199 Proofs for Segment_Reg_Datatype (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . 2924
C.199.1 segment_selector_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2924
C.199.2 segment_reg_data_type_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2924
C.200 Proofs for Segment_Types (paging-data.pvs) . . . . . . . . . . . . . . . . . . . . . . . . 2925
C.201 Proofs for SelectionStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . 2925
C.202 Proofs for Set_Lift (vfiasco-prelude.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . 2925
C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs). . . . . . . . . . . . . 2925
C.203.1 break_catch_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2925
C.203.2 break_break_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2925
C.203.3 break_break_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2926
C.203.4 break_break_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2926
C.203.5 break_break_lift_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2926
C.203.6 break_break_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2926
C.203.7 break_break_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.8 break_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.9 stmt_break_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.10 break_stmt_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.11 break_stmt_catch_continue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2927
C.203.12 break_stmt_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2928
C.203.13 break_stmt_lift. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2928
C.203.14 break_stmt_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2928
C.203.15 break_stmt_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2928
C.203.16 continue_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2929

C.203.17 continue_break_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2929
C.203.18 continue_break_catch_continue . . . . . . . . . . . . . . . . . . . . . . . . . . . 2929
C.203.19 continue_break_catch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . 2929
C.203.20 continue_break_lift_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.21 continue_break_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.22 continue_break_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.23 continue_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.24 stmt_continue_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2930
C.203.25 continue_stmt_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2931
C.203.26 continue_stmt_catch_break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2931
C.203.27 continue_stmt_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2931
C.203.28 continue_stmt_lift. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2931
C.203.29 continue_stmt_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2932
C.203.30 continue_stmt_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2932
C.203.31 switch_stmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2932
C.203.32 stmt_switch_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2932
C.203.33 switch_case_taken. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2933
C.203.34 stmt_switch_case_taken . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2933
C.203.35 switch_case_not_taken. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2933
C.203.36 stmt_switch_case_not_taken . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2933
C.203.37 switch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2934
C.203.38 stmt_switch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2934
C.203.39 switch_catch_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2934
C.203.40 stmt_switch_catch_break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2935
C.203.41 switch_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2935
C.203.42 stmt_switch_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2935
C.203.43 switch_catch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2935
C.203.44 stmt_switch_catch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2936
C.203.45 default_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2936
C.203.46 stmt_default_stmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2936
C.203.47 default_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2936
C.203.48 stmt_default_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2937
C.203.49 default_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2937
C.203.50 stmt_default_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2937
C.203.51 default_catch_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2937
C.203.52 stmt_default_catch_break . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2938
C.203.53 default_catch_continue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2938
C.203.54 stmt_default_catch_continue . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2938
C.203.55 default_catch_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2938
C.203.56 stmt_default_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2939
C.203.57 return_void_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2939
C.203.58 skip_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2939
C.203.59 skip_state_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2939
C.203.60 skip_state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2940
C.203.61 skip_elemination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2940
C.203.62 stmt_skip_elemination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2940
C.203.63 stmt_remove_catch_default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2940
C.203.64 stmt_remove_case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941
C.203.65 stmt_remove_default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941
C.203.66 stmt_remove_catch_continue . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941
C.203.67 stmt_remove_catch_break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941
C.203.68 stmt_ok_lift. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2941

C.203.69 while_unroll_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2942
C.203.70 while_unroll. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2942
C.203.71 stmt_while_unroll. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2942
C.203.72 iterate_while_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2943
C.203.73 while_hang . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2945
C.203.74 composition_assoc_rewrite_stmt_ok . . . . . . . . . . . . . . . . . . . . . . . . 2946
C.203.75 composition_assoc_rewrite_stmt_ok_cstmt . . . . . . . . . . . . . . . . . . . . 2947
C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs). . . . . . . . . . . . . 2947
C.204.1 forward_s_c_s_of_s_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2947
C.204.2 stmt_ok_lift_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2947
C.204.3 break_break_stmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2947
C.204.4 break_break_catch_continue_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2948
C.204.5 break_break_catch_default_expr . . . . . . . . . . . . . . . . . . . . . . . . . . 2948
C.204.6 break_break_lift_stmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2948
C.204.7 break_break_case_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2949
C.204.8 break_break_default_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2949
C.204.9 continue_break_stmt_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2949
C.204.10 continue_break_catch_continue_expr . . . . . . . . . . . . . . . . . . . . . . . . 2949
C.204.11 continue_break_catch_default_expr . . . . . . . . . . . . . . . . . . . . . . . . 2950
C.204.12 continue_break_lift_stmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . 2950
C.204.13 continue_break_case_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2950
C.204.14 continue_break_default_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2951
C.204.15 while_unroll_expr_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2951
C.204.16 while_unroll_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2951
C.204.17 while_unroll_lexpr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2952
C.204.18 stmt_while_unroll_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2952
C.204.19 stmt_while_unroll_lexpr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2953
C.204.20 e2s_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2953
C.204.21 stmt_e2s_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2954
C.204.22 e2s_state_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2954
C.204.23 e2s_state_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2954
C.204.24 e2s_state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2955
C.204.25 stmt_e2s_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2955
C.204.26 stmt_e2s_state_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2955
C.204.27 stmt_e2s_state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2956
C.204.28 comp_eval_if_ok_fstmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2956
C.204.29 stmt_eval_if_ok_fstmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2956
C.204.30 comp_eval_if_ok_fstmt_cstmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2956
C.204.31 stmt_eval_if_ok_fstmt_cstmt . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2957
C.204.32 composition_assoc_rewrite_expr_1 . . . . . . . . . . . . . . . . . . . . . . . . . 2957
C.204.33 composition_assoc_rewrite_expr_2 . . . . . . . . . . . . . . . . . . . . . . . . . 2957
C.204.34 composition_assoc_rewrite_expr_3 . . . . . . . . . . . . . . . . . . . . . . . . . 2958
C.204.35 composition_assoc_rewrite_expr_4 . . . . . . . . . . . . . . . . . . . . . . . . . 2958
C.204.36 composition_assoc_rewrite_expr_5 . . . . . . . . . . . . . . . . . . . . . . . . . 2958
C.204.37 composition_assoc_rewrite_expr_6 . . . . . . . . . . . . . . . . . . . . . . . . . 2959
C.204.38 composition_assoc_rewrite_stmt_ok . . . . . . . . . . . . . . . . . . . . . . . . 2959
C.204.39 composition_assoc_rewrite_stmt_ok_expr . . . . . . . . . . . . . . . . . . . . . 2959
C.204.40 composition_assoc_rewrite_stmt_ok_expr_lexpr . . . . . . . . . . . . . . . . . . 2960
C.204.41 ok_result_fstmt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2960
C.204.42 pm_q_prop_read_ok_s_read_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . 2960
C.205 Proofs for Single_Statement_Rewrites2 (statement-rewrites.pvs). . . . . . . . . . . . . 2961
C.205.1 ok_result_fexpr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2961

C.205.2 e2s_merge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2961
C.205.3 stmt_e2s_merge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2961
C.205.4 e2s_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2962
C.205.5 stmt_e2s_expr. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2962
C.205.6 composition_assoc_expression_rewrite_stmt . . . . . . . . . . . . . . . . . . . . 2962
C.205.7 comp_eval_if_ok_fstmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2962
C.205.8 stmt_eval_if_ok_fstmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2963
C.205.9 stmt_eval_if_ok_fexpr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2963
C.205.10 comp_eval_if_ok_fstmt_cstmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2963
C.205.11 stmt_eval_if_ok_fstmt_cstmt_expr . . . . . . . . . . . . . . . . . . . . . . . . . 2964
C.206 Proofs for Single_Statement_Rewrites3 (statement-rewrites.pvs). . . . . . . . . . . . . 2964
C.206.1 ok_result_elemination_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2964
C.206.2 comp_eval_if_ok_fexpr_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2965
C.206.3 expr_eval_if_ok_fexpr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2965
C.206.4 composition_assoc_expression_rewrite . . . . . . . . . . . . . . . . . . . . . . . 2965
C.206.5 stmt_eval_if_ok_fexpr_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2966
C.207 Proofs for Single_Statement_Rewrites4 (statement-rewrites.pvs). . . . . . . . . . . . . 2966
C.207.1 expr_eval_if_ok_fexpr_expr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2966
C.208 Proofs for SkipStatements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . 2966
C.209 Proofs for State_Transformer (state-transformer.pvs) . . . . . . . . . . . . . . . . . . . 2966
C.210 Proofs for State_Transformer_Lift (state-transformer.pvs). . . . . . . . . . . . . . . . . 2967
C.211 Proofs for State_Transformer_Lift_Expr (state-transformer.pvs). . . . . . . . . . . . . 2967
C.211.1 ok_result_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2967
C.211.2 ok_result_data_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2967
C.211.3 ok_result_data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2967
C.211.4 ok_result_state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2967
C.211.5 expr_2_super_ok_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.211.6 ok_lift_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.211.7 has_next_state_ok_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.211.8 has_next_state_fatal_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.211.9 expr_2_super_fatal_result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2968
C.212 Proofs for State_Transformer_Lift_Stmt (state-transformer.pvs). . . . . . . . . . . . . 2969
C.213 Proofs for Statement_Composition_Rewrites (state-transformer.pvs). . . . . . . . . . . 2969
C.213.1 composition_assoc_rewrite_1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2969
C.213.2 composition_assoc_rewrite_2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2969
C.213.3 composition_assoc_rewrite_3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2969
C.213.4 composition_assoc_rewrite_4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2970
C.213.5 composition_assoc_rewrite_5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2970
C.213.6 composition_assoc_rewrite_6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2970
C.213.7 composition_assoc_rewrite_7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2971
C.213.8 composition_assoc_rewrite_8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2971
C.214 Proofs for Statement_Rewrites (statement-rewrites.pvs). . . . . . . . . . . . . . . . . . 2971
C.215 Proofs for Statements (statements.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . 2971
C.216 Proofs for StmtResult (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2972
C.217 Proofs for StmtResult_adt (StmtResult_adt.pvs). . . . . . . . . . . . . . . . . . . . . . 2972
C.218 Proofs for StmtResult_adt_map (StmtResult_adt.pvs) . . . . . . . . . . . . . . . . . . . 2972
C.219 Proofs for StmtResult_adt_reduce (StmtResult_adt.pvs) . . . . . . . . . . . . . . . . . . 2972
C.220 Proofs for Subtype_stable (graph.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . . . 2972
C.220.1 length_stable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2972
C.220.2 nth_stable_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2972
C.220.3 nth_stable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2973
C.221 Proofs for SuperResult (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2974

C.222 Proofs for SuperResult_adt (SuperResult_adt.pvs). . . . . . . . . . . . . . . . . . . . . 2974
C.223 Proofs for SuperResult_adt_map (SuperResult_adt.pvs) . . . . . . . . . . . . . . . . . . 2974
C.224 Proofs for SuperResult_adt_reduce (SuperResult_adt.pvs) . . . . . . . . . . . . . . . . . 2974
C.225 Proofs for Super_Embedding (result.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . 2974
C.226 Proofs for Super_Embedding_Expr (result.pvs). . . . . . . . . . . . . . . . . . . . . . . 2974
C.226.1 expr_2_super_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2974
C.226.2 expr_2_super_res_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2974
C.227 Proofs for Super_Embedding_Stmt (result.pvs). . . . . . . . . . . . . . . . . . . . . . . 2975
C.227.1 stmt_2_super_res_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2975
C.227.2 stmt_2_super_res_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2975
C.228 Proofs for Super_Result_Util (result.pvs). . . . . . . . . . . . . . . . . . . . . . . . . . 2975
C.229 Proofs for Transformer_Invariant (state-transformer.pvs) . . . . . . . . . . . . . . . . . 2976
C.229.1 result_pred_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2976
C.229.2 super_transformer_invariant_next_ok_TCC1 . . . . . . . . . . . . . . . . . . . 2976
C.229.3 super_transformer_invariant_next_ok . . . . . . . . . . . . . . . . . . . . . . . 2976
C.229.4 transformer_invariant_mono_transformers. . . . . . . . . . . . . . . . . . . . 2977
C.229.5 transformer_invariant_union_transformers. . . . . . . . . . . . . . . . . . . . 2977
C.229.6 transformer_invariant_truth. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2978
C.229.7 transformer_invariant_all_transformers. . . . . . . . . . . . . . . . . . . . . . 2978
C.229.8 super_transformers_ok_ok. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2978
C.229.9 transformers_ok_mono_transformers. . . . . . . . . . . . . . . . . . . . . . . 2979
C.229.10 transformers_ok_mono_states. . . . . . . . . . . . . . . . . . . . . . . . . . . 2979
C.229.11 transformers_ok_union_transformers. . . . . . . . . . . . . . . . . . . . . . . 2979
C.229.12 transformers_ok_all_transformers. . . . . . . . . . . . . . . . . . . . . . . . . 2980
C.230 Proofs for Transformer_Invariant_2 (state-transformer.pvs). . . . . . . . . . . . . . . . 2981
C.230.1 expr_transformer_invariant_next_ok_TCC1 . . . . . . . . . . . . . . . . . . . . 2981
C.230.2 expr_transformer_invariant_next_ok . . . . . . . . . . . . . . . . . . . . . . . . 2981
C.230.3 expr_transformers_ok_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2981
C.230.4 expr_result_pred_next_state_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . 2982
C.230.5 expr_result_pred_next_state . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2982
C.231 Proofs for Transformer_Invariant_3 (state-transformer.pvs). . . . . . . . . . . . . . . . 2982
C.231.1 fexpr_composition_transformers_ok. . . . . . . . . . . . . . . . . . . . . . . . 2982
C.231.2 expr_composition_transformers_ok. . . . . . . . . . . . . . . . . . . . . . . . 2983
C.231.3 fexpr_composition_transformer_invariant . . . . . . . . . . . . . . . . . . . . . 2984
C.231.4 expr_composition_transformer_invariant. . . . . . . . . . . . . . . . . . . . . 2985
C.232 Proofs for Transformer_Super_Embedding (state-transformer.pvs). . . . . . . . . . . . 2985
C.233 Proofs for Transformer_Super_Embedding_Expr (state-transformer.pvs) . . . . . . . . . 2985
C.233.1 ok_expr_2_super . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2985
C.233.2 has_next_state_expr_2_super . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2986
C.233.3 state_expr_2_super_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2986
C.233.4 state_expr_2_super_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2986
C.233.5 state_expr_2_super. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2987
C.234 Proofs for Transformer_Super_Embedding_Stmt (state-transformer.pvs) . . . . . . . . . 2987
C.234.1 ok_stmt_2_super. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2987
C.234.2 has_next_state_stmt_2_super . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2987
C.234.3 state_stmt_2_super_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2987
C.234.4 state_stmt_2_super_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2988
C.234.5 state_stmt_2_super. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2988
C.235 Proofs for UnaryExpressions (expressions.pvs) . . . . . . . . . . . . . . . . . . . . . . . 2988
C.235.1 deref_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2988
C.235.2 arrow_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2989
C.235.3 arrow_TCC2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2989

C.235.4 unary_minus_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2989
C.235.5 unary_minus_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2990
C.235.6 unary_minus_unsigned_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . 2990
C.235.7 unary_minus_unsigned_TCC2. . . . . . . . . . . . . . . . . . . . . . . . . . . 2990
C.235.8 preinc_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2990
C.235.9 sizeof_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2991
C.236 Proofs for Uninterpreted_Data (abstract_data.pvs). . . . . . . . . . . . . . . . . . . . . 2991
C.236.1 u_data_type_length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2991
C.237 Proofs for Unit (vfiasco-prelude.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2991
C.238 Proofs for Unit_adt (Unit_adt.pvs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2992
C.239 Proofs for Unit_adt_reduce (Unit_adt.pvs). . . . . . . . . . . . . . . . . . . . . . . . . 2992
C.240 Proofs for While_Hoare (statement-rewrites.pvs). . . . . . . . . . . . . . . . . . . . . . 2992
C.240.1 iterate_while_right. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2992
C.240.2 while_variant?_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2993
C.240.3 while_no_cb_TCC1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2995
C.240.4 while_no_cb_cb_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2995
C.240.5 iterate_while_invariant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2995
C.240.6 min_termination_point_no_less . . . . . . . . . . . . . . . . . . . . . . . . . . . 2997
C.240.7 while_terminates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2997
C.240.8 hoare_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2997
C.241 Proofs for While_Rewrites (statement-rewrites.pvs) . . . . . . . . . . . . . . . . . . . . 2998
C.241.1 while_to_while_no_cb . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2998
C.241.2 while_inv_rewrite_termination_result . . . . . . . . . . . . . . . . . . . . . . . 2998
C.241.3 while_inv_rewrite_data_ok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2998
C.241.4 while_inv_rewrite_data_break . . . . . . . . . . . . . . . . . . . . . . . . . . . 2999
C.241.5 while_inv_rewrite_data_return . . . . . . . . . . . . . . . . . . . . . . . . . . . 2999
C.241.6 stmt_while_inv_rewrite_termination_result_TCC1 . . . . . . . . . . . . . . . . 3000
C.241.7 stmt_while_inv_rewrite_termination_result . . . . . . . . . . . . . . . . . . . . 3000
C.241.8 stmt_while_inv_rewrite_data_ok . . . . . . . . . . . . . . . . . . . . . . . . . . 3001
C.241.9 stmt_while_inv_rewrite_data_break . . . . . . . . . . . . . . . . . . . . . . . . 3002
C.241.10 stmt_while_inv_rewrite_data_return . . . . . . . . . . . . . . . . . . . . . . . . 3002
C.241.11 pm_q_prop_while. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3003
C.241.12 pm_q_prop_stmt_while_TCC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 3004
C.241.13 pm_q_prop_stmt_while . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3004

C.1 Proofs for Abstract_Read_Write (abstract_data.pvs)

C.1 Proofs for Abstract_Read_Write (abstract_data.pvs)

C.1.1 Abstract_Read_Write.read_data_valid_in_mem

Terse proof for read_data_valid_in_mem.
read_data_valid_in_mem:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Memory_struct[State], s: State): OK?(read_data(pm, dt)(addr)(s)) ⊃ valid_in_mem(pm, dt)(addr)(s)

Repeatedly Skolemizing and flattening, Expanding the definition of valid_in_mem, Expanding the definition of read_data, Expanding the definition of ok_lift, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using valid_iff_from_byte, matching in * where idt gets dt!1, This completes the proof of read_data_valid_in_mem. Q.E.D.

C.2 Proofs for Abstract_Read_Write_Plain (plain_memory.pvs)

This theory contains no provable formal statements.

C.3 Proofs for Address_Datatype (paging-data.pvs)

C.3.1 Address_Datatype.address_data_type_TCC1

Terse proof for address_data_type_TCC1.
address_data_type_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[Memory_Address_4G])): true

Using lemma address_data_type_exists, This completes the proof of address_data_type_TCC1. Q.E.D.

C.4 Proofs for Address_Helpers (constants.pvs)

C.4.1 Address_Helpers.type_add_rewrite

Terse proof for type_add_rewrite.
type_add_rewrite:

{1} ∀ (m_addr: Memory_Address, size: int): (m_addr+ size)`type_of = m_addr`type_of

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of type_add_rewrite. Q.E.D.

C.4.2 Address_Helpers.offset_add_rewrite

Terse proof for offset_add_rewrite.
offset_add_rewrite:

{1} ∀ (m_addr: Memory_Address, size: int):

(m_addr+ size)`offset = m_addr‘offset + size

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of offset_add_rewrite. Q.E.D.

C.4.3 Address_Helpers.type_add_memory

Terse proof for type_add_memory.
type_add_memory:

{1} ∀ (m_addr, size): Mem?((m_addr+ size)`type_of)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of type_add_memory. Q.E.D.

C.4.4 Address_Helpers.address_add_zero

Terse proof for address_add_zero.
address_add_zero:

{1} ∀ (a: Address): a + 0 = a

Expanding the definition of +, which is trivially true. This completes the proof of address_add_zero. Q.E.D.

C.4.5 Address_Helpers.address_add_sum

Terse proof for address_add_sum.
address_add_sum:

{1} ∀ (a: Address, i, j: int): (a + i) + j = a + (i + j)

Expanding the definition of +, which is trivially true. This completes the proof of address_add_sum. Q.E.D.

C.5 Proofs for Address_Model (paging-data-models.pvs)

C.4.6 Address_Helpers.reg_size_TCC1

Terse proof for reg_size_TCC1.

reg_size_TCC1:

{1} ∀ (max: Memory_Address, id: Register_Id): ¬ SYSENTER_EIP?(id) ∧ ¬ SYSENTER_ESP?(id) ∧ ¬ SYSENTER_CS?(id) ∧ ¬ TR?(id) ∧ ¬ LDTR?(id) ∧ ¬ GDTR?(id) ∧ ¬ IDTR?(id) ∧ ¬ EFLAGS?(id) ∧ ¬ IP?(id) ∧ ¬ Mem?(id) ⊃ ¬ (GP?(id) ∧ Segment_Reg?(id)) ∧ ¬ (Segment_Reg?(id) ∧ Control_Reg?(id))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of reg_size_TCC1. Q.E.D.

C.4.7 Address_Helpers.reg_size_TCC2

Terse proof for reg_size_TCC2.

reg_size_TCC2:

{1} ∀ (max: Memory_Address, id: Register_Id): ¬ SYSENTER_EIP?(id) ∧ ¬ SYSENTER_ESP?(id) ∧ ¬ SYSENTER_CS?(id) ∧ ¬ TR?(id) ∧ ¬ LDTR?(id) ∧ ¬ GDTR?(id) ∧ ¬ IDTR?(id) ∧ ¬ EFLAGS?(id) ∧ ¬ IP?(id) ∧ ¬ Mem?(id) ⊃ GP?(id) ∨ Segment_Reg?(id) ∨ Control_Reg?(id)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of reg_size_TCC2. Q.E.D.

C.5 Proofs for Address_Model (paging-data-models.pvs)

C.5.1 Address_Model.address_to_byte_TCC1

Terse proof for address_to_byte_TCC1.
address_to_byte_TCC1:

{1} ∀ (addr: Memory_Address_4G): offset(addr) ≥ 0

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less over-

write_shift_bits_less max_linear_offset bus_width Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of address_to_byte_TCC1. Q.E.D.

C.5.2 Address_Model.address_to_byte_TCC2

Terse proof for address_to_byte_TCC2.
address_to_byte_TCC2:

{1} ∀ (addr: Memory_Address_4G): cut_bits(offset(addr), 0, 8) < max_byte

Repeatedly Skolemizing and flattening, Using lemma cut_bits_below, Rewriting using less_than_max_byte, matching in *, This completes the proof of address_to_byte_TCC2. Q.E.D.

C.5.3 Address_Model.address_to_byte_TCC3

Terse proof for address_to_byte_TCC3.
address_to_byte_TCC3:

{1} ∀ (addr: Memory_Address_4G):

every[nat] ({s: nat | s < max_byte}) ((:cut_bits(offset(addr), 8, 8), cut_bits(offset(addr), 16, 8),

cut_bits(offset(addr), 24, 8):))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less over-

write_shift_bits_less max_linear_offset bus_width Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of address_to_byte_TCC3. Q.E.D.

C.5.4 Address_Model.address_from_byte_TCC1

Terse proof for address_from_byte_TCC1.
address_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ 0 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_from_byte_TCC1. Q.E.D.

C.5.5 Address_Model.address_from_byte_TCC2

Terse proof for address_from_byte_TCC2.
address_from_byte_TCC2:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ 1 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_from_byte_TCC2. Q.E.D.

C.5 Proofs for Address_Model (paging-data-models.pvs)

C.5.6 Address_Model.address_from_byte_TCC3

Terse proof for address_from_byte_TCC3.
address_from_byte_TCC3:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ 2 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_from_byte_TCC3. Q.E.D.

C.5.7 Address_Model.address_from_byte_TCC4

Terse proof for address_from_byte_TCC4.
address_from_byte_TCC4:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ 3 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_from_byte_TCC4. Q.E.D.

C.5.8 Address_Model.address_from_byte_TCC5

Terse proof for address_from_byte_TCC5.

address_from_byte_TCC5:

{1} ∀ (data: list[Byte], a: Address): address_valid?(data, a) ⊃ Mem?(Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, nth[Byte] (data, 0),

      0,

8), nth[Byte] (data, 1),

    8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`type_of)

∧ 0 ≤ Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, nth[Byte] (data, 0),

  0,

8), nth[Byte] (data, 1),

8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

∧ Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, nth[Byte] (data, 0),

  0,

8), nth[Byte] (data, 1),

8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

< max_linear_offset

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less address_valid? max_linear_offset bus_width

Expanding the definition of Mem, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of address_from_byte_TCC5.

C.5 Proofs for Address_Model (paging-data-models.pvs)

Q.E.D.

C.5.9 Address_Model.address_model_TCC1

Terse proof for address_model_TCC1.
address_model_TCC1:

{1} ∀ (f: [[Memory_Address_4G, Address] → [list[Byte] → bool]]): (f = (λ (d: Memory_Address_4G, a: Address): (zero_mask?(4)))) ⊃ (∀ (x_{1}: [Memory_Address_4G, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Expanding the definition of singleton?, which is trivially true. This completes the proof of address_model_TCC1. Q.E.D.

C.5.10 Address_Model.address_valid_to_byte

Terse proof for address_valid_to_byte.
address_valid_to_byte:

{1} ∀ (d: Memory_Address_4G, a: Address):

valid?(uidt(address_model))(to_byte(address_model)(d, a), a)

Installing automatic rewrites from: address_model address_to_byte length address_valid? Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement, This completes the proof of address_valid_to_byte. Q.E.D.

C.5.11 Address_Model.address_is_pod

Terse proof for address_is_pod.
address_is_pod:

{1} pod_data_type?(address_model)

Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Expanding the definition of uninterpreted_data_type?, Applying propositional simplification, we get 6 subgoals:

address_is_pod.1:

{1} ∀ (l: list[Byte], a: Address):

¬ length(l) = size(address_model`uidt) ⊃ ¬ valid?(address_model`uidt)(l, a)

Repeatedly Skolemizing and flattening, Expanding the definition of address_model, Expanding the definition of address_valid?, which is trivially true. This completes the proof of address_is_pod.1.

address_is_pod.2:

{1} ∀ (d: Memory_Address_4G, a: Address): valid?(uidt(address_model))(to_byte(address_model)(d, a), a)

Repeatedly Skolemizing and flattening, Rewriting using address_valid_to_byte, matching in *, This completes the proof of address_is_pod.2.

address_is_pod.3:

{1} ∀ (l: list[Byte], a: Address):

valid?(uidt(address_model))(l, a) ≡ up?(from_byte(address_model)(l, a))

Repeatedly Skolemizing and flattening, Expanding the definition of address_model, Expanding the definition of address_from_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of address_is_pod.3.

address_is_pod.4:

{1} ∀ (d: Memory_Address_4G, a: Address): down(from_byte(address_model)(to_byte(address_model)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: address_model address_from_byte address_to_byte address_valid?

length nth overwrite_shift_bits_zero cut_bits_cut_bits overwrite_shift_bits_merge max_linear_offset bus_width zero_aligned

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using shift_bits_left_cut_bits, matching in *, Applying extensionality, we get 2 subgoals:

address_is_pod.4.1:

{-1} Mem?(d′`type_of)
{-2} 0 ≤ d′`offset
{-3} d′`offset < expt(2, 32)
{1} Mem(offset(d′))`offset = d′`offset

Expanding the definition of Mem, which is trivially true. This completes the proof of address_is_pod.4.1.

address_is_pod.4.2:

{-1} Mem?(d′`type_of)
{-2} 0 ≤ d′`offset
{-3} d′`offset < expt(2, 32)
{1} Mem(offset(d′))`type_of = d′`type_of

Expanding the definition of Mem, Simplifying, rewriting, and recording with decision procedures, This completes the proof of address_is_pod.4.2.

C.6 Proofs for Address_Util (memory.pvs)

address_is_pod.5:

{1} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(address_model))(l, a_{1}) ≡ valid?(uidt(address_model))(l, a_{2})

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of address_model, Expanding the definition of address_valid?, which is trivially true. This completes the proof of address_is_pod.5.

address_is_pod.6:

{1} size(uidt(address_model)) > 0

Expanding the definition of address_model, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of address_is_pod.6. Q.E.D.

C.6 Proofs for Address_Util (memory.pvs)

C.6.1 Address_Util.address_block_subset_1

Terse proof for address_block_subset_1.
address_block_subset_1:

{1} ∀ (addr: Address, size: nat):

(address_block(addr + 1, size) ⊆ address_block(addr, 1 + size))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_block_subset_1. Q.E.D.

C.6.2 Address_Util.address_block_subset_2

Terse proof for address_block_subset_2.
address_block_subset_2:

{1} ∀ (addresses: PRED[Address], addr: Address, size: nat): (address_block(addr, size + 1) ⊆ addresses) ⊃ (address_block(addr + 1, size) ⊆ addresses)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of address_block_subset_2. Q.E.D.

C.6.3 Address_Util.blocks_disjoint_disjoint

Terse proof for blocks_disjoint_disjoint.

blocks_disjoint_disjoint:

{1} ∀ (addr1, addr2: Address, size1, size2: nat):

size1 > 0 ∧ size2 > 0 ⊃ blocks_disjoint?(addr1, size1, addr2, size2) = disjoint?(address_block(addr1, size1), address_block(addr2, size2))

Repeatedly Skolemizing and flattening, Converting equality to IFF, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

blocks_disjoint_disjoint.1:

{-1} size1′ ≥ 0
{-2} size2′ ≥ 0
{-3} size1′ > 0
{-4} size2′ > 0
{-5} blocks_disjoint?(addr1′, size1′, addr2′, size2′)
{1} disjoint?(address_block(addr1′, size1′), address_block(addr2′, size2′))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of blocks_disjoint_disjoint.1.
blocks_disjoint_disjoint.2:

{-1} size1′ ≥ 0
{-2} size2′ ≥ 0
{-3} size1′ > 0
{-4} size2′ > 0
{-5} disjoint?(address_block(addr1′, size1′), address_block(addr2′, size2′))
{1} blocks_disjoint?(addr1′, size1′, addr2′, size2′)

Expanding the definition of blocks_disjoint?, Applying disjunctive simplification to flatten sequent, Expanding the definition(s) of (disjoint? empty? intersection member), Case splitting on addr1!1 < addr2!1, we get 2 subgoals:

blocks_disjoint_disjoint.2.1:

{-1} addr1′ < addr2′
{-2} size1′ ≥ 0
{-3} size2′ ≥ 0
{-4} size1′ > 0
{-5} size2′ > 0
{-6} type_of(addr1′) = type_of(addr2′)
{-7} ∀ (x: Address):

¬ (address_block(addr1′, size1′)(x) ∧ address_block(addr2′, size2′)(x))

{1} addr1′ + size1′ ≤ addr2′
{2} addr2′ + size2′ ≤ addr1′

Instantiating the top quantifier in -7 with the terms: addr2′, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of blocks_disjoint_disjoint.2.1.

blocks_disjoint_disjoint.2.2:

{-1} size1′ ≥ 0
{-2} size2′ ≥ 0
{-3} size1′ > 0
{-4} size2′ > 0
{-5} type_of(addr1′) = type_of(addr2′)
{-6} ∀ (x: Address):

¬ (address_block(addr1′, size1′)(x) ∧ address_block(addr2′, size2′)(x))

{1} addr1′ < addr2′
{2} addr1′ + size1′ ≤ addr2′
{3} addr2′ + size2′ ≤ addr1′

Instantiating the top quantifier in -6 with the terms: addr1′, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of blocks_disjoint_disjoint.2.2.

Q.E.D.

C.6.4 Address_Util.blocks_disjoint_symmetric

Terse proof for blocks_disjoint_symmetric.
blocks_disjoint_symmetric:

{1} ∀ (addr1, addr2: Address, size1, size2: nat):

blocks_disjoint?(addr1, size1, addr2, size2) = blocks_disjoint?(addr2, size2, addr1, size1)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of blocks_disjoint_symmetric.

Q.E.D.

C.6.5 Address_Util.blocks_in_larger_set

Terse proof for blocks_in_larger_set.
blocks_in_larger_set:

{1} ∀ (addr1, addr2: Address, size1, size2: nat, addresses: PRED[Address]): (address_block(addr1, size1) ⊆ addresses) ∧ (address_block(addr2, size2) ⊆ addresses) ∧ blocks_disjoint?(addr1, size1, addr2, size2) ⊃ (address_block(addr2, size2) ⊆ (addresses \ address_block(addr1, size1)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of blocks_in_larger_set. Q.E.D.

C.6.6 Address_Util.blocks_pairwise_disjoint_add

Terse proof for blocks_pairwise_disjoint_add.

blocks_pairwise_disjoint_add:

{1} ∀ (addr: Address, size: posnat, blocks: list[[Address, posnat]]): blocks_pairwise_disjoint(blocks) ∧ (∀ (oaddr: Address, osize: posnat): member((oaddr, osize), blocks) ⊃ blocks_disjoint?(addr, size, oaddr, osize)) ⊃ blocks_pairwise_disjoint(cons((addr, size), blocks))

Expanding the definition of blocks_pairwise_disjoint, Repeatedly Skolemizing and flattening, Expanding the definition of member, Case splitting on addr!2 = addr!1 AND size!2 = size!1, we get 2 subgoals:

blocks_pairwise_disjoint_add.1:

{-1} addr′′ = addr′ ∧ size′′ = size′
{-2} size′′ > 0
{-3} size′′′ > 0
{-4} size′ > 0

{-5} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-6} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{-7} addr′′ = addr′ ∧ size′′ = size′ ∨ member((addr′′, size′′), blocks′)
{-8} member((addr′′′, size′′′),

list_remove((addr′′, size′′), cons((addr′, size′), blocks′)))

{1} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of list_remove, Rewriting using member_list_remove, matching in *, Instantiating the top quantifier in -7 with the terms: addr′′′, size′′′, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of blocks_pairwise_disjoint_add.1.
blocks_pairwise_disjoint_add.2:

{-1} size′′ > 0
{-2} size′′′ > 0
{-3} size′ > 0

{-4} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-5} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{-6} addr′′ = addr′ ∧ size′′ = size′ ∨ member((addr′′, size′′), blocks′)
{-7} member((addr′′′, size′′′),

list_remove((addr′′, size′′), cons((addr′, size′), blocks′)))

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Splitting conjunctions, we get 2 subgoals:

blocks_pairwise_disjoint_add.2.1:

{-1} addr′′ = addr′ ∧ size′′ = size′
{-2} size′′ > 0
{-3} size′′′ > 0
{-4} size′ > 0

{-5} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-6} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{-7} member((addr′′′, size′′′),

list_remove((addr′′, size′′), cons((addr′, size′), blocks′)))

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

which is trivially true.

This completes the proof of blocks_pairwise_disjoint_add.2.1.
blocks_pairwise_disjoint_add.2.2:

{-1} member((addr′′, size′′), blocks′)
{-2} size′′ > 0
{-3} size′′′ > 0
{-4} size′ > 0

{-5} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-6} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{-7} member((addr′′′, size′′′),

list_remove((addr′′, size′′), cons((addr′, size′), blocks′)))

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Expanding the definition of list_remove, Lifting IF-conditions to the top level, Splitting conjunctions, we get 2 subgoals:

blocks_pairwise_disjoint_add.2.2.1:

{-1} (addr′′ = addr′ ∧ size′′ = size′) ∧

member((addr′′′, size′′′), list_remove((addr′′, size′′), blocks′))

{-2} member((addr′′, size′′), blocks′)
{-3} size′′ > 0
{-4} size′′′ > 0
{-5} size′ > 0

{-6} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-7} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of blocks_pairwise_disjoint_add.2.2.1.
blocks_pairwise_disjoint_add.2.2.2:

{-1} ¬ (addr′′ = addr′ ∧ size′′ = size′) ∧

member((addr′′′, size′′′),

cons((addr′, size′), list_remove((addr′′, size′′), blocks′)))

{-2} member((addr′′, size′′), blocks′)
{-3} size′′ > 0
{-4} size′′′ > 0
{-5} size′ > 0

{-6} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-7} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Applying disjunctive simplification to flatten sequent, Hiding formulas: 1, Expanding the definition of member, Splitting conjunctions, we get 2 subgoals:

blocks_pairwise_disjoint_add.2.2.2.1:

{-1} addr′′′ = addr′ ∧ size′′′ = size′
{-2} member((addr′′, size′′), blocks′)
{-3} size′′ > 0
{-4} size′′′ > 0
{-5} size′ > 0

{-6} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-7} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -8 with the terms: addr′′, size′′, Simplifying, rewriting, and recording with decision procedures, Rewriting using blocks_disjoint_symmetric, matching in *,

This completes the proof of blocks_pairwise_disjoint_add.2.2.2.1.

blocks_pairwise_disjoint_add.2.2.2.2:

{-1} member((addr′′′, size′′′), list_remove((addr′′, size′′), blocks′))
{-2} member((addr′′, size′′), blocks′)
{-3} size′′ > 0
{-4} size′′′ > 0
{-5} size′ > 0

{-6} ∀ (addr_1, addr_2: Address, size_1, size_2: posnat): member((addr_1, size_1), blocks′) ∧ member((addr_2, size_2), list_remove((addr_1, size_1), blocks′)) ⊃ blocks_disjoint?(addr_1, size_1, addr_2, size_2)

{-7} ∀ (oaddr: Address, osize: posnat):

member((oaddr, osize), blocks′) ⊃ blocks_disjoint?(addr′, size′, oaddr, osize)

{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′′, size′′, addr′′′, size′′′)

Instantiating the top quantifier in -6 with the terms: addr′′, addr′′′, size′′, size′′′, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of blocks_pairwise_disjoint_add.2.2.2.2.

Q.E.D.

C.6.7 Address_Util.blocks_pairwise_disjoint_remove

Terse proof for blocks_pairwise_disjoint_remove.
blocks_pairwise_disjoint_remove:

{1} ∀ (addr: Address, size: posnat, blocks: list[[Address, posnat]]): blocks_pairwise_disjoint(blocks) ⊃ blocks_pairwise_disjoint(list_remove((addr, size), blocks))

Expanding the definition of blocks_pairwise_disjoint, Repeatedly Skolemizing and flattening, Rewriting using list_remove_commutative, matching in *, Rewriting using member_list_remove, matching in *, Rewriting using member_list_remove, matching in *, Instantiating the top quantifier in -4 with the terms: addr′′, addr′′′, size′′, size′′′, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of blocks_pairwise_disjoint_remove.

Q.E.D.

C.6.8 Address_Util.subset_block_is_free

Terse proof for subset_block_is_free.
subset_block_is_free:

{1} ∀ (b_{1}, b_{2}: PRED[Address], alloc_points: list[[Address, posnat]]): (b_{1} ⊆ b_{2}) ∧ block_is_free(b_{2}, alloc_points) ⊃ block_is_free(b_{1}, alloc_points)

Repeatedly Skolemizing and flattening, Expanding the definition of block_is_free, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Using lemma disjoint_mono, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_equal, matching in *, This completes the proof of subset_block_is_free. Q.E.D.

C.6.9 Address_Util.block_is_free_add

Terse proof for block_is_free_add.
block_is_free_add:

{1} ∀ (block: PRED[Address], alloc_points: list[[Address, posnat]], addr: Address, size: posnat): block_is_free(block, alloc_points) ∧ disjoint?(block, address_block(addr, size)) ⊃ block_is_free(block, cons((addr, size), alloc_points))

Repeatedly Skolemizing and flattening, Expanding the definition of block_is_free, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: member Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: addr′′, size′′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of block_is_free_add. Q.E.D.

C.7 Proofs for Alignment (vfiasco-prelude.pvs)

C.7.1 Alignment.aligned_zero

Terse proof for aligned_zero.

aligned_zero:

{1} ∀ (n: nat): aligned?(n)(0)

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Rewriting using divides_zero, matching in *, This completes the proof of aligned_zero. Q.E.D.

C.7.2 Alignment.zero_aligned

Terse proof for zero_aligned.

zero_aligned:

{1} ∀ (n: nat): aligned?(0)(n)

C.7 Proofs for Alignment (vfiasco-prelude.pvs)

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Expanding the definition of expt, Rewriting using one_divides, matching in *, This completes the proof of zero_aligned. Q.E.D.

C.7.3 Alignment.aligned_bigger

Terse proof for aligned_bigger.
aligned_bigger:

{1} ∀ (m, n_{1}, n_{2}: nat): n_{2} ≤ n_{1} ∧ aligned?(n_{1})(m) ⊃ aligned?(n_{2})(m)

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Forward chaining on divides_expt_gt, This completes the proof of aligned_bigger. Q.E.D.

C.7.4 Alignment.aligned_plus

Terse proof for aligned_plus.

aligned_plus:

{1} ∀ (m, n: nat, a: aligned(n), b: aligned(m)):

aligned?(min(n, m))(a + b)

Repeatedly Skolemizing and flattening, Expanding the definition of min, Expanding the definition of aligned?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

aligned_plus.1:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} divides(expt(2, n′), a′)
{-4} divides(expt(2, m′), b′)
{-5} n′ > m′
{1} divides(expt(2, m′), a′ + b′)

Rewriting using divides_sum, matching in *, Hiding formulas: -4, 2, Using lemma expt_divides, Simplifying, rewriting, and recording with decision procedures, Using lemma divides_transitive, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_plus.1.

aligned_plus.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} divides(expt(2, n′), a′)
{-4} divides(expt(2, m′), b′)
{1} n′ > m′
{2} divides(expt(2, n′), a′ + b′)

Rewriting using divides_sum, matching in *, Hiding formulas: -3, 3, Using lemma expt_divides, Simplifying, rewriting, and recording with decision procedures, Using lemma divides_transitive, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_plus.2. Q.E.D.

C.7.5 Alignment.aligned_plus_n

Terse proof for aligned_plus_n.
aligned_plus_n:

{1} ∀ (n: nat, a, b: aligned(n)): aligned?(n)(a + b)

Repeatedly Skolemizing and flattening, Using lemma aligned_plus, Expanding the definition of min, which is trivially true. This completes the proof of aligned_plus_n. Q.E.D.

C.7.6 Alignment.aligned_minus_TCC1

Terse proof for aligned_minus_TCC1.
aligned_minus_TCC1:

{1} ∀ (m, n: nat, a: aligned(n), b: aligned(m)): a ≥ b ⊃ a − b ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of aligned_minus_TCC1. Q.E.D.

C.7.7 Alignment.aligned_minus

Terse proof for aligned_minus.

aligned_minus:

{1} ∀ (m, n: nat, a: aligned(n), b: aligned(m)):

a ≥ b ⊃ aligned?(min(n, m))(a − b)

Repeatedly Skolemizing and flattening, Expanding the definition of min, Expanding the definition of aligned?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

aligned_minus.1:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} divides(expt(2, n′), a′)
{-4} divides(expt(2, m′), b′)
{-5} a′ ≥ b′
{-6} n′ > m′
{1} divides(expt(2, m′), a′ − b′)

Rewriting using divides_diff, matching in *, Hiding formulas: -4, 2, Using lemma expt_divides, Simplifying, rewriting, and recording with decision procedures, Using lemma divides_transitive, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_minus.1.

aligned_minus.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} divides(expt(2, n′), a′)
{-4} divides(expt(2, m′), b′)
{-5} a′ ≥ b′
{1} n′ > m′
{2} divides(expt(2, n′), a′ − b′)

Rewriting using divides_diff, matching in *, Hiding formulas: -3, 3, Using lemma expt_divides, Simplifying, rewriting, and recording with decision procedures, Using lemma divides_transitive, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_minus.2. Q.E.D.

C.7.8 Alignment.aligned_mult_expt_2

Terse proof for aligned_mult_expt_2.
aligned_mult_expt_2:

{1} ∀ (m, n: nat, a: aligned(n)): aligned?(n + m)(a × expt(2, m))

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Rewriting using expt_plus_aux, matching in *, Using lemma divides_prod_elim1, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_mult_expt_2. Q.E.D.

C.7.9 Alignment.aligned_rem

Terse proof for aligned_rem.

aligned_rem:

{1} ∀ (m, n, i: nat): aligned?(n)(m) ⊃ aligned?(n)(rem(expt(2, i))(m))

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Applying rem_def2 Instantiating the top quantifier in -1 with the terms: expt(2, n′), rem(expt(2, i′))(m′), 0, we get 2 subgoals:

aligned_rem.1:

{-1} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0 ≡

divides(expt(2, n′), rem(expt(2, i′))(m′) − 0)

{-2} m′ ≥ 0
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} divides(expt(2, n′), m′)
{1} divides(expt(2, n′), rem(expt(2, i′))(m′))

Simplifying, rewriting, and recording with decision procedures, Hiding formulas: 2, Case splitting on i!1 <= n!1, we get 2 subgoals:

aligned_rem.1.1:

{-1} i′ ≤ n′
{-2} m′ ≥ 0
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} divides(expt(2, n′), m′)
{1} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0

Rewriting using rem_mod, matching in *, we get 2 subgoals:

aligned_rem.1.1.1:

{-1} i′ ≤ n′
{-2} m′ ≥ 0
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} divides(expt(2, n′), m′)
{1} rem(expt(2, i′))(m′) = 0

Using lemma rem_def2, Simplifying, rewriting, and recording with decision procedures, Forward chaining on divides_expt_gt, This completes the proof of aligned_rem.1.1.1.

aligned_rem.1.1.2:

{-1} i′ ≤ n′
{-2} m′ ≥ 0
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} divides(expt(2, n′), m′)
{1} rem(expt(2, i′))(m′) < expt(2, n′)
{2} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0

Using lemma both_sides_expt_gt1_le, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_rem.1.1.2.

aligned_rem.1.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} divides(expt(2, n′), m′)
{1} i′ ≤ n′
{2} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0

Rewriting using rem_rem, matching in *, we get 2 subgoals:

aligned_rem.1.2.1:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} divides(expt(2, n′), m′)
{1} i′ ≤ n′
{2} rem(expt(2, n′))(m′) = 0

Rewriting using rem_def2, matching in *, This completes the proof of aligned_rem.1.2.1.

aligned_rem.1.2.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} divides(expt(2, n′), m′)
{1} divides(expt(2, n′), expt(2, i′))
{2} i′ ≤ n′
{3} rem(expt(2, n′))(rem(expt(2, i′))(m′)) = 0

Rewriting using expt_divides, matching in *, This completes the proof of aligned_rem.1.2.2.

aligned_rem.2:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} divides(expt(2, n′), m′)
{1} 0 < expt(2, n′)
{2} divides(expt(2, n′), rem(expt(2, i′))(m′))

Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_rem.2. Q.E.D.

C.7.10 Alignment.aligned_add_below

Terse proof for aligned_add_below.
aligned_add_below:

{1} ∀ (n, m, i, k: nat):

i ≤ k ∧ n < expt(2, k) ∧ aligned?(i)(n) ∧ m < expt(2, i) ⊃

n + m < expt(2, k)

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Expanding the definition of divides, Repeatedly Skolemizing and flattening, Replacing using formula -8, Applying bit_split_less Instantiating the top quantifier in -1 with the terms: x′, m′, k′ − i′, i′, we get 3 subgoals:

aligned_add_below.1:

{-1} m′ < expt(2, i′) ⊃
(x′ × expt(2, i′) + m′ < expt(2, i′ + k′ − i′) ≡
x′ < expt(2, k′ − i′))
{-2} integer_pred(x′)
{-3} expt(2, i′) × x′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} k′ ≥ 0
{-7} i′ ≤ k′
{-8} expt(2, i′) × x′ < expt(2, k′)
{-9} n′ = expt(2, i′) × x′
{-10} m′ < expt(2, i′)
{1} expt(2, i′) × x′ + m′ < expt(2, k′)

Simplifying, rewriting, and recording with decision procedures, Applying both_sides_times_pos_lt2 Instantiating the top quantifier in -1 with the terms: expt(2, i′), x′, expt(2, k′ − i′), Simplifying, rewriting, and recording with decision procedures, Rewriting using expt_plus, matching in *, This completes the proof of aligned_add_below.1.

C.8 Proofs for Allocation_Info (allocators.pvs)

aligned_add_below.2:

{-1} integer_pred(x′)
{-2} expt(2, i′) × x′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ ≥ 0
{-6} i′ ≤ k′
{-7} expt(2, i′) × x′ < expt(2, k′)
{-8} n′ = expt(2, i′) × x′
{-9} m′ < expt(2, i′)
{1} k′ − i′ ≥ 0
{2} expt(2, i′) × x′ + m′ < expt(2, k′)

Applying both_sides_expt_gt1_le Instantiating the top quantifier in -1 with the terms: 2, i′, k′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_add_below.2.

aligned_add_below.3:

{-1} integer_pred(x′)
{-2} expt(2, i′) × x′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ ≥ 0
{-6} i′ ≤ k′
{-7} expt(2, i′) × x′ < expt(2, k′)
{-8} n′ = expt(2, i′) × x′
{-9} m′ < expt(2, i′)
{1} x′ ≥ 0
{2} expt(2, i′) × x′ + m′ < expt(2, k′)

Applying pos_times_le Instantiating the top quantifier in -1 with the terms: expt(2, i′), x′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_add_below.3. Q.E.D.

C.8 Proofs for Allocation_Info (allocators.pvs)

C.8.1 Allocation_Info.consistent_allocator_state_change

Terse proof for consistent_allocator_state_change.
consistent_allocator_state_change:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), ac: (allocator?(pm)), s_{1}, s_{2}: State): consistent_allocator?(pm)(ac, ai)(s_{1}) ∧ ac`allocated(pm)(s_{1}) = ac`allocated(pm)(s_{2}) ⊃ consistent_allocator?(pm)(ac, ai)(s_{2})

Repeatedly Skolemizing and flattening, Expanding the definition of consistent_allocator?, Applying disjunctive simplification to flatten sequent, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of consistent_allocator_state_change.

Q.E.D.

C.8.2 Allocation_Info.consistent_allocator_read_TCC1

Terse proof for consistent_allocator_read_TCC1.
consistent_allocator_read_TCC1:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), addr: Address): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s)) ∨ Exception?[State, Byte](memory_read(pm`mem)(addr)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *,

This completes the proof of consistent_allocator_read_TCC1.

Q.E.D.

C.8.3 Allocation_Info.consistent_allocator_read

Terse proof for consistent_allocator_read.
consistent_allocator_read:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?(pm)),

addr: Address): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ consistent_allocator?(pm)(ac, ai)(state(memory_read(pm`mem)(addr)(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of consistent_allocator?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_allocated_memory_read, matching in *,

This completes the proof of consistent_allocator_read.

Q.E.D.

C.8.4 Allocation_Info.consistent_allocator_write_TCC1

Terse proof for consistent_allocator_write_TCC1.

consistent_allocator_write_TCC1:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), addr: Address, byte: Byte): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ OK?[State, Unit](memory_write(pm`mem)(addr, byte)(s)) ∨ Exception?[State, Unit](memory_write(pm`mem)(addr, byte)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_write_ok, matching in *,

This completes the proof of consistent_allocator_write_TCC1.

Q.E.D.

C.8.5 Allocation_Info.consistent_allocator_write

Terse proof for consistent_allocator_write.
consistent_allocator_write:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?(pm)), addr: Ad-

dress,

byte: Byte): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ consistent_allocator?(pm)(ac, ai)(state(memory_write(pm`mem)(addr, byte)(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of consistent_allocator?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_allocated_memory_write, matching in *,

This completes the proof of consistent_allocator_write.

Q.E.D.

C.8.6 Allocation_Info.consistent_allocator_alloc_TCC1

Terse proof for consistent_allocator_alloc_TCC1.
consistent_allocator_alloc_TCC1:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), size: posnat): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of consistent_allocator_alloc_TCC1.

Q.E.D.

C.8.7 Allocation_Info.consistent_allocator_alloc

Terse proof for consistent_allocator_alloc.
consistent_allocator_alloc:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?(pm)),

size: posnat): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ consistent_allocator?(pm)(ac, cons((data(ac`alloc(pm)(size)(s)), size), ai)) (state(ac`alloc(pm)(size)(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of consistent_allocator?, Applying propositional simplification, we get 2 subgoals:

consistent_allocator_alloc.1:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} size′ > 0
{-4} pm′`states(s′)
{-5} allocator_info?(ai′)

{-6} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-7} OK?(ac′`alloc(pm′)(size′)(s′))
{1} allocator_info?(cons((data(ac′`alloc(pm′)(size′)(s′)), size′), ai′))
{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Expanding the definition of allocator_info?, Rewriting using blocks_pairwise_disjoint_add, matching in *, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using blocks_disjoint_disjoint, matching in *, Instantiating the top quantifier in -8 with the terms: oaddr′, osize′, Simplifying, rewriting, and recording with decision procedures, Using lemma disjoint_mono, Installing automatic rewrites from: subset_equal Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma allocator_alloc_disjoint, Simplifying, rewriting, and recording with decision procedures, Rewriting using disjoint_symmetric, matching in *,

This completes the proof of consistent_allocator_alloc.1.

C.8 Proofs for Allocation_Info (allocators.pvs)

consistent_allocator_alloc.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} size′ > 0
{-4} pm′`states(s′)
{-5} allocator_info?(ai′)

{-6} ∀ (addr: Address, size: posnat): member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-7} OK?(ac′`alloc(pm′)(size′)(s′))

{1} ∀ (addr: Address, size: posnat):

member((addr, size), cons((data(ac′`alloc(pm′)(size′)(s′)), size′), ai′))

⊃

(address_block(addr, size) ⊆ ac′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′))))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Hiding formulas: -5, Repeatedly Skolemizing and flattening, Expanding the definition of member, Applying propositional simplification, we get 2 subgoals:

consistent_allocator_alloc.2.1:

{-1} addr′ = data(ac′`alloc(pm′)(size′)(s′))
{-2} size′′ = size′
{-3} size′′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} size′ > 0
{-7} pm′`states(s′)

{-8} ∀ (addr: Address, size: posnat): member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-9} OK?(ac′`alloc(pm′)(size′)(s′))
{1} (address_block(addr′, size′′) ⊆ ac′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′))))
{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Rewriting using allocator_allocated_alloc, matching in *, Replacing using formula -1, Replacing using formula -2, Rewriting using union_subset3, matching in *,

This completes the proof of consistent_allocator_alloc.2.1.

consistent_allocator_alloc.2.2:

{-1} member((addr′, size′′), ai′)
{-2} size′′ > 0
{-3} plain_memory?(pm′)
{-4} allocator?(pm′)(ac′)
{-5} size′ > 0
{-6} pm′`states(s′)

{-7} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-8} OK?(ac′`alloc(pm′)(size′)(s′))
{1} (address_block(addr′, size′′) ⊆ ac′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′))))
{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_allocated_alloc, matching in *, Rewriting using subset_bigger_union_left, matching in *,

This completes the proof of consistent_allocator_alloc.2.2.

Q.E.D.

C.8.8 Allocation_Info.consistent_allocator_free_TCC1

Terse proof for consistent_allocator_free_TCC1.
consistent_allocator_free_TCC1:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), addr: Address): OK?(ac`free(pm)(addr)(s)) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ pm`states(s) ⊃ up?[posnat](ac`freed_size(pm)(addr)(s))

Repeatedly Skolemizing and flattening, Rewriting using allocator_free_freed_size, matching in *,

This completes the proof of consistent_allocator_free_TCC1.

Q.E.D.

C.8.9 Allocation_Info.consistent_allocator_free_TCC2

Terse proof for consistent_allocator_free_TCC2.

consistent_allocator_free_TCC2:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?[State](pm)), addr: Address): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ OK?(ac`free(pm)(addr)(s)) ∧ (member((addr, down(ac`freed_size(pm)(addr)(s))), ai) ∨ blocks_pairwise_disjoint(cons((addr, down(ac`freed_size(pm)(addr)(s))), ai))) ⊃ OK?[State, Unit](ac`free(pm)(addr)(s)) ∨ Exception?[State, Unit](ac`free(pm)(addr)(s))

Repeatedly Skolemizing and flattening,

This completes the proof of consistent_allocator_free_TCC2.

Q.E.D.

C.8.10 Allocation_Info.consistent_allocator_free

Terse proof for consistent_allocator_free.
consistent_allocator_free:

{1} ∀ (ai: Allocator_Info, pm: (plain_memory?), s: State, ac: (allocator?(pm)), addr: Address): pm`states(s) ∧ consistent_allocator?(pm)(ac, ai)(s) ∧ OK?(ac`free(pm)(addr)(s)) ∧ (member((addr, down(ac`freed_size(pm)(addr)(s))), ai) ∨ blocks_pairwise_disjoint(cons((addr, down(ac`freed_size(pm)(addr)(s))), ai))) ⊃ consistent_allocator?(pm) (ac, list_remove((addr, down(ac`freed_size(pm)(addr)(s))), ai)) (state(ac`free(pm)(addr)(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of consistent_allocator?, Splitting conjunctions, we get 2 subgoals:

consistent_allocator_free.1:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} pm′`states(s′)

{-4} allocator_info?(ai′) ∧

(∀ (addr: Address, size: posnat): member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′)))

{-5} OK?(ac′`free(pm′)(addr′)(s′))

{-6} (member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′) ∨

blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{1} allocator_info?(list_remove((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′))

Expanding the definition of allocator_info?,

Rewriting using blocks_pairwise_disjoint_remove, matching in *,

This completes the proof of consistent_allocator_free.1.
consistent_allocator_free.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} pm′`states(s′)

{-4} allocator_info?(ai′) ∧

(∀ (addr: Address, size: posnat): member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′)))

{-5} OK?(ac′`free(pm′)(addr′)(s′))

{-6} (member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′) ∨

blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{1} ∀ (addr: Address, size: posnat):

member((addr, size),

list_remove((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(state(ac′‘free(pm′)(addr′)(s′))))

Repeatedly Skolemizing and flattening,

Rewriting using member_list_remove, matching in *,

Splitting conjunctions,

we get 2 subgoals:

consistent_allocator_free.2.1:

{-1} size′ > 0
{-2} plain_memory?(pm′)
{-3} allocator?(pm′)(ac′)
{-4} pm′`states(s′)
{-5} allocator_info?(ai′)

{-6} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-7} OK?(ac′`free(pm′)(addr′)(s′))

{-8} (member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′) ∨

blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{1} true
{2} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(state(ac′‘free(pm′)(addr′)(s′))))

which is trivially true.

This completes the proof of consistent_allocator_free.2.1.
consistent_allocator_free.2.2:

{-1} ¬ (addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))) ∧

member((addr′′, size′), ai′)

{-2} size′ > 0
{-3} plain_memory?(pm′)
{-4} allocator?(pm′)(ac′)
{-5} pm′`states(s′)
{-6} allocator_info?(ai′)

{-7} ∀ (addr: Address, size: posnat):

member((addr, size), ai′) ⊃ (address_block(addr, size) ⊆ ac′‘allocated(pm′)(s′))

{-8} OK?(ac′`free(pm′)(addr′)(s′))

{-9} (member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′) ∨

blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{1} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(state(ac′‘free(pm′)(addr′)(s′))))

Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_allocated_free, matching in *, Rewriting using disjoint_subset_difference, matching in *, Hiding formulas: 3, Splitting conjunctions, we get 2 subgoals:

consistent_allocator_free.2.2.1:

{-1} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)
{-2} member((addr′′, size′), ai′)
{-3} size′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} pm′`states(s′)
{-7} allocator_info?(ai′)
{-8} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-9} OK?(ac′`free(pm′)(addr′)(s′))

{1} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{2} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Expanding the definition of allocator_info?, Expanding the definition of blocks_pairwise_disjoint, Instantiating the top quantifier in -7 with the terms: addr′′, addr′, size′, down(ac′‘freed_size(pm′)(addr′)(s′)), Simplifying, rewriting, and recording with decision procedures, Splitting conjunctions, we get 2 subgoals:

consistent_allocator_free.2.2.1.1:

{-1} blocks_disjoint?(addr′′, size′, addr′, down(ac′`freed_size(pm′)(addr′)(s′)))
{-2} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)
{-3} member((addr′′, size′), ai′)
{-4} size′ > 0
{-5} plain_memory?(pm′)
{-6} allocator?(pm′)(ac′)
{-7} pm′`states(s′)
{-8} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-9} OK?(ac′`free(pm′)(addr′)(s′))

{1} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{2} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Rewriting using blocks_disjoint_disjoint, matching in *,

This completes the proof of consistent_allocator_free.2.2.1.1.
consistent_allocator_free.2.2.1.2:

{-1} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)
{-2} member((addr′′, size′), ai′)
{-3} size′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} pm′`states(s′)
{-7} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-8} OK?(ac′`free(pm′)(addr′)(s′))

{1} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))),

list_remove((addr′′, size′), ai′))

{2} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{3} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Rewriting using member_list_remove, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of consistent_allocator_free.2.2.1.2.
consistent_allocator_free.2.2.2:

{-1} blocks_pairwise_disjoint(cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))),

ai′))

{-2} member((addr′′, size′), ai′)
{-3} size′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} pm′`states(s′)
{-7} allocator_info?(ai′)
{-8} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-9} OK?(ac′`free(pm′)(addr′)(s′))

{1} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{2} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Expanding the definition of blocks_pairwise_disjoint, Instantiating the top quantifier in -1 with the terms: addr′, addr′′, down(ac′‘freed_size(pm′)(addr′)(s′)),

size′, Splitting conjunctions, we get 3 subgoals:

consistent_allocator_free.2.2.2.1:

{-1} blocks_disjoint?(addr′, down(ac′`freed_size(pm′)(addr′)(s′)), addr′′, size′)
{-2} member((addr′′, size′), ai′)
{-3} size′ > 0
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} pm′`states(s′)
{-7} allocator_info?(ai′)
{-8} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-9} OK?(ac′`free(pm′)(addr′)(s′))

{1} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{2} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Rewriting using blocks_disjoint_disjoint, matching in *, Rewriting using disjoint_symmetric, matching in *,

This completes the proof of consistent_allocator_free.2.2.2.1.
consistent_allocator_free.2.2.2.2:

{-1} member((addr′′, size′), ai′)
{-2} size′ > 0
{-3} plain_memory?(pm′)
{-4} allocator?(pm′)(ac′)
{-5} pm′`states(s′)
{-6} allocator_info?(ai′)
{-7} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-8} OK?(ac′`free(pm′)(addr′)(s′))

{1} member((addr′, down(ac′`freed_size(pm′)(addr′)(s′))),

cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′))

{2} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{3} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Expanding the definition of member, which is trivially true.

This completes the proof of consistent_allocator_free.2.2.2.2.
consistent_allocator_free.2.2.2.3:

{-1} member((addr′′, size′), ai′)
{-2} size′ > 0
{-3} plain_memory?(pm′)
{-4} allocator?(pm′)(ac′)
{-5} pm′`states(s′)
{-6} allocator_info?(ai′)
{-7} (address_block(addr′′, size′) ⊆ ac′‘allocated(pm′)(s′))
{-8} OK?(ac′`free(pm′)(addr′)(s′))

{1} member((addr′′, size′),

list_remove((addr′, down(ac′`freed_size(pm′)(addr′)(s′))),

cons((addr′, down(ac′`freed_size(pm′)(addr′)(s′))), ai′)))

{2} disjoint?(address_block(addr′′, size′),

address_block(addr′, down(ac′`freed_size(pm′)(addr′)(s′))))

{3} addr′′ = addr′ ∧ size′ = down(ac′`freed_size(pm′)(addr′)(s′))

Rewriting using member_list_remove, matching in *, Expanding the definition of member, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of consistent_allocator_free.2.2.2.3.

Q.E.D.

C.9 Proofs for Allocation_Table (allocators.pvs)

C.9.1 Allocation_Table.allocation_finite_tree

Terse proof for allocation_finite_tree.
allocation_finite_tree:

{1} ∀ (pm: (plain_memory?), at: Allocation_Table(pm)): finite_tree?(at`hierarchy)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of allocation_finite_tree. Q.E.D.

C.9.2 Allocation_Table.allocation_subnodes_allocated_and_free

Terse proof for allocation_subnodes_allocated_and_free.
allocation_subnodes_allocated_and_free:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2: (at`hierarchy`nodes)): allocation_ok?(pm)(at, s) ∧ at`hierarchy`edges(ac1, ac2) ⊃ (ac2‘memory_pool(pm)(s) ⊆ ac1‘allocated(pm)(s)) ∧ block_is_free(ac2`memory_pool(pm)(s), at`info(ac1))

C.9 Proofs for Allocation_Table (allocators.pvs)

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_subnodes_allocated_and_free.

Q.E.D.

C.9.3 Allocation_Table.allocation_subnodes_disjoint

Terse proof for allocation_subnodes_disjoint.
allocation_subnodes_disjoint:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2, ac3: (at`hierarchy`nodes)): allocation_ok?(pm)(at, s) ∧ at`hierarchy`edges(ac1, ac2) ∧ at`hierarchy`edges(ac1, ac3) ⊃ ac2 = ac3 ∨ disjoint?(ac2`memory_pool(pm)(s), ac3`memory_pool(pm)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -9 with the terms: ac1′, ac2′, ac3′, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_subnodes_disjoint.

Q.E.D.

C.9.4 Allocation_Table.allocation_roots_disjoint

Terse proof for allocation_roots_disjoint.
allocation_roots_disjoint:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2: (roots(at`hierarchy))): allocation_ok?(pm)(at, s) ⊃ ac1 = ac2 ∨ disjoint?(ac1`memory_pool(pm)(s), ac2`memory_pool(pm)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_roots_disjoint.

Q.E.D.

C.9.5 Allocation_Table.allocation_private_memory_disjoint

Terse proof for allocation_private_memory_disjoint.
allocation_private_memory_disjoint:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2: (at`hierarchy`nodes)): allocation_ok?(pm)(at, s) ⊃ ac1 = ac2 ∨ disjoint?(ac1`private_mem(pm), ac2`private_mem(pm))

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_private_memory_disjoint.

Q.E.D.

C.9.6 Allocation_Table.allocation_consistent_allocator

Terse proof for allocation_consistent_allocator.
allocation_consistent_allocator:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes)): allocation_ok?(pm)(at, s) ⊃ consistent_allocator?(pm)(ac, at`info(ac))(s)

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_ok?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables,

This completes the proof of allocation_consistent_allocator.

Q.E.D.

C.9.7 Allocation_Table.allocation_allocated_allocation_point

Terse proof for allocation_allocated_allocation_point.
allocation_allocated_allocation_point:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes),

addr: Address, size: posnat): allocation_ok?(pm)(at, s) ∧ member((addr, size), at`info(ac)) ⊃ (address_block(addr, size) ⊆ ac‘allocated(pm)(s))

Repeatedly Skolemizing and flattening, Using lemma allocation_consistent_allocator, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of consistent_allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_allocated_allocation_point.

Q.E.D.

C.9.8 Allocation_Table.allocation_allocation_point_in_memory_pool

Terse proof for allocation_allocation_point_in_memory_pool.
allocation_allocation_point_in_memory_pool:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes),

addr: Address, size: posnat): pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ member((addr, size), at`info(ac)) ⊃ (address_block(addr, size) ⊆ ac‘memory_pool(pm)(s))

Repeatedly Skolemizing and flattening, Using lemma allocation_allocated_allocation_point, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_subset_allocated_memory_pool, Simplifying, rewriting, and recording with decision procedures, Forward chaining on subset_transitive,

This completes the proof of allocation_allocation_point_in_memory_pool.

Q.E.D.

C.9.9 Allocation_Table.allocators_different_in_hierachy

Terse proof for allocators_different_in_hierachy.
allocators_different_in_hierachy:

{1} ∀ (pm: (plain_memory?), at: Allocation_Table(pm), ac1, ac2: (at`hierarchy`nodes)): at`hierarchy`edges(ac1, ac2) ⊃ ¬ ac1 = ac2

Repeatedly Skolemizing and flattening, Using lemma different_nodes_on_edge[(allocator?(pm′))], Simplifying, rewriting, and recording with decision procedures, Adding type constraints for at!1‘hierarchy, Expanding the definition of finite_tree?, Expanding the definition of tree?, which is trivially true.

This completes the proof of allocators_different_in_hierachy.

Q.E.D.

C.9.10 Allocation_Table.uppath_memory_pool

Terse proof for uppath_memory_pool.
uppath_memory_pool:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), p: (path?(at`hierarchy))): allocation_ok?(pm)(at, s) ∧ pm`states(s) ⊃ (path_end(p)‘memory_pool(pm)(s) ⊆ path_start(p)‘memory_pool(pm)(s))

For the top quantifier in 1, we introduce Skolem constants: (pm′ s′ at′ ), Inducting on p on formula 1 using induction scheme path_list_induction[(allocator?(pm′))], we get 3 subgoals:

uppath_memory_pool.1:

{-1} allocation_ok?(pm′)(at′, s′)
{-2} pm′`states(s′)
{1} path?(at′`hierarchy)(p′)
{2} (path_end(p′)‘memory_pool(pm′)(s′) ⊆ path_start(p′)‘memory_pool(pm′)(s′))

Simplifying, rewriting, and recording with decision procedures, This completes the proof of uppath_memory_pool.1.

uppath_memory_pool.2:

{1} ∀ (t: ((allocator?(pm′)))):

path?(at′`hierarchy)(cons(t, null)) ⊃ allocation_ok?(pm′)(at′, s′) ∧ pm′`states(s′) ⊃ (path_end(cons(t, null))‘memory_pool(pm′)(s′) ⊆ path_start(cons(t, null))‘memory_pool(pm′)(s′))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_start path_end length nth subset_reflexive Simplifying, rewriting, and recording with decision procedures, This completes the proof of uppath_memory_pool.2.

uppath_memory_pool.3:

{1} ∀ (t: ((allocator?(pm′))), tail: (path_list?)):

(path?(at′`hierarchy)(tail) ⊃ allocation_ok?(pm′)(at′, s′) ∧ pm′`states(s′) ⊃ (path_end(tail)‘memory_pool(pm′)(s′) ⊆ path_start(tail)‘memory_pool(pm′)(s′)))

⊃

path?(at′`hierarchy)(cons(t, tail)) ⊃

allocation_ok?(pm′)(at′, s′) ∧ pm′`states(s′) ⊃

(path_end(cons(t, tail))‘memory_pool(pm′)(s′) ⊆ path_start(cons(t, tail))‘memory_pool(pm′)(s′))

Repeatedly Skolemizing and flattening, Using lemma path_cdr, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: path_start nth length path_list? path_end Simplifying, rewriting, and recording with decision procedures, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -7 with the terms: 0, Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_subnodes_allocated_and_free, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Hiding formulas: -2, Forward chaining on subset_transitive, Hiding formulas: -2, -7, Using lemma allocator_subset_allocated_memory_pool, Simplifying, rewriting, and recording with decision procedures, Forward chaining on subset_transitive, This completes the proof of uppath_memory_pool.3. Q.E.D.

C.9.11 Allocation_Table.uppath_memory_pool_allocated_and_free_TCC1

Terse proof for uppath_memory_pool_allocated_and_free_TCC1.

uppath_memory_pool_allocated_and_free_TCC1:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), p: (path?[((allocator?(pm)))](at`hierarchy))):

(path_end(p)‘memory_pool(pm)(s) ⊆ path_start(p)‘allocated(pm)(s)) ∧ pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ length(p) ≥ 2 ⊃ at`hierarchy`nodes(path_start[((allocator?(pm)))](p))

Repeatedly Skolemizing and flattening, Rewriting using nodes_path_start, matching in *,

This completes the proof of uppath_memory_pool_allocated_and_free_TCC1.

Q.E.D.

C.9.12 Allocation_Table.uppath_memory_pool_allocated_and_free

Terse proof for uppath_memory_pool_allocated_and_free.
uppath_memory_pool_allocated_and_free:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), p: (path?(at`hierarchy))): pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ length(p) ≥ 2 ⊃ (path_end(p)‘memory_pool(pm)(s) ⊆ path_start(p)‘allocated(pm)(s)) ∧ block_is_free(path_end(p)`memory_pool(pm)(s), at`info(path_start(p)))

Repeatedly Skolemizing and flattening, Using lemma path_cdr, Installing automatic rewrites from: path_list? length_cdr path_end path_start nth subset_reflexive Simplifying, rewriting, and recording with decision procedures, Using lemma uppath_memory_pool, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -7 with the terms: 0, Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_subnodes_allocated_and_free, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Forward chaining on subset_transitive, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -1, -2, Expanding the definition of block_is_free, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Using lemma disjoint_mono, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of uppath_memory_pool_allocated_and_free.

Q.E.D.

C.9.13 Allocation_Table.allocation_memory_pools

Terse proof for allocation_memory_pools.

allocation_memory_pools:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm),

ac1, ac2: (at`hierarchy`nodes)): pm`states(s) ∧ allocation_ok?(pm)(at, s) ⊃ ac1 = ac2 ∨ disjoint?(ac1`memory_pool(pm)(s), ac2`memory_pool(pm)(s)) ∨ ((ac1‘memory_pool(pm)(s) ⊆ ac2‘allocated(pm)(s)) ∧

block_is_free(ac1`memory_pool(pm)(s), at`info(ac2))) ∨ ((ac2‘memory_pool(pm)(s) ⊆ ac1‘allocated(pm)(s)) ∧

block_is_free(ac2`memory_pool(pm)(s), at`info(ac1)))

Repeatedly Skolemizing and flattening,

Using lemma symmetric_node_pair_distinction[(allocator?(pm′))],

Splitting conjunctions,

we get 7 subgoals:

allocation_memory_pools.1:

{-1} ∀ (n1_1, n2_1: (at′`hierarchy`nodes)):

n1_1 = n2_1 ∨ disjoint?(n1_1`memory_pool(pm′)(s′), n2_1`memory_pool(pm′)(s′)) ∨ ((n1_1‘memory_pool(pm′)(s′) ⊆ n2_1‘allocated(pm′)(s′)) ∧

block_is_free(n1_1`memory_pool(pm′)(s′), at′`info(n2_1))) ∨ ((n2_1‘memory_pool(pm′)(s′) ⊆ n1_1‘allocated(pm′)(s′)) ∧

block_is_free(n2_1`memory_pool(pm′)(s′), at′`info(n1_1)))

{-2} plain_memory?(pm′)
{-3} allocator?(pm′)(ac1′)
{-4} at′`hierarchy`nodes(ac1′)
{-5} allocator?(pm′)(ac2′)
{-6} at′`hierarchy`nodes(ac2′)
{-7} pm′`states(s′)
{-8} allocation_ok?(pm′)(at′, s′)
{1} ac1′ = ac2′
{2} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{3} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{4} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of allocation_memory_pools.1.

allocation_memory_pools.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)
{1} true
{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

which is trivially true.

This completes the proof of allocation_memory_pools.2.
allocation_memory_pools.3:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)

{1} symmetric?(λ (n_{1}, n_{2}: (at′`hierarchy`nodes)):

n_{1} = n_{2} ∨ disjoint?(n_{1}`memory_pool(pm′)(s′), n_{2}`memory_pool(pm′)(s′)) ∨ ((n_{1}‘memory_pool(pm′)(s′) ⊆ n_{2}‘allocated(pm′)(s′)) ∧

block_is_free(n_{1}`memory_pool(pm′)(s′), at′`info(n_{2}))) ∨ ((n_{2}‘memory_pool(pm′)(s′) ⊆ n_{1}‘allocated(pm′)(s′)) ∧

block_is_free(n_{2}`memory_pool(pm′)(s′), at′`info(n_{1}))))

{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Keeping 1 and hiding *,

Expanding the definition of symmetric?,

Repeatedly Skolemizing and flattening,

Using lemma disjoint_symmetric,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of allocation_memory_pools.3.

allocation_memory_pools.4:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)
{1} ∀ (n: (at′`hierarchy`nodes)): true
{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_memory_pools.4.
allocation_memory_pools.5:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)

{1} ∀ (n1_1, n2_1: (at′`hierarchy`nodes), p: (path?(at′`hierarchy))): ¬ n1_1 = n2_1 ∧ path_start(p) = n2_1 ∧ path_end(p) = n1_1 ∧ length(p) ≥ 2 ⊃ n1_1 = n2_1 ∨ disjoint?(n1_1`memory_pool(pm′)(s′), n2_1`memory_pool(pm′)(s′)) ∨ ((n1_1‘memory_pool(pm′)(s′) ⊆ n2_1‘allocated(pm′)(s′)) ∧

block_is_free(n1_1`memory_pool(pm′)(s′), at′`info(n2_1))) ∨ ((n2_1‘memory_pool(pm′)(s′) ⊆ n1_1‘allocated(pm′)(s′)) ∧

block_is_free(n2_1`memory_pool(pm′)(s′), at′`info(n1_1)))

{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Keeping (-6 -7 1) and hiding *,

Repeatedly Skolemizing and flattening,

Using lemma uppath_memory_pool_allocated_and_free,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of allocation_memory_pools.5.

allocation_memory_pools.6:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)

{1} ∀ (n1_1, n2_1: (at′`hierarchy`nodes), p_{1}, p_{2}: (path?(at′`hierarchy))): ¬ n1_1 = n2_1 ∧ root_path(at′`hierarchy, n1_1)(p_{1}) ∧ root_path(at′`hierarchy, n2_1)(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2}) ⊃ n1_1 = n2_1 ∨ disjoint?(n1_1`memory_pool(pm′)(s′), n2_1`memory_pool(pm′)(s′)) ∨ ((n1_1‘memory_pool(pm′)(s′) ⊆ n2_1‘allocated(pm′)(s′)) ∧

block_is_free(n1_1`memory_pool(pm′)(s′), at′`info(n2_1))) ∨ ((n2_1‘memory_pool(pm′)(s′) ⊆ n1_1‘allocated(pm′)(s′)) ∧

block_is_free(n2_1`memory_pool(pm′)(s′), at′`info(n1_1)))

{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Keeping (-6 -7 1) and hiding *,

Repeatedly Skolemizing and flattening,

Hiding formulas: 5, 6,

Using lemma uppath_memory_pool,

Using lemma uppath_memory_pool,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of root_path,

Applying disjunctive simplification to flatten sequent,

Using lemma allocation_roots_disjoint,

Simplifying, rewriting, and recording with decision procedures,

Forward chaining on disjoint_mono,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_memory_pools.6.

allocation_memory_pools.7:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} pm′`states(s′)
{-7} allocation_ok?(pm′)(at′, s′)

{1} ∀ (n1_1, n2_1, n_{3}: (at′`hierarchy`nodes), p_{1}, p_{2}: (path?(at′`hierarchy))): ¬ n1_1 = n2_1 ∧ ¬ n1_1 = n_{3} ∧ ¬ n2_1 = n_{3} ∧ at′`hierarchy`edges(n_{3}, path_start(p_{1})) ∧ at′`hierarchy`edges(n_{3}, path_start(p_{2})) ∧ path_end(p_{1}) = n1_1 ∧ path_end(p_{2}) = n2_1 ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃

n1_1 = n2_1 ∨

disjoint?(n1_1`memory_pool(pm′)(s′), n2_1`memory_pool(pm′)(s′)) ∨ ((n1_1‘memory_pool(pm′)(s′) ⊆ n2_1‘allocated(pm′)(s′)) ∧

block_is_free(n1_1`memory_pool(pm′)(s′), at′`info(n2_1))) ∨ ((n2_1‘memory_pool(pm′)(s′) ⊆ n1_1‘allocated(pm′)(s′)) ∧

block_is_free(n2_1`memory_pool(pm′)(s′), at′`info(n1_1)))

{2} ac1′ = ac2′
{3} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))

{4} ((ac1′‘memory_pool(pm′)(s′) ⊆ ac2′‘allocated(pm′)(s′)) ∧

block_is_free(ac1′`memory_pool(pm′)(s′), at′`info(ac2′)))

{5} ((ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′)) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′)))

Keeping (-6 -7 1) and hiding *, Repeatedly Skolemizing and flattening, Hiding formulas: 7, 8, Using lemma uppath_memory_pool, Using lemma uppath_memory_pool, Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_subnodes_disjoint, Simplifying, rewriting, and recording with decision procedures, Forward chaining on disjoint_mono, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_memory_pools.7.

Q.E.D.

C.9.14 Allocation_Table.allocation_info_TCC1

Terse proof for allocation_info_TCC1.
allocation_info_TCC1:

{1} ∀ (pm: (plain_memory?[State]), at: Allocation_Table(pm)):

is_finite[(at`hierarchy`nodes)]

(restrict[((allocator?(pm))), (at`hierarchy`nodes), boolean] (at`hierarchy`nodes))

Repeatedly Skolemizing and flattening, Adding type constraints for at!1‘hierarchy, Expanding the definition of finite_tree?, Applying disjunctive simplification to flatten sequent, Expanding the definition of finite?, Hiding formulas: -2, -3, Expanding the definition of restrict, Expanding the definition of is_finite, which is trivially true. This completes the proof of allocation_info_TCC1. Q.E.D.

C.9.15 Allocation_Table.member_allocation_info

Terse proof for member_allocation_info.
member_allocation_info:

{1} ∀ (pm: (plain_memory?), at: Allocation_Table(pm), addr: Address, size: posnat): member((addr, size), allocation_info(pm)(at)) ⊃ (∃ (ac: (at`hierarchy`nodes)): member((addr, size), at`info(ac)))

Repeatedly Skolemizing and flattening, Expanding the definition of allocation_info, Using lemma member_flatten[[Address, posnat]], Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -4, Repeatedly Skolemizing and flattening, Using lemma member_map, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -2, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of member_allocation_info. Q.E.D.

C.9.16 Allocation_Table.allocation_consistent

Terse proof for allocation_consistent.
allocation_consistent:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm)): pm`states(s) ∧ allocation_ok?(pm)(at, s) ⊃ allocator_info?(allocation_info(pm)(at))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator_info?, Expanding the definition of blocks_pairwise_disjoint, Repeatedly Skolemizing and flattening, Rewriting using member_list_remove, matching in *, Splitting conjunctions, we get 2 subgoals:

allocation_consistent.1:

{-1} size′ > 0
{-2} size′′ > 0
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} allocation_ok?(pm′)(at′, s′)
{-6} member((addr′, size′), allocation_info(pm′)(at′))
{1} true
{2} blocks_disjoint?(addr′, size′, addr′′, size′′)

which is trivially true. This completes the proof of allocation_consistent.1.

allocation_consistent.2:

{-1} ¬ (addr′′ = addr′ ∧ size′′ = size′) ∧

member((addr′′, size′′), allocation_info(pm′)(at′))

{-2} size′ > 0
{-3} size′′ > 0
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} allocation_ok?(pm′)(at′, s′)
{-7} member((addr′, size′), allocation_info(pm′)(at′))
{1} blocks_disjoint?(addr′, size′, addr′′, size′′)

Applying disjunctive simplification to flatten sequent, Forward chaining on member_allocation_info, Forward chaining on member_allocation_info, Hiding formulas: -3, -9, Repeatedly Skolemizing and flattening, Using lemma allocation_memory_pools, Simplifying, rewriting, and recording with decision procedures, Splitting conjunctions, we get 4 subgoals:

allocation_consistent.2.1:

{-1} ac′ = ac′′
{-2} allocator?(pm′)(ac′′)
{-3} at′`hierarchy`nodes(ac′′)
{-4} allocator?(pm′)(ac′)
{-5} at′`hierarchy`nodes(ac′)
{-6} member((addr′, size′), at′`info(ac′))
{-7} member((addr′′, size′′), at′`info(ac′′))
{-8} size′ > 0
{-9} size′′ > 0
{-10} plain_memory?(pm′)
{-11} pm′`states(s′)
{-12} allocation_ok?(pm′)(at′, s′)
{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′, size′, addr′′, size′′)

Using lemma allocation_consistent_allocator, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of consistent_allocator?, Applying disjunctive simplification to flatten sequent, Hiding formulas: -2, Expanding the definition of allocator_info?, Expanding the definition of blocks_pairwise_disjoint, Instantiating quantified variables, Rewriting using member_list_remove, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of allocation_consistent.2.1.
allocation_consistent.2.2:

{-1} disjoint?(ac′`memory_pool(pm′)(s′), ac′′`memory_pool(pm′)(s′))
{-2} allocator?(pm′)(ac′′)
{-3} at′`hierarchy`nodes(ac′′)
{-4} allocator?(pm′)(ac′)
{-5} at′`hierarchy`nodes(ac′)
{-6} member((addr′, size′), at′`info(ac′))
{-7} member((addr′′, size′′), at′`info(ac′′))
{-8} size′ > 0
{-9} size′′ > 0
{-10} plain_memory?(pm′)
{-11} pm′`states(s′)
{-12} allocation_ok?(pm′)(at′, s′)
{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′, size′, addr′′, size′′)

Rewriting using blocks_disjoint_disjoint, matching in *, Using lemma allocation_allocation_point_in_memory_pool, Using lemma allocation_allocation_point_in_memory_pool, Simplifying, rewriting, and recording with decision procedures, Forward chaining on disjoint_mono,

This completes the proof of allocation_consistent.2.2.
allocation_consistent.2.3:

{-1} ((ac′‘memory_pool(pm′)(s′) ⊆ ac′′‘allocated(pm′)(s′)) ∧

block_is_free(ac′`memory_pool(pm′)(s′), at′`info(ac′′)))

{-2} allocator?(pm′)(ac′′)
{-3} at′`hierarchy`nodes(ac′′)
{-4} allocator?(pm′)(ac′)
{-5} at′`hierarchy`nodes(ac′)
{-6} member((addr′, size′), at′`info(ac′))
{-7} member((addr′′, size′′), at′`info(ac′′))
{-8} size′ > 0
{-9} size′′ > 0
{-10} plain_memory?(pm′)
{-11} pm′`states(s′)
{-12} allocation_ok?(pm′)(at′, s′)
{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′, size′, addr′′, size′′)

Applying disjunctive simplification to flatten sequent, Rewriting using blocks_disjoint_disjoint, matching in *, Using lemma allocation_allocation_point_in_memory_pool, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of block_is_free, Instantiating the top quantifier in -3 with the terms: addr′′, size′′, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -2, Using lemma disjoint_mono, Installing automatic rewrites from: subset_reflexive Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_consistent.2.3.
allocation_consistent.2.4:

{-1} ((ac′′‘memory_pool(pm′)(s′) ⊆ ac′‘allocated(pm′)(s′)) ∧

block_is_free(ac′′`memory_pool(pm′)(s′), at′`info(ac′)))

{-2} allocator?(pm′)(ac′′)
{-3} at′`hierarchy`nodes(ac′′)
{-4} allocator?(pm′)(ac′)
{-5} at′`hierarchy`nodes(ac′)
{-6} member((addr′, size′), at′`info(ac′))
{-7} member((addr′′, size′′), at′`info(ac′′))
{-8} size′ > 0
{-9} size′′ > 0
{-10} plain_memory?(pm′)
{-11} pm′`states(s′)
{-12} allocation_ok?(pm′)(at′, s′)
{1} addr′′ = addr′ ∧ size′′ = size′
{2} blocks_disjoint?(addr′, size′, addr′′, size′′)

Applying disjunctive simplification to flatten sequent, Hiding formulas: -1, Rewriting using blocks_disjoint_disjoint, matching in *, Using lemma allocation_allocation_point_in_memory_pool, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of block_is_free, Instantiating the top quantifier in -2 with the terms: addr′, size′, Simplifying, rewriting, and recording with decision procedures, Using lemma disjoint_mono, Installing automatic rewrites from: subset_reflexive Simplifying, rewriting, and recording with decision procedures, Rewriting using disjoint_symmetric, matching in *,

This completes the proof of allocation_consistent.2.4.

Q.E.D.

C.9.17 Allocation_Table.allocation_alloc_other_private_memory_TCC1

Terse proof for allocation_alloc_other_private_memory_TCC1.

allocation_alloc_other_private_memory_TCC1:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac1, ac2: (at`hierarchy`nodes), size: posnat):

pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ OK?(ac1`alloc(pm)(size)(s)) ∧ ¬ data(ac1`alloc(pm)(size)(s)) = null_address ∧ ¬ ac1 = ac2

⊃

OK?[State, Address](ac1`alloc(pm)(size)(s)) ∨

Exception?[State, Address](ac1`alloc(pm)(size)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of allocation_alloc_other_private_memory_TCC1.

Q.E.D.

C.9.18 Allocation_Table.allocation_alloc_other_private_memory_TCC2

Terse proof for allocation_alloc_other_private_memory_TCC2.
allocation_alloc_other_private_memory_TCC2:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac1, ac2: (at`hierarchy`nodes), size: posnat):

pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ OK?(ac1`alloc(pm)(size)(s)) ∧ ¬ data(ac1`alloc(pm)(size)(s)) = null_address ∧ ¬ ac1 = ac2

⊃ pm`states(state[State, Address](ac1`alloc(pm)(size)(s)))

Repeatedly Skolemizing and flattening, Rewriting using allocator_next_state_alloc, matching in *, Expanding the definition of has_next_state, which is trivially true.

This completes the proof of allocation_alloc_other_private_memory_TCC2.

Q.E.D.

C.9.19 Allocation_Table.allocation_alloc_other_private_memory

Terse proof for allocation_alloc_other_private_memory.
allocation_alloc_other_private_memory:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac1, ac2: (at`hierarchy`nodes), size: posnat):

pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ OK?(ac1`alloc(pm)(size)(s)) ∧ ¬ data(ac1`alloc(pm)(size)(s)) = null_address ∧ ¬ ac1 = ac2

⊃ stays_unchanged(pm)(s, state(ac1`alloc(pm)(size)(s)), ac2`private_mem(pm))

Repeatedly Skolemizing and flattening, Using lemma allocator_only_changes_alloc, Simplifying, rewriting, and recording with decision procedures, Using lemma stays_unchanged_only_changes_disjoint, Installing automatic rewrites from: allocator_next_state_alloc allocator_subset_private_memory_plain_memory

has_next_state Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_private_memory_disjoint, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocation_alloc_other_private_memory.

Q.E.D.

C.9.20 Allocation_Table.allocation_alloc_TCC1

Terse proof for allocation_alloc_TCC1.
allocation_alloc_TCC1:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes),

size: posnat): pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of allocation_alloc_TCC1. Q.E.D.

C.9.21 Allocation_Table.allocation_alloc

Terse proof for allocation_alloc.
allocation_alloc:

{1} ∀ (pm: (plain_memory?), s: State, at: Allocation_Table(pm), ac: (at`hierarchy`nodes),

size: posnat): pm`states(s) ∧ allocation_ok?(pm)(at, s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ allocation_ok?(pm)

(at

with [`info(ac)

:= cons((data(ac`alloc(pm)(size)(s)), size),

at`info(ac))],

state(ac`alloc(pm)(size)(s)))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: allocator_next_state_alloc has_next_state subset_bigger_union_left

allocator_memory_pool_alloc allocator_allocated_alloc subset_equal Expanding the definition of allocation_ok?, Applying propositional simplification, we get 5 subgoals:

allocation_alloc.1:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} at′`hierarchy`nodes(ac′)
{-4} size′ > 0
{-5} pm′`states(s′)
{-6} allocation_ok?(pm′)(at′, s′)
{-7} OK?(ac′`alloc(pm′)(size′)(s′))

{1} ∀ (ac1, ac2: (at′`hierarchy`nodes)):

at′`hierarchy`edges(ac1, ac2) ⊃ (ac2‘memory_pool(pm′)(state(ac′‘alloc(pm′)(size′)(s′))) ⊆ ac1‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′)))) ∧ block_is_free(ac2`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

at′`info

with [(ac′)

:= cons((data(ac′`alloc(pm′)(size′)(s′)), size′),

at′`info(ac′))]

(ac1))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Repeatedly Skolemizing and flattening, Using lemma allocation_subnodes_allocated_and_free, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Case splitting on ac!1 = ac2!1, we get 2 subgoals:

allocation_alloc.1.1:

{-1} ac′ = ac2′
{-2} (ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′))
{-3} block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′))
{-4} allocator?(pm′)(ac1′)
{-5} at′`hierarchy`nodes(ac1′)
{-6} allocator?(pm′)(ac2′)
{-7} at′`hierarchy`nodes(ac2′)
{-8} at′`hierarchy`edges(ac1′, ac2′)
{-9} plain_memory?(pm′)
{-10} allocator?(pm′)(ac′)
{-11} at′`hierarchy`nodes(ac′)
{-12} size′ > 0
{-13} pm′`states(s′)
{-14} allocation_ok?(pm′)(at′, s′)
{-15} OK?(ac′`alloc(pm′)(size′)(s′))

{1} (ac2′‘memory_pool(pm′)(state(ac′‘alloc(pm′)(size′)(s′))) ⊆ ac1′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′)))) ∧ block_is_free(ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

at′`info

with [(ac′)

:= cons((data(ac′`alloc(pm′)(size′)(s′)), size′),

at′`info(ac′))]

(ac1′))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Using lemma allocators_different_in_hierachy, Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_allocated, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.1.1.

allocation_alloc.1.2:

{-1} (ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′))
{-2} block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′))
{-3} allocator?(pm′)(ac1′)
{-4} at′`hierarchy`nodes(ac1′)
{-5} allocator?(pm′)(ac2′)
{-6} at′`hierarchy`nodes(ac2′)
{-7} at′`hierarchy`edges(ac1′, ac2′)
{-8} plain_memory?(pm′)
{-9} allocator?(pm′)(ac′)
{-10} at′`hierarchy`nodes(ac′)
{-11} size′ > 0
{-12} pm′`states(s′)
{-13} allocation_ok?(pm′)(at′, s′)
{-14} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac′ = ac2′

{2} (ac2′‘memory_pool(pm′)(state(ac′‘alloc(pm′)(size′)(s′))) ⊆ ac1′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′)))) ∧ block_is_free(ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

at′`info

with [(ac′)

:= cons((data(ac′`alloc(pm′)(size′)(s′)), size′),

at′`info(ac′))]

(ac1′))

{3} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Case splitting on ac1!1 = ac!1, we get 2 subgoals:

C.9 Proofs for Allocation_Table (allocators.pvs)

allocation_alloc.1.2.1:

{-1} ac1′ = ac′

{-2} stays_unchanged(pm′)

(s′, state(ac′`alloc(pm′)(size′)(s′)), ac2′`private_mem(pm′))

{-3} (ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′))
{-4} block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′))
{-5} allocator?(pm′)(ac1′)
{-6} at′`hierarchy`nodes(ac1′)
{-7} allocator?(pm′)(ac2′)
{-8} at′`hierarchy`nodes(ac2′)
{-9} at′`hierarchy`edges(ac1′, ac2′)
{-10} plain_memory?(pm′)
{-11} allocator?(pm′)(ac′)
{-12} at′`hierarchy`nodes(ac′)
{-13} size′ > 0
{-14} pm′`states(s′)
{-15} allocation_ok?(pm′)(at′, s′)
{-16} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac′ = ac2′

{2} (ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′)))) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info

with [(ac′)

:= cons((data(ac′`alloc(pm′)(size′)(s′)), size′),

at′`info(ac′))]

(ac1′))

{3} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Rewriting using block_is_free_add, matching in *, Using lemma allocator_alloc_disjoint, Simplifying, rewriting, and recording with decision procedures, Using lemma disjoint_mono, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.1.2.1.

allocation_alloc.1.2.2:

{-1} stays_unchanged(pm′)

(s′, state(ac′`alloc(pm′)(size′)(s′)), ac2′`private_mem(pm′))

{-2} (ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(s′))
{-3} block_is_free(ac2′`memory_pool(pm′)(s′), at′`info(ac1′))
{-4} allocator?(pm′)(ac1′)
{-5} at′`hierarchy`nodes(ac1′)
{-6} allocator?(pm′)(ac2′)
{-7} at′`hierarchy`nodes(ac2′)
{-8} at′`hierarchy`edges(ac1′, ac2′)
{-9} plain_memory?(pm′)
{-10} allocator?(pm′)(ac′)
{-11} at′`hierarchy`nodes(ac′)
{-12} size′ > 0
{-13} pm′`states(s′)
{-14} allocation_ok?(pm′)(at′, s′)
{-15} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac1′ = ac′
{2} ac′ = ac2′

{3} (ac2′‘memory_pool(pm′)(s′) ⊆ ac1′‘allocated(pm′)(state(ac′‘alloc(pm′)(size′)(s′)))) ∧ block_is_free(ac2′`memory_pool(pm′)(s′), at′`info

with [(ac′)

:= cons((data(ac′`alloc(pm′)(size′)(s′)), size′),

at′`info(ac′))]

(ac1′))

{4} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_allocated, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.1.2.2.

allocation_alloc.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} at′`hierarchy`nodes(ac′)
{-4} size′ > 0
{-5} pm′`states(s′)
{-6} allocation_ok?(pm′)(at′, s′)
{-7} OK?(ac′`alloc(pm′)(size′)(s′))

{1} ∀ (ac1, ac2, ac3: (at′`hierarchy`nodes)): at′`hierarchy`edges(ac1, ac2) ∧ at′`hierarchy`edges(ac1, ac3) ⊃ ac2 = ac3 ∨ disjoint?(ac2`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac3`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Repeatedly Skolemizing and flattening, Using lemma allocation_subnodes_disjoint, Simplifying, rewriting, and recording with decision procedures, Case splitting on ac2!1 = ac!1, we get 2 subgoals:

allocation_alloc.2.1:

{-1} ac2′ = ac′
{-2} disjoint?(ac2′`memory_pool(pm′)(s′), ac3′`memory_pool(pm′)(s′))
{-3} allocator?(pm′)(ac1′)
{-4} at′`hierarchy`nodes(ac1′)
{-5} allocator?(pm′)(ac2′)
{-6} at′`hierarchy`nodes(ac2′)
{-7} allocator?(pm′)(ac3′)
{-8} at′`hierarchy`nodes(ac3′)
{-9} at′`hierarchy`edges(ac1′, ac2′)
{-10} at′`hierarchy`edges(ac1′, ac3′)
{-11} plain_memory?(pm′)
{-12} allocator?(pm′)(ac′)
{-13} at′`hierarchy`nodes(ac′)
{-14} size′ > 0
{-15} pm′`states(s′)
{-16} allocation_ok?(pm′)(at′, s′)
{-17} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac2′ = ac3′

{2} disjoint?(ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac3′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{3} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Replacing using formula -1, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.2.1.

allocation_alloc.2.2:

{-1} disjoint?(ac2′`memory_pool(pm′)(s′), ac3′`memory_pool(pm′)(s′))
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} allocator?(pm′)(ac3′)
{-7} at′`hierarchy`nodes(ac3′)
{-8} at′`hierarchy`edges(ac1′, ac2′)
{-9} at′`hierarchy`edges(ac1′, ac3′)
{-10} plain_memory?(pm′)
{-11} allocator?(pm′)(ac′)
{-12} at′`hierarchy`nodes(ac′)
{-13} size′ > 0
{-14} pm′`states(s′)
{-15} allocation_ok?(pm′)(at′, s′)
{-16} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac2′ = ac′
{2} ac2′ = ac3′

{3} disjoint?(ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac3′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{4} data(ac′`alloc(pm′)(size′)(s′)) = null_address

C Proof scripts

Case splitting on ac3!1 = ac!1, we get 2 subgoals:

allocation_alloc.2.2.1:

{-1} ac3′ = ac′
{-2} disjoint?(ac2′`memory_pool(pm′)(s′), ac3′`memory_pool(pm′)(s′))
{-3} allocator?(pm′)(ac1′)
{-4} at′`hierarchy`nodes(ac1′)
{-5} allocator?(pm′)(ac2′)
{-6} at′`hierarchy`nodes(ac2′)
{-7} allocator?(pm′)(ac3′)
{-8} at′`hierarchy`nodes(ac3′)
{-9} at′`hierarchy`edges(ac1′, ac2′)
{-10} at′`hierarchy`edges(ac1′, ac3′)
{-11} plain_memory?(pm′)
{-12} allocator?(pm′)(ac′)
{-13} at′`hierarchy`nodes(ac′)
{-14} size′ > 0
{-15} pm′`states(s′)
{-16} allocation_ok?(pm′)(at′, s′)
{-17} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac2′ = ac′
{2} ac2′ = ac3′

{3} disjoint?(ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac3′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{4} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Replacing using formula -1, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.2.2.1.

allocation_alloc.2.2.2:

{-1} disjoint?(ac2′`memory_pool(pm′)(s′), ac3′`memory_pool(pm′)(s′))
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} allocator?(pm′)(ac2′)
{-5} at′`hierarchy`nodes(ac2′)
{-6} allocator?(pm′)(ac3′)
{-7} at′`hierarchy`nodes(ac3′)
{-8} at′`hierarchy`edges(ac1′, ac2′)
{-9} at′`hierarchy`edges(ac1′, ac3′)
{-10} plain_memory?(pm′)
{-11} allocator?(pm′)(ac′)
{-12} at′`hierarchy`nodes(ac′)
{-13} size′ > 0
{-14} pm′`states(s′)
{-15} allocation_ok?(pm′)(at′, s′)
{-16} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac3′ = ac′
{2} ac2′ = ac′
{3} ac2′ = ac3′

{4} disjoint?(ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac3′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{5} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Using lemma allocation_alloc_other_private_memory, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.2.2.2.

allocation_alloc.3:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} at′`hierarchy`nodes(ac′)
{-4} size′ > 0
{-5} pm′`states(s′)
{-6} allocation_ok?(pm′)(at′, s′)
{-7} OK?(ac′`alloc(pm′)(size′)(s′))

{1} ∀ (ac1, ac2: (roots(at′`hierarchy))):

ac1 = ac2 ∨ disjoint?(ac1`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac2`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Repeatedly Skolemizing and flattening, Using lemma allocation_roots_disjoint, Simplifying, rewriting, and recording with decision procedures, Case splitting on ac1!1 = ac!1, we get 2 subgoals:

allocation_alloc.3.1:

{-1} ac1′ = ac′
{-2} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))
{-3} allocator?(pm′)(ac1′)
{-4} at′`hierarchy`nodes(ac1′)
{-5} roots(at′`hierarchy)(ac1′)
{-6} allocator?(pm′)(ac2′)
{-7} at′`hierarchy`nodes(ac2′)
{-8} roots(at′`hierarchy)(ac2′)
{-9} plain_memory?(pm′)
{-10} allocator?(pm′)(ac′)
{-11} at′`hierarchy`nodes(ac′)
{-12} size′ > 0
{-13} pm′`states(s′)
{-14} allocation_ok?(pm′)(at′, s′)
{-15} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac1′ = ac2′

{2} disjoint?(ac1′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{3} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Replacing using formula -1, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.3.1.

allocation_alloc.3.2:

{-1} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} roots(at′`hierarchy)(ac1′)
{-5} allocator?(pm′)(ac2′)
{-6} at′`hierarchy`nodes(ac2′)
{-7} roots(at′`hierarchy)(ac2′)
{-8} plain_memory?(pm′)
{-9} allocator?(pm′)(ac′)
{-10} at′`hierarchy`nodes(ac′)
{-11} size′ > 0
{-12} pm′`states(s′)
{-13} allocation_ok?(pm′)(at′, s′)
{-14} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac1′ = ac′
{2} ac1′ = ac2′

{3} disjoint?(ac1′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{4} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Case splitting on ac2!1 = ac!1, we get 2 subgoals:

allocation_alloc.3.2.1:

{-1} ac2′ = ac′
{-2} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))
{-3} allocator?(pm′)(ac1′)
{-4} at′`hierarchy`nodes(ac1′)
{-5} roots(at′`hierarchy)(ac1′)
{-6} allocator?(pm′)(ac2′)
{-7} at′`hierarchy`nodes(ac2′)
{-8} roots(at′`hierarchy)(ac2′)
{-9} plain_memory?(pm′)
{-10} allocator?(pm′)(ac′)
{-11} at′`hierarchy`nodes(ac′)
{-12} size′ > 0
{-13} pm′`states(s′)
{-14} allocation_ok?(pm′)(at′, s′)
{-15} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac1′ = ac′
{2} ac1′ = ac2′

{3} disjoint?(ac1′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{4} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Replacing using formula -1, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.3.2.1.

allocation_alloc.3.2.2:

{-1} disjoint?(ac1′`memory_pool(pm′)(s′), ac2′`memory_pool(pm′)(s′))
{-2} allocator?(pm′)(ac1′)
{-3} at′`hierarchy`nodes(ac1′)
{-4} roots(at′`hierarchy)(ac1′)
{-5} allocator?(pm′)(ac2′)
{-6} at′`hierarchy`nodes(ac2′)
{-7} roots(at′`hierarchy)(ac2′)
{-8} plain_memory?(pm′)
{-9} allocator?(pm′)(ac′)
{-10} at′`hierarchy`nodes(ac′)
{-11} size′ > 0
{-12} pm′`states(s′)
{-13} allocation_ok?(pm′)(at′, s′)
{-14} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac2′ = ac′
{2} ac1′ = ac′
{3} ac1′ = ac2′

{4} disjoint?(ac1′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))),

ac2′`memory_pool(pm′)(state(ac′`alloc(pm′)(size′)(s′))))

{5} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Using lemma allocation_alloc_other_private_memory, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_memory_pool, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.3.2.2.

allocation_alloc.4:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} at′`hierarchy`nodes(ac′)
{-4} size′ > 0
{-5} pm′`states(s′)
{-6} allocation_ok?(pm′)(at′, s′)
{-7} OK?(ac′`alloc(pm′)(size′)(s′))

{1} ∀ (ac1, ac2: (at′`hierarchy`nodes)):

ac1 = ac2 ∨ disjoint?(ac1`private_mem(pm′), ac2`private_mem(pm′))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Repeatedly Skolemizing and flattening, Using lemma allocation_private_memory_disjoint, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.4.

allocation_alloc.5:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} at′`hierarchy`nodes(ac′)
{-4} size′ > 0
{-5} pm′`states(s′)
{-6} allocation_ok?(pm′)(at′, s′)
{-7} OK?(ac′`alloc(pm′)(size′)(s′))

{1} ∀ (ac: (at′`hierarchy`nodes)):

consistent_allocator?(pm′)

(ac,

at′`info

with [(ac′)

:= cons((data(ac′`alloc(pm′)(size′)(s′)),

size′), at′`info(ac′))]

(ac)) (state(ac′`alloc(pm′)(size′)(s′)))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Repeatedly Skolemizing and flattening, Using lemma allocation_consistent_allocator, Simplifying, rewriting, and recording with decision procedures, Case splitting on ac!1 = ac!2, we get 2 subgoals:

allocation_alloc.5.1:

{-1} ac′ = ac′′
{-2} consistent_allocator?(pm′)(ac′′, at′`info(ac′′))(s′)
{-3} allocator?(pm′)(ac′′)
{-4} at′`hierarchy`nodes(ac′′)
{-5} plain_memory?(pm′)
{-6} allocator?(pm′)(ac′)
{-7} at′`hierarchy`nodes(ac′)
{-8} size′ > 0
{-9} pm′`states(s′)
{-10} allocation_ok?(pm′)(at′, s′)
{-11} OK?(ac′`alloc(pm′)(size′)(s′))

{1} consistent_allocator?(pm′)

(ac′′,

at′`info
with [(ac′)

:= cons((data(ac′`alloc(pm′)(size′)(s′)), size′),

at′`info(ac′))]

(ac′′)) (state(ac′`alloc(pm′)(size′)(s′)))

{2} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Rewriting using consistent_allocator_alloc, matching in *, This completes the proof of allocation_alloc.5.1.

allocation_alloc.5.2:

{-1} consistent_allocator?(pm′)(ac′′, at′`info(ac′′))(s′)
{-2} allocator?(pm′)(ac′′)
{-3} at′`hierarchy`nodes(ac′′)
{-4} plain_memory?(pm′)
{-5} allocator?(pm′)(ac′)
{-6} at′`hierarchy`nodes(ac′)
{-7} size′ > 0
{-8} pm′`states(s′)
{-9} allocation_ok?(pm′)(at′, s′)
{-10} OK?(ac′`alloc(pm′)(size′)(s′))
{1} ac′ = ac′′

{2} consistent_allocator?(pm′)

(ac′′,

at′`info
with [(ac′)

:= cons((data(ac′`alloc(pm′)(size′)(s′)), size′),

at′`info(ac′))]

(ac′′)) (state(ac′`alloc(pm′)(size′)(s′)))

{3} data(ac′`alloc(pm′)(size′)(s′)) = null_address

Simplifying, rewriting, and recording with decision procedures, Using lemma consistent_allocator_state_change, Simplifying, rewriting, and recording with decision procedures, Using lemma allocation_alloc_other_private_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_const_private_memory_allocated, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocation_alloc.5.2. Q.E.D.

C.10 Proofs for Allocator (allocators.pvs)

C.10.1 Allocator.null_address_TCC1

Terse proof for null_address_TCC1.
null_address_TCC1:

{1} Mem?(Mem(0)`type_of)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of null_address_TCC1. Q.E.D.

C.10.2 Allocator.allocator?_TCC1

Terse proof for allocator?_TCC1.
allocator?_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (size: posnat):

disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of allocator?_TCC1. Q.E.D.

C.10.3 Allocator.allocator?_TCC2

Terse proof for allocator?_TCC2.

C.10 Proofs for Allocator (allocators.pvs)

allocator?_TCC2:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State): (∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat): OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s), address_block(data(ac`alloc(pm)(size)(s)), size)) ∧ ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s)) ∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (addr1: Address): OK?(ac`free(pm)(addr1)(s)) ⊃ OK?[State, Unit](ac`free(pm)(addr1)(s)) ∨ Exception?[State, Unit](ac`free(pm)(addr1)(s))))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of allocator?_TCC2. Q.E.D.

C.10.4 Allocator.allocator?_TCC3

Terse proof for allocator?_TCC3.

C Proof scripts

allocator?_TCC3:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State): (∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat): OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s), address_block(data(ac`alloc(pm)(size)(s)), size)) ∧ ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s)) ∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (addr1: Address): OK?(ac`free(pm)(addr1)(s)) ⊃ up?[posnat](ac`freed_size(pm)(addr1)(s))))

Repeatedly Skolemizing and flattening, Rewriting using -3, matching in *, This completes the proof of allocator?_TCC3. Q.E.D.

C.10.5 Allocator.allocator?_TCC4

Terse proof for allocator?_TCC4.

C.10 Proofs for Allocator (allocators.pvs)

allocator?_TCC4:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (s_{2}: State):

pm`states(s_{2}) ∧ stays_unchanged(pm)(s, s_{2}, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_{2}) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_{2}))

∧

(∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ⊃ ac`allocated(pm)(state(ac`free(pm)(addr)(s))) = (ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (size1: posnat):

has_next_state(ac`alloc(pm)(size1)(s)) ⊃

OK?[State, Address](ac`alloc(pm)(size1)(s)) ∨

Exception?[State, Address](ac`alloc(pm)(size1)(s))))

Repeatedly Skolemizing and flattening, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of allocator?_TCC4. Q.E.D.

C.10.6 Allocator.allocator?_TCC5

Terse proof for allocator?_TCC5.

allocator?_TCC5:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (size: posnat): has_next_state(ac`alloc(pm)(size)(s)) ⊃ pm`states(state(ac`alloc(pm)(size)(s))))

∧

(∀ (s_{2}: State):

pm`states(s_{2}) ∧ stays_unchanged(pm)(s, s_{2}, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_{2}) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_{2}))

∧

(∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ⊃ ac`allocated(pm)(state(ac`free(pm)(addr)(s))) = (ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (addr1: Address):

has_next_state(ac`free(pm)(addr1)(s)) ⊃ OK?[State, Unit](ac`free(pm)(addr1)(s)) ∨ Exception?[State, Unit](ac`free(pm)(addr1)(s))))

Repeatedly Skolemizing and flattening,

Expanding the definition of has_next_state,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of allocator?_TCC5.

Q.E.D.

C.10.7 Allocator.allocator?_TCC6

Terse proof for allocator?_TCC6.
allocator?_TCC6:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (addr: Address): has_next_state(ac`free(pm)(addr)(s)) ⊃ pm`states(state(ac`free(pm)(addr)(s))))

∧ (∀ (size: posnat):

has_next_state(ac`alloc(pm)(size)(s)) ⊃ pm`states(state(ac`alloc(pm)(size)(s))))

∧ (∀ (s_{2}: State):

pm`states(s_{2}) ∧ stays_unchanged(pm)(s, s_{2}, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_{2}) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_{2}))

∧ (∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ⊃

ac`allocated(pm)(state(ac`free(pm)(addr)(s))) =

(ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧ (∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (size1: posnat):

OK?(ac`alloc(pm)(size1)(s)) ∧ ¬ data(ac`alloc(pm)(size1)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size1)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size1)(s))))

C Proof scripts

Repeatedly Skolemizing and flattening, This completes the proof of allocator?_TCC6. Q.E.D.

C.10.8 Allocator.allocator?_TCC7

Terse proof for allocator?_TCC7.

allocator?_TCC7:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (addr: Address): has_next_state(ac`free(pm)(addr)(s)) ⊃ pm`states(state(ac`free(pm)(addr)(s))))

∧

(∀ (size: posnat): has_next_state(ac`alloc(pm)(size)(s)) ⊃ pm`states(state(ac`alloc(pm)(size)(s))))

∧

(∀ (s_{2}: State):

pm`states(s_{2}) ∧ stays_unchanged(pm)(s, s_{2}, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_{2}) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_{2}))

∧

(∀ (addr: Address): OK?(ac`free(pm)(addr)(s)) ⊃ ac`allocated(pm)(state(ac`free(pm)(addr)(s))) = (ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧

(∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (size1: posnat):

OK?(ac`alloc(pm)(size1)(s)) ∧

¬ data(ac`alloc(pm)(size1)(s)) = null_address

⊃ pm`states(state[State, Address](ac`alloc(pm)(size1)(s)))))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of has_next_state, Simplifying, rewriting, and recording with decision procedures,

C Proof scripts

This completes the proof of allocator?_TCC7.

Q.E.D.

C.10.9 Allocator.allocator?_TCC8

Terse proof for allocator?_TCC8.

allocator?_TCC8:

{1} ∀ (pm: (plain_memory?[State]), ac: Allocator): (ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ (∀ (s: State):

(∀ (size: posnat): OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ only_changes(pm)(s, state(ac`alloc(pm)(size)(s)), ac`private_mem(pm)))

∧ (∀ (addr: Address):

has_next_state(ac`free(pm)(addr)(s)) ⊃ pm`states(state(ac`free(pm)(addr)(s))))

∧ (∀ (size: posnat):

has_next_state(ac`alloc(pm)(size)(s)) ⊃

pm`states(state(ac`alloc(pm)(size)(s)))) ∧ (∀ (s_{2}: State):

pm`states(s_{2}) ∧ stays_unchanged(pm)(s, s_{2}, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s) = ac`memory_pool(pm)(s_{2}) ∧ ac`allocated(pm)(s) = ac`allocated(pm)(s_{2}))

∧ (∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ⊃

ac`allocated(pm)(state(ac`free(pm)(addr)(s))) =

(ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s)))) ∧ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s))

∧ (∀ (addr: Address):

OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s))) ∧ (∀ (size: posnat):

OK?(ac`alloc(pm)(size)(s)) ∧

¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

∧

ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size)) ∧ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s))

∧ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s)) ∧ pm`states(s) ⊃ (∀ (free_addr: Address):

OK?(ac`free(pm)(free_addr)(s)) ⊃ pm`states(state[State, Unit](ac`free(pm)(free_addr)(s)))))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of has_next_state, Simplifying, rewriting, and recording with decision procedures, This completes the proof of allocator?_TCC8. Q.E.D.

C.10.10 Allocator.allocator_subset_private_memory_plain_memory

Terse proof for allocator_subset_private_memory_plain_memory.
allocator_subset_private_memory_plain_memory:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm))):

(ac‘private_mem(pm) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_subset_private_memory_plain_memory.

Q.E.D.

C.10.11 Allocator.allocator_private_memory_in_plain_memory

Terse proof for allocator_private_memory_in_plain_memory.
allocator_private_memory_in_plain_memory:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Address): ac`private_mem(pm)(addr) ⊃ union(pm`ro_addr, pm`rw_addr)(addr)

Repeatedly Skolemizing and flattening, Using lemma allocator_subset_private_memory_plain_memory, Using lemma subset_member, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_private_memory_in_plain_memory.

Q.E.D.

C.10.12 Allocator.allocator_subset_allocated_memory_pool

Terse proof for allocator_subset_allocated_memory_pool.
allocator_subset_allocated_memory_pool:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), s: State): pm`states(s) ⊃ (ac‘allocated(pm)(s) ⊆ ac‘memory_pool(pm)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_subset_allocated_memory_pool.

Q.E.D.

C.10.13 Allocator.allocator_alloc_disjoint

Terse proof for allocator_alloc_disjoint.
allocator_alloc_disjoint:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ disjoint?(ac`allocated(pm)(s),

address_block(data(ac`alloc(pm)(size)(s)), size))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -3 with the terms: s′, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_alloc_disjoint.

Q.E.D.

C.10.14 Allocator.allocator_allocated_alloc_TCC1

Terse proof for allocator_allocated_alloc_TCC1.
allocator_allocated_alloc_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of allocator_allocated_alloc_TCC1.

Q.E.D.

C.10.15 Allocator.allocator_allocated_alloc

Terse proof for allocator_allocated_alloc.
allocator_allocated_alloc:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ ac`allocated(pm)(state(ac`alloc(pm)(size)(s))) = (ac‘allocated(pm)(s) ∪ address_block(data(ac‘alloc(pm)(size)(s)), size))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -3 with the terms: s′, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_allocated_alloc.

Q.E.D.

C.10.16 Allocator.allocator_memory_pool_alloc

Terse proof for allocator_memory_pool_alloc.
allocator_memory_pool_alloc:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ ac`memory_pool(pm)(state(ac`alloc(pm)(size)(s))) = ac`memory_pool(pm)(s)

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -3 with the terms: s′, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_memory_pool_alloc.

Q.E.D.

C.10.17 Allocator.allocator_subset_address_block_alloc_allocated

Terse proof for allocator_subset_address_block_alloc_allocated.
allocator_subset_address_block_alloc_allocated:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, addr: Ad-

dress, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ (address_block(data(ac‘alloc(pm)(size)(s)), size) ⊆ ac‘allocated(pm)(state(ac‘alloc(pm)(size)(s))))

Repeatedly Skolemizing and flattening, Using lemma allocator_allocated_alloc, Simplifying, rewriting, and recording with decision procedures, Applying union_subset3 where a gets address_block(data(ac!1‘alloc(pm!1)(size!1)(s!1)), size!1), b gets

ac!1‘allocated(pm!1)(s!1), Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_subset_address_block_alloc_allocated.

Q.E.D.

C.10.18 Allocator.allocator_free_freed_size

Terse proof for allocator_free_freed_size.
allocator_free_freed_size:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ⊃ (OK?(ac`free(pm)(addr)(s)) ≡ up?(ac`freed_size(pm)(addr)(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables,

This completes the proof of allocator_free_freed_size.

Q.E.D.

C.10.19 Allocator.allocator_allocated_free_TCC1

Terse proof for allocator_allocated_free_TCC1.
allocator_allocated_free_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ OK?(ac`free(pm)(addr)(s)) ⊃ OK?[State, Unit](ac`free(pm)(addr)(s)) ∨ Exception?[State, Unit](ac`free(pm)(addr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of allocator_allocated_free_TCC1.

Q.E.D.

C.10.20 Allocator.allocator_allocated_free_TCC2

Terse proof for allocator_allocated_free_TCC2.
allocator_allocated_free_TCC2:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ OK?(ac`free(pm)(addr)(s)) ⊃ up?[posnat](ac`freed_size(pm)(addr)(s))

Repeatedly Skolemizing and flattening, Rewriting using allocator_free_freed_size, matching in *,

This completes the proof of allocator_allocated_free_TCC2.

Q.E.D.

C.10.21 Allocator.allocator_allocated_free

Terse proof for allocator_allocated_free.

allocator_allocated_free:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ OK?(ac`free(pm)(addr)(s)) ⊃ ac`allocated(pm)(state(ac`free(pm)(addr)(s))) = (ac‘allocated(pm)(s) \ address_block(addr, down(ac‘freed_size(pm)(addr)(s))))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -3 with the terms: s′, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_allocated_free.

Q.E.D.

C.10.22 Allocator.allocator_memory_pool_free

Terse proof for allocator_memory_pool_free.
allocator_memory_pool_free:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ OK?(ac`free(pm)(addr)(s)) ⊃ ac`memory_pool(pm)(state(ac`free(pm)(addr)(s))) = ac`memory_pool(pm)(s)

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -3 with the terms: s′, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_memory_pool_free.

Q.E.D.

C.10.23 Allocator.allocator_const_private_memory_memory_pool

Terse proof for allocator_const_private_memory_memory_pool.
allocator_const_private_memory_memory_pool:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), s_{1}, s_{2}: State): pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ stays_unchanged(pm)(s_{1}, s_{2}, ac`private_mem(pm)) ⊃ ac`memory_pool(pm)(s_{1}) = ac`memory_pool(pm)(s_{2})

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -3 with the terms: s′_{1}, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_const_private_memory_memory_pool.

Q.E.D.

C.10.24 Allocator.allocator_const_private_memory_allocated

Terse proof for allocator_const_private_memory_allocated.
allocator_const_private_memory_allocated:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), s_{1}, s_{2}: State):

pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ stays_unchanged(pm)(s_{1}, s_{2}, ac`private_mem(pm)) ⊃ ac`allocated(pm)(s_{1}) = ac`allocated(pm)(s_{2})

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -3 with the terms: s′_{1}, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -7 with the terms: s′_{2}, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_const_private_memory_allocated.

Q.E.D.

C.10.25 Allocator.allocator_next_state_alloc_TCC1

Terse proof for allocator_next_state_alloc_TCC1.
allocator_next_state_alloc_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ has_next_state(ac`alloc(pm)(size)(s)) ⊃ OK?[State, Address](ac`alloc(pm)(size)(s)) ∨ Exception?[State, Address](ac`alloc(pm)(size)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of allocator_next_state_alloc_TCC1.

Q.E.D.

C.10.26 Allocator.allocator_next_state_alloc

Terse proof for allocator_next_state_alloc.
allocator_next_state_alloc:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ has_next_state(ac`alloc(pm)(size)(s)) ⊃ pm`states(state(ac`alloc(pm)(size)(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_next_state_alloc.

Q.E.D.

C.10.27 Allocator.allocator_next_state_free_TCC1

Terse proof for allocator_next_state_free_TCC1.
allocator_next_state_free_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ has_next_state(ac`free(pm)(addr)(s)) ⊃ OK?[State, Unit](ac`free(pm)(addr)(s)) ∨ Exception?[State, Unit](ac`free(pm)(addr)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of allocator_next_state_free_TCC1.

Q.E.D.

C.10.28 Allocator.allocator_next_state_free

Terse proof for allocator_next_state_free.
allocator_next_state_free:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ has_next_state(ac`free(pm)(addr)(s)) ⊃ pm`states(state(ac`free(pm)(addr)(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_next_state_free.

Q.E.D.

C.10.29 Allocator.allocator_only_changes_alloc_TCC1

Terse proof for allocator_only_changes_alloc_TCC1.

allocator_only_changes_alloc_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ pm`states(state[State, Address](ac`alloc(pm)(size)(s)))

Repeatedly Skolemizing and flattening, Rewriting using allocator_next_state_alloc, matching in *, Expanding the definition of has_next_state, which is trivially true.

This completes the proof of allocator_only_changes_alloc_TCC1.

Q.E.D.

C.10.30 Allocator.allocator_only_changes_alloc

Terse proof for allocator_only_changes_alloc.
allocator_only_changes_alloc:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ only_changes(pm)(s, state(ac`alloc(pm)(size)(s)), ac`private_mem(pm))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_only_changes_alloc.

Q.E.D.

C.10.31 Allocator.allocator_only_changes_free_TCC1

Terse proof for allocator_only_changes_free_TCC1.
allocator_only_changes_free_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), free_addr: Ad-

dress, s: State): pm`states(s) ∧ OK?(ac`free(pm)(free_addr)(s)) ⊃ pm`states(state[State, Unit](ac`free(pm)(free_addr)(s)))

Repeatedly Skolemizing and flattening, Rewriting using allocator_next_state_free, matching in *, Expanding the definition of has_next_state, which is trivially true.

This completes the proof of allocator_only_changes_free_TCC1.

Q.E.D.

C.10.32 Allocator.allocator_only_changes_free

Terse proof for allocator_only_changes_free.
allocator_only_changes_free:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), free_addr: Address, s: State): pm`states(s) ∧ OK?(ac`free(pm)(free_addr)(s)) ⊃ only_changes(pm)(s, state(ac`free(pm)(free_addr)(s)), ac`private_mem(pm))

Repeatedly Skolemizing and flattening, Expanding the definition of allocator?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_only_changes_free.

Q.E.D.

C.10.33 Allocator.allocator_allocated_memory_read_TCC1

Terse proof for allocator_allocated_memory_read_TCC1.
allocator_allocated_memory_read_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s)) ∨ Exception?[State, Byte](memory_read(pm`mem)(addr)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *,

This completes the proof of allocator_allocated_memory_read_TCC1.

Q.E.D.

C.10.34 Allocator.allocator_allocated_memory_read

Terse proof for allocator_allocated_memory_read.
allocator_allocated_memory_read:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ ac`allocated(pm)(state(memory_read(pm`mem)(addr)(s))) = ac`allocated(pm)(s)

Installing automatic rewrites from: plain_memory_states_memory_read Repeatedly Skolemizing and flattening, Rewriting using allocator_const_private_memory_allocated, matching in *, we get 2 subgoals:

allocator_allocated_memory_read.1:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} pm′`states(s′)
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{1} pm′`states(state(memory_read(pm′`mem)(addr′)(s′)))

{2} ac′`allocated(pm′)(state(memory_read(pm′`mem)(addr′)(s′))) = ac′`allocated(pm′)(s′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_allocated_memory_read.1.
allocator_allocated_memory_read.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} pm′`states(s′)
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)

{1} stays_unchanged(pm′)

(state(memory_read(pm′`mem)(addr′)(s′)), s′, ac′`private_mem(pm′))

{2} ac′`allocated(pm′)(state(memory_read(pm′`mem)(addr′)(s′))) = ac′`allocated(pm′)(s′)

Rewriting using stays_unchanged_symmetric, matching in *, Using lemma plain_memory_stays_unchanged_memory_read, Simplifying, rewriting, and recording with decision procedures, Using lemma stays_unchanged_mono, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_subset_private_memory_plain_memory, matching in *,

This completes the proof of allocator_allocated_memory_read.2.

Q.E.D.

C.10.35 Allocator.allocator_memory_pool_memory_read

Terse proof for allocator_memory_pool_memory_read.
allocator_memory_pool_memory_read:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Address, s: State): pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ ac`memory_pool(pm)(state(memory_read(pm`mem)(addr)(s))) = ac`memory_pool(pm)(s)

Installing automatic rewrites from: plain_memory_states_memory_read Repeatedly Skolemizing and flattening, Rewriting using allocator_const_private_memory_memory_pool, matching in *, we get 2 subgoals:

allocator_memory_pool_memory_read.1:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} pm′`states(s′)
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{1} pm′`states(state(memory_read(pm′`mem)(addr′)(s′)))

{2} ac′`memory_pool(pm′)(state(memory_read(pm′`mem)(addr′)(s′))) = ac′`memory_pool(pm′)(s′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of allocator_memory_pool_memory_read.1.
allocator_memory_pool_memory_read.2:

{-1} plain_memory?(pm′)
{-2} allocator?(pm′)(ac′)
{-3} pm′`states(s′)
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)

{1} stays_unchanged(pm′)

(state(memory_read(pm′`mem)(addr′)(s′)), s′, ac′`private_mem(pm′))

{2} ac′`memory_pool(pm′)(state(memory_read(pm′`mem)(addr′)(s′))) = ac′`memory_pool(pm′)(s′)

Rewriting using stays_unchanged_symmetric, matching in *, Using lemma plain_memory_stays_unchanged_memory_read, Simplifying, rewriting, and recording with decision procedures, Using lemma stays_unchanged_mono, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_subset_private_memory_plain_memory, matching in *,

This completes the proof of allocator_memory_pool_memory_read.2.

Q.E.D.

C.10.36 Allocator.allocator_stays_unchanged_memory_write_private_mem_TCC1

Terse proof for allocator_stays_unchanged_memory_write_private_mem_TCC1.
allocator_stays_unchanged_memory_write_private_mem_TCC1:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), addr: Address, byte: Byte, s: State): pm`states(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ OK?[State, Unit](memory_write(pm`mem)(addr, byte)(s)) ∨ Exception?[State, Unit](memory_write(pm`mem)(addr, byte)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_write_ok, matching in *,

This completes the proof of allocator_stays_unchanged_memory_write_private_mem_TCC1.

Q.E.D.

C.10.37 Allocator.allocator_stays_unchanged_memory_write_private_mem_TCC2

Terse proof for allocator_stays_unchanged_memory_write_private_mem_TCC2.
allocator_stays_unchanged_memory_write_private_mem_TCC2:

{1} ∀ (pm: (plain_memory?[State]), ac: (allocator?(pm)), addr: Address, byte: Byte, s: State): pm`states(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ pm`states(state[State, Unit](memory_write(pm`mem)(addr, byte)(s)))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_states_memory_write, matching in *,

This completes the proof of allocator_stays_unchanged_memory_write_private_mem_TCC2.

Q.E.D.

C.10.38 Allocator.allocator_stays_unchanged_memory_write_private_mem

Terse proof for allocator_stays_unchanged_memory_write_private_mem.
allocator_stays_unchanged_memory_write_private_mem:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Ad-

dress, byte: Byte, s: State): pm`states(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ stays_unchanged(pm)

(s, state(memory_write(pm`mem)(addr, byte)(s)), ac`private_mem(pm))

Installing automatic rewrites from: plain_memory_states_memory_write Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_stays_unchanged_memory_write, Simplifying, rewriting, and recording with decision procedures, Using lemma stays_unchanged_mono, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -1, 3, Using lemma allocator_subset_private_memory_plain_memory, Keeping (-1 1 2) and hiding *, Rewriting relative to the theory: sets, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement,

This completes the proof of allocator_stays_unchanged_memory_write_private_mem.

Q.E.D.

C.10.39 Allocator.allocator_allocated_memory_write

Terse proof for allocator_allocated_memory_write.
allocator_allocated_memory_write:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Ad-

dress, byte: Byte, s: State): pm`states(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ ac`allocated(pm)(state(memory_write(pm`mem)(addr, byte)(s))) = ac`allocated(pm)(s)

Installing automatic rewrites from: plain_memory_states_memory_write Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_const_private_memory_allocated, matching in *, Rewriting using stays_unchanged_symmetric, matching in *, Rewriting using allocator_stays_unchanged_memory_write_private_mem, matching in *,

This completes the proof of allocator_allocated_memory_write.

Q.E.D.

C.10.40 Allocator.allocator_memory_pool_memory_write

Terse proof for allocator_memory_pool_memory_write.
allocator_memory_pool_memory_write:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), addr: Ad-

dress, byte: Byte, s: State): pm`states(s) ∧ pm`rw_addr(addr) ∧ ¬ ac`private_mem(pm)(addr) ⊃ ac`memory_pool(pm)(state(memory_write(pm`mem)(addr, byte)(s))) = ac`memory_pool(pm)(s)

Installing automatic rewrites from: plain_memory_states_memory_write Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_const_private_memory_memory_pool, matching in *, Rewriting using stays_unchanged_symmetric, matching in *, Rewriting using allocator_stays_unchanged_memory_write_private_mem, matching in *,

This completes the proof of allocator_memory_pool_memory_write.

Q.E.D.

C.10.41 Allocator.allocator_subset_address_block_alloc_memory_pool

Terse proof for allocator_subset_address_block_alloc_memory_pool.
allocator_subset_address_block_alloc_memory_pool:

{1} ∀ (pm: (plain_memory?), ac: (allocator?(pm)), size: posnat, addr: Ad-

dress, s: State): pm`states(s) ∧ OK?(ac`alloc(pm)(size)(s)) ∧ ¬ data(ac`alloc(pm)(size)(s)) = null_address ⊃ (address_block(data(ac‘alloc(pm)(size)(s)), size) ⊆ ac‘memory_pool(pm)(s))

Repeatedly Skolemizing and flattening, Using lemma allocator_subset_address_block_alloc_allocated, Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_next_state_alloc, Installing automatic rewrites from: has_next_state Simplifying, rewriting, and recording with decision procedures, Using lemma allocator_subset_allocated_memory_pool, Simplifying, rewriting, and recording with decision procedures, Rewriting using allocator_memory_pool_alloc, matching in *, Forward chaining on subset_transitive,

This completes the proof of allocator_subset_address_block_alloc_memory_pool.

Q.E.D.

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

C.11.1 ArithmeticExpressions.mod_impl_TCC1

Terse proof for mod_impl_TCC1.

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

mod_impl_TCC1:

{1} ∃ (x: [d: [int, {k: int | k ≠ 0}] → {r: int | abs(r) < abs(d`2)}]): true

Instantiating the top quantifier in 1 with the terms: (λ (a: int, b: {k: int | k ≠ 0}): 0), we get 2 subgoals:

mod_impl_TCC1.1:

{1} true

which is trivially true. This completes the proof of mod_impl_TCC1.1.

mod_impl_TCC1.2:

{1} ∀ (b: {k: int | k ≠ 0}): abs(0) < abs(b)

Repeatedly Skolemizing and flattening, Expanding the definition of abs, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of mod_impl_TCC1.2. Q.E.D.

C.11.2 ArithmeticExpressions.div_impl_pos_range_TCC1

Terse proof for div_impl_pos_range_TCC1.
div_impl_pos_range_TCC1:

{1} ∀ (j: nat): j ≠ 0 ⊃ j > 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of div_impl_pos_range_TCC1. Q.E.D.

C.11.3 ArithmeticExpressions.plus_ptr_TCC1

Terse proof for plus_ptr_TCC1.

plus_ptr_TCC1:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?)),

ptr_val: (range_pointer(cv_base(typ))), n: (range(i_typ))): not_null?(typ)(ptr_val) ⊃ array?(cv_base(typ)) ∨ pointer?(cv_base(typ)) ∨ reference?(cv_base(typ)) ∨ bitfield?(cv_base(typ)) ∨ enum?(cv_base(typ)) ∨ pointer_to_member?(cv_base(typ)) ∨ const?(cv_base(typ)) ∨ volatile?(cv_base(typ))

Repeatedly Skolemizing and flattening, Keeping (-2 2) and hiding *,

C Proof scripts

Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of plus_ptr_TCC1. Q.E.D.

C.11.4 ArithmeticExpressions.plus_ptr_TCC2

Terse proof for plus_ptr_TCC2.

plus_ptr_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?)),

ptr_val: (range_pointer(cv_base(typ))), n: (range(i_typ))): not_null?(typ)(ptr_val) ⊃ Cpp_Type?(typ(cv_base(typ)))

Repeatedly Skolemizing and flattening, Keeping (-1 -2 1) and hiding *, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (t!1), Splitting conjunctions, we get 2 subgoals:

plus_ptr_TCC2.1:

{-1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

{-2} cv(pointer?)(typ′)
{-3} subterm(t′, typ(cv_base(typ′)))

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

575

which is trivially true. This completes the proof of plus_ptr_TCC2.1.

plus_ptr_TCC2.2:

{-1} cv(pointer?)(typ′)
{-2} subterm(t′, typ(cv_base(typ′)))
{1} subterm(t′, typ′)

{2} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Hiding formulas: 2, Using lemma subterm_cv_base, Using lemma cv_base_result, we get 2 subgoals:

plus_ptr_TCC2.2.1:

{-1} pointer?(cv_base(typ′))
{-2} subterm(cv_base(typ′), typ′)
{-3} cv(pointer?)(typ′)
{-4} subterm(t′, typ(cv_base(typ′)))
{1} subterm(t′, typ′)

Using lemma subterm_transitive, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -4 1) and hiding *, Expanding the definition of subterm, which is trivially true. This completes the proof of plus_ptr_TCC2.2.1.

plus_ptr_TCC2.2.2:

{-1} subterm(cv_base(typ′), typ′)
{-2} cv(pointer?)(typ′)
{-3} subterm(t′, typ(cv_base(typ′)))
{1} (pointer? ⊆ interpreted?)
{2} subterm(t′, typ′)

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of plus_ptr_TCC2.2.2. Q.E.D.

C.11.5 ArithmeticExpressions.plus_ptr_TCC3

Terse proof for plus_ptr_TCC3.

plus_ptr_TCC3:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?)),

ptr_val: (range_pointer(cv_base(typ))), n: (range(i_typ))): not_null?(typ)(ptr_val) ⊃ pointer?(cv_base(typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in * where P gets pointer?, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of plus_ptr_TCC3. Q.E.D.

C.11.6 ArithmeticExpressions.plus_ptr_TCC4

Terse proof for plus_ptr_TCC4.

plus_ptr_TCC4:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?)),

ptr_val: (range_pointer(cv_base(typ))), n: (range(i_typ))): ¬ (not_null?(typ)(ptr_val) ∧

range_pointer(cv_base(typ))

(add(typ)(ptr_val, n × size_of(typ(cv_base(typ)))))

∧

check_bounds(typ)

(add(typ)(ptr_val, n × size_of(typ(cv_base(typ))))))

⊃ pointer?(cv_base(typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of plus_ptr_TCC4. Q.E.D.

C.11.7 ArithmeticExpressions.plus_ptr_TCC5

Terse proof for plus_ptr_TCC5.

plus_ptr_TCC5:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?)),

ptr_val: (range_pointer(cv_base(typ)))): pointer?(cv_base(typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of plus_ptr_TCC5. Q.E.D.

C.11.8 ArithmeticExpressions.plus_ptr_TCC6

Terse proof for plus_ptr_TCC6.

plus_ptr_TCC6:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?))): pointer?(cv_base(typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of plus_ptr_TCC6. Q.E.D.

C.11.9 ArithmeticExpressions.postinc_ptr_TCC1

Terse proof for postinc_ptr_TCC1.
postinc_ptr_TCC1:

{1} ∀ ((typ: Cpp_Subtype(v(pointer?)))): cv(pointer?)(typ)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of postinc_ptr_TCC1. Q.E.D.

C.11.10 ArithmeticExpressions.postinc_ptr_TCC2

Terse proof for postinc_ptr_TCC2.
postinc_ptr_TCC2:

{1} ∀ ((typ: Cpp_Subtype(v(pointer?)))): pointer?(cv_base(typ))

Repeatedly Skolemizing and flattening, Using lemma postinc_ptr_TCC1, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of postinc_ptr_TCC2. Q.E.D.

C.11.11 ArithmeticExpressions.postinc_ptr_TCC3

Terse proof for postinc_ptr_TCC3.
postinc_ptr_TCC3:

{1} ∀ ((typ: Cpp_Subtype(v(pointer?)))): range(uchar)(1)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Expanding the definition of range, Expanding the definition of range_integral, Expanding the definition of extend, Using lemma binary_range_uchar, Using lemma max_uchar, Using lemma pos_expt_gt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of postinc_ptr_TCC3. Q.E.D.

C.11.12 ArithmeticExpressions.postinc_ptr_TCC4

Terse proof for postinc_ptr_TCC4.
postinc_ptr_TCC4:

{1} ∀ ((typ: Cpp_Subtype(v(pointer?)))):

Cpp_Type?(uchar) ∧ cv(non_bool_integral_enum?)(uchar)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Applying propositional simplification, we get 2 subgoals:

postinc_ptr_TCC4.1:

{1} Cpp_Type?(uchar)

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of postinc_ptr_TCC4.1.

postinc_ptr_TCC4.2:

{1} cv(non_bool_integral_enum?)(uchar)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of postinc_ptr_TCC4.2. Q.E.D.

C.11.13 ArithmeticExpressions.subscript_TCC1

Terse proof for subscript_TCC1.
subscript_TCC1:

{1} ∀ ((typ: Cpp_Subtype(array?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?))): array?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ)

Repeatedly Skolemizing and flattening, This completes the proof of subscript_TCC1. Q.E.D.

C.11.14 ArithmeticExpressions.subscript_TCC2

Terse proof for subscript_TCC2.
subscript_TCC2:

{1} ∀ ((typ: Cpp_Subtype(array?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?))): Cpp_Type?(pointer(typ(typ))) ∧ cv(pointer?)(pointer(typ(typ)))

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

subscript_TCC2.1:

{-1} Cpp_Type?(typ′)
{-2} array?(typ′)
{-3} Cpp_Type?(i_typ′)
{-4} cv(non_bool_integral_enum?)(i_typ′)
{1} Cpp_Type?(pointer(typ(typ′)))

Keeping (-1 -2 1) and hiding *, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Splitting conjunctions, we get 2 subgoals:

subscript_TCC2.1.1:

{-1} t′ = pointer(typ(typ′))

{-2} ∀ (t: Cpp_Type_): subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-3} array?(typ′)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

581

Replacing using formula -1,

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_array_of_bitfields? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Instantiating the top quantifier in -2 with the terms: (typ!1),

Expanding the definition of subterm,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of subscript_TCC2.1.1.

subscript_TCC2.1.2:

{-1} subterm(t′, typ(typ′))

{-2} ∀ (t: Cpp_Type_): subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-3} array?(typ′)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

583

Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subscript_TCC2.1.2.

subscript_TCC2.2:

{-1} Cpp_Type?(typ′)
{-2} array?(typ′)
{-3} Cpp_Type?(i_typ′)
{-4} cv(non_bool_integral_enum?)(i_typ′)
{1} cv(pointer?)(pointer(typ(typ′)))

Expanding the definition of cv, Expanding the definition of c, which is trivially true. This completes the proof of subscript_TCC2.2. Q.E.D.

C.11.15 ArithmeticExpressions.subscript_TCC3

Terse proof for subscript_TCC3.
subscript_TCC3:

{1} ∀ ((typ: Cpp_Subtype(array?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?))): Cpp_Type?(pointer(typ(typ)))

Repeatedly Skolemizing and flattening, Using lemma subscript_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subscript_TCC3. Q.E.D.

C.11.16 ArithmeticExpressions.subscript_TCC4

Terse proof for subscript_TCC4.
subscript_TCC4:

{1} ∀ ((typ: Cpp_Subtype(array?)), i_typ: Cpp_Subtype(cv(non_bool_integral_enum?))): pointer?(cv_base(pointer(typ(typ))))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result2, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subscript_TCC4. Q.E.D.

C.11.17 ArithmeticExpressions.ptr_to_nonzero_object_TCC1

Terse proof for ptr_to_nonzero_object_TCC1.

ptr_to_nonzero_object_TCC1:

{1} ∀ (typ:

Cpp_Subtype(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))):

array?(cv_base(typ)) ∨ pointer?(cv_base(typ)) ∨ reference?(cv_base(typ)) ∨ bitfield?(cv_base(typ)) ∨ enum?(cv_base(typ)) ∨ pointer_to_member?(cv_base(typ)) ∨ const?(cv_base(typ)) ∨ volatile?(cv_base(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 4) and hiding *, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

ptr_to_nonzero_object_TCC1.1:

{-1} pointer?(typ′)
{1} cv(pointer?)(typ′)
{2} pointer?(cv_base(typ′))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object_TCC1.1.
ptr_to_nonzero_object_TCC1.2:

{-1} pointer?(typ′)
{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(typ′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object_TCC1.2.

Q.E.D.

C.11.18 ArithmeticExpressions.ptr_to_nonzero_object_TCC2

Terse proof for ptr_to_nonzero_object_TCC2.
ptr_to_nonzero_object_TCC2:

{1} ∀ (typ:

Cpp_Subtype(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))):

array?(typ(cv_base(typ))) ⊃ Cpp_Type?(typ(cv_base(typ)))

Repeatedly Skolemizing and flattening, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, Keeping (-1 -2 3) and hiding *, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object_TCC2.

Q.E.D.

C.11.19 ArithmeticExpressions.ptr_to_nonzero_object_TCC3

Terse proof for ptr_to_nonzero_object_TCC3.
ptr_to_nonzero_object_TCC3:

{1} ∀ (typ:

Cpp_Subtype(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))):

(array?(typ(cv_base(typ))) ⊃ size_of(typ(cv_base(typ))) > 0) ⊃ Cpp_Type?(typ(cv_base(typ)))

Repeatedly Skolemizing and flattening, Hiding formulas: -3, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, Keeping (-1 -2 3) and hiding *, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object_TCC3.

Q.E.D.

C.11.20 ArithmeticExpressions.ptr_to_nonzero_object

Terse proof for ptr_to_nonzero_object.
ptr_to_nonzero_object:

{1} ∀ (typ:

Cpp_Subtype(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))):

(array?(typ(cv_base(typ))) ⊃ size_of(typ(cv_base(typ))) > 0) ⊃ size_of(typ(cv_base(typ))) > 0

Repeatedly Skolemizing and flattening, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, Expanding the definition of size_of, Expanding the definition of uidt, Expanding the definition of Cpp_Type?, Instantiating the top quantifier in -1 with the terms: (typ!1), Expanding the definition of subterm, Applying disjunctive simplification to flatten sequent, Hiding formulas: (-4 -5 -6 -7 -8 -9 -10 -11 -12 -13 -14 -15 -16), Hiding formulas: (-13 -15), Expanding the definition of no_pointers_to_bitfield?, Expanding the definition of no_pointers_to_references?, Installing automatic rewrites from: pod_size Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 13 subgoals:

ptr_to_nonzero_object.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_pointer(typ(typ′)))) > 0

Expanding the definition of dt_cv_pointer, Adding type constraints for dt_pointer(typ(typ!1)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of ptr_to_nonzero_object.1.

ptr_to_nonzero_object.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer_to_member?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_ptm(typ(typ′)))) > 0

Expanding the definition of dt_cv_ptm, Adding type constraints for dt_ptm(typ(typ!1)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of ptr_to_nonzero_object.2.

ptr_to_nonzero_object.3:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} bitfield?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_bitfield(typ(typ′)))) > 0

Expanding the definition of cv, Expanding the definition of c, which is trivially true. This completes the proof of ptr_to_nonzero_object.3.

ptr_to_nonzero_object.4:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(typ(typ(typ′)))) > 0

Expanding the definition of uidt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

ptr_to_nonzero_object.4.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer?(typ(typ(typ(typ′))))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_pointer(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_pointer, Rewriting using dt_volatile_size, matching in *, we get 2 subgoals:

ptr_to_nonzero_object.4.1.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer?(typ(typ(typ(typ′))))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_pointer(typ(typ(typ(typ′)))))) > 0

Expanding the definition of dt_cv_pointer, Adding type constraints for dt_pointer(typ(typ(typ(typ!1)))), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.4.1.1.

ptr_to_nonzero_object.4.1.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer?(typ(typ(typ(typ′))))

{1} ∃ (x_{1}:

(interpreted_data_type?

[((range_pointer(cv_base(typ(typ(typ(typ′)))))))])):

true

{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_pointer(typ(typ(typ(typ′))))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_pointer(cv_base(typ(typ(typ(typ!1)))))), we get 2 subgoals:

ptr_to_nonzero_object.4.1.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer?(typ(typ(typ(typ′))))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_pointer(typ(typ(typ(typ′))))))) > 0

which is trivially true.

This completes the proof of ptr_to_nonzero_object.4.1.2.1.

ptr_to_nonzero_object.4.1.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer?(typ(typ(typ(typ′))))
{1} pointer?(cv_base(typ(typ(typ(typ′)))))
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_pointer(typ(typ(typ(typ′))))))) > 0

Keeping (-15 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object.4.1.2.2.
ptr_to_nonzero_object.4.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer_to_member?(typ(typ(typ(typ′))))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_ptm(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_ptm, Rewriting using dt_volatile_size, matching in *, we get 2 subgoals:

ptr_to_nonzero_object.4.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer_to_member?(typ(typ(typ(typ′))))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_ptm(typ(typ(typ(typ′)))))) > 0

Expanding the definition of dt_cv_ptm, Adding type constraints for dt_ptm(typ(typ(typ(typ!1)))), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.4.2.1.
ptr_to_nonzero_object.4.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer_to_member?(typ(typ(typ(typ′))))

{1} ∃ (x_{1}:

(interpreted_data_type?[((range_ptm(cv_base(typ(typ(typ(typ′)))))))])): true

{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_ptm(typ(typ(typ(typ′))))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_ptm(cv_base(typ(typ(typ(typ!1)))))), we get 2 subgoals:

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

ptr_to_nonzero_object.4.2.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer_to_member?(typ(typ(typ(typ′))))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_ptm(typ(typ(typ(typ′))))))) > 0

which is trivially true.

This completes the proof of ptr_to_nonzero_object.4.2.2.1.
ptr_to_nonzero_object.4.2.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} pointer_to_member?(typ(typ(typ(typ′))))
{1} pointer_to_member?(cv_base(typ(typ(typ(typ′)))))
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_ptm(typ(typ(typ(typ′))))))) > 0

Keeping (-15 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object.4.2.2.2.

ptr_to_nonzero_object.4.3:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} bitfield?(typ(typ(typ(typ′))))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_bitfield(typ(typ(typ′))))) > 0

Expanding the definition of cv, which is trivially true.

This completes the proof of ptr_to_nonzero_object.4.3.
ptr_to_nonzero_object.4.4:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} floating_point?(typ(typ(typ(typ′))))
{1} cv(bitfield?)(typ(typ′))
{2} bool?(typ(typ(typ(typ′))))
{3} pointer?(typ(typ(typ(typ′))))
{4} pointer_to_member?(typ(typ(typ(typ′))))
{5} bitfield?(typ(typ(typ(typ′))))
{6} size(uidt(dt_cv_float(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_float, Rewriting using dt_volatile_size, matching in *, we get 2 subgoals:

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

ptr_to_nonzero_object.4.4.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} floating_point?(typ(typ(typ(typ′))))
{1} cv(bitfield?)(typ(typ′))
{2} bool?(typ(typ(typ(typ′))))
{3} pointer?(typ(typ(typ(typ′))))
{4} pointer_to_member?(typ(typ(typ(typ′))))
{5} bitfield?(typ(typ(typ(typ′))))
{6} size(uidt(dt_cv_float(typ(typ(typ(typ′)))))) > 0

Expanding the definition of dt_cv_float, Adding type constraints for dt_floating_point(typ(typ(typ(typ!1)))), Expanding the definition of floating_point?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.4.4.1.

ptr_to_nonzero_object.4.4.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} floating_point?(typ(typ(typ(typ′))))

{1} ∃ (x_{1}:

(interpreted_data_type?

[((range_floating_point(cv_base(typ(typ(typ(typ′)))))))])):

true

{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ(typ′))))
{4} pointer?(typ(typ(typ(typ′))))
{5} pointer_to_member?(typ(typ(typ(typ′))))
{6} bitfield?(typ(typ(typ(typ′))))
{7} size(uidt(dt_volatile(dt_cv_float(typ(typ(typ(typ′))))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_floating_point(cv_base(typ(typ(typ(typ!1)))))), we get 2 subgoals:

ptr_to_nonzero_object.4.4.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} floating_point?(typ(typ(typ(typ′))))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ(typ′))))
{4} pointer?(typ(typ(typ(typ′))))
{5} pointer_to_member?(typ(typ(typ(typ′))))
{6} bitfield?(typ(typ(typ(typ′))))
{7} size(uidt(dt_volatile(dt_cv_float(typ(typ(typ(typ′))))))) > 0

which is trivially true.

This completes the proof of ptr_to_nonzero_object.4.4.2.1.
ptr_to_nonzero_object.4.4.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} volatile?(typ(typ(typ′)))
{-15} floating_point?(typ(typ(typ(typ′))))
{1} floating_point?(cv_base(typ(typ(typ(typ′)))))
{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ(typ′))))
{4} pointer?(typ(typ(typ(typ′))))
{5} pointer_to_member?(typ(typ(typ(typ′))))
{6} bitfield?(typ(typ(typ(typ′))))
{7} size(uidt(dt_volatile(dt_cv_float(typ(typ(typ(typ′))))))) > 0

Keeping (-15 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object.4.4.2.2.
ptr_to_nonzero_object.5:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} floating_point?(typ(typ(typ′)))
{1} cv(bitfield?)(typ(typ′))
{2} bool?(typ(typ(typ′)))
{3} pointer?(typ(typ(typ′)))
{4} pointer_to_member?(typ(typ(typ′)))
{5} bitfield?(typ(typ(typ′)))
{6} volatile?(typ(typ(typ′)))
{7} size(uidt(dt_cv_float(typ(typ′)))) > 0

C Proof scripts

Expanding the definition of dt_cv_float, Rewriting using dt_const_size, matching in *, we get 2 subgoals:

ptr_to_nonzero_object.5.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} floating_point?(typ(typ(typ′)))
{1} cv(bitfield?)(typ(typ′))
{2} bool?(typ(typ(typ′)))
{3} pointer?(typ(typ(typ′)))
{4} pointer_to_member?(typ(typ(typ′)))
{5} bitfield?(typ(typ(typ′)))
{6} volatile?(typ(typ(typ′)))
{7} size(uidt(dt_cv_float(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_float, Adding type constraints for dt_floating_point(typ(typ(typ!1))), Expanding the definition of floating_point?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.5.1.

ptr_to_nonzero_object.5.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} floating_point?(typ(typ(typ′)))

{1} ∃ (x_{1}:

(interpreted_data_type?

[((range_floating_point(cv_base(typ(typ(typ′))))))])):

true

{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ′)))
{4} pointer?(typ(typ(typ′)))
{5} pointer_to_member?(typ(typ(typ′)))
{6} bitfield?(typ(typ(typ′)))
{7} volatile?(typ(typ(typ′)))
{8} size(uidt(dt_const(dt_cv_float(typ(typ(typ′)))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_floating_point(cv_base(typ(typ(typ!1))))), we get 2 subgoals:

ptr_to_nonzero_object.5.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} floating_point?(typ(typ(typ′)))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ′)))
{4} pointer?(typ(typ(typ′)))
{5} pointer_to_member?(typ(typ(typ′)))
{6} bitfield?(typ(typ(typ′)))
{7} volatile?(typ(typ(typ′)))
{8} size(uidt(dt_const(dt_cv_float(typ(typ(typ′)))))) > 0

C Proof scripts

which is trivially true.

This completes the proof of ptr_to_nonzero_object.5.2.1.
ptr_to_nonzero_object.5.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} floating_point?(typ(typ(typ′)))
{1} floating_point?(cv_base(typ(typ(typ′))))
{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ′)))
{4} pointer?(typ(typ(typ′)))
{5} pointer_to_member?(typ(typ(typ′)))
{6} bitfield?(typ(typ(typ′)))
{7} volatile?(typ(typ(typ′)))
{8} size(uidt(dt_const(dt_cv_float(typ(typ(typ′)))))) > 0

Keeping (-14 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object.5.2.2.

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

ptr_to_nonzero_object.6:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} floating_point?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} reference?(typ(typ′))
{3} void?(typ(typ′))
{4} function?(typ(typ′))
{5} array?(typ(typ′))
{6} class?(typ(typ′))
{7} union?(typ(typ′))
{8} pointer?(typ(typ′))
{9} pointer_to_member?(typ(typ′))
{10} bitfield?(typ(typ′))
{11} bool?(typ(typ′))
{12} const?(typ(typ′))
{13} size(uidt(dt_cv_float(typ(typ′)))) > 0
{14} volatile?(typ(typ′))

Expanding the definition of dt_cv_float, Adding type constraints for dt_floating_point(typ(typ!1)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of ptr_to_nonzero_object.6.

ptr_to_nonzero_object.7:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} floating_point?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} bool?(typ(typ(typ′)))
{3} pointer?(typ(typ(typ′)))
{4} pointer_to_member?(typ(typ(typ′)))
{5} bitfield?(typ(typ(typ′)))
{6} size(uidt(dt_cv_float(typ(typ′)))) > 0

Expanding the definition of dt_cv_float, Rewriting using dt_volatile_size, matching in *, we get 2 subgoals:

ptr_to_nonzero_object.7.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} floating_point?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} bool?(typ(typ(typ′)))
{3} pointer?(typ(typ(typ′)))
{4} pointer_to_member?(typ(typ(typ′)))
{5} bitfield?(typ(typ(typ′)))
{6} size(uidt(dt_cv_float(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_float, Adding type constraints for dt_floating_point(typ(typ(typ!1))), Expanding the definition of floating_point?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.7.1.

ptr_to_nonzero_object.7.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} floating_point?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))

{1} ∃ (x_{1}:

(interpreted_data_type?

[((range_floating_point(cv_base(typ(typ(typ′))))))])):

true

{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ′)))
{4} pointer?(typ(typ(typ′)))
{5} pointer_to_member?(typ(typ(typ′)))
{6} bitfield?(typ(typ(typ′)))
{7} size(uidt(dt_volatile(dt_cv_float(typ(typ(typ′)))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_floating_point(cv_base(typ(typ(typ!1))))), we get 2 subgoals:

ptr_to_nonzero_object.7.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} floating_point?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ′)))
{4} pointer?(typ(typ(typ′)))
{5} pointer_to_member?(typ(typ(typ′)))
{6} bitfield?(typ(typ(typ′)))
{7} size(uidt(dt_volatile(dt_cv_float(typ(typ(typ′)))))) > 0

which is trivially true.

This completes the proof of ptr_to_nonzero_object.7.2.1.
ptr_to_nonzero_object.7.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} floating_point?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} floating_point?(cv_base(typ(typ(typ′))))
{2} cv(bitfield?)(typ(typ′))
{3} bool?(typ(typ(typ′)))
{4} pointer?(typ(typ(typ′)))
{5} pointer_to_member?(typ(typ(typ′)))
{6} bitfield?(typ(typ(typ′)))
{7} size(uidt(dt_volatile(dt_cv_float(typ(typ(typ′)))))) > 0

Keeping (-13 1) and hiding *, Expanding the definition of cv_base, Expanding the definition of floating_point?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.7.2.2.
ptr_to_nonzero_object.8:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} bitfield?(typ(typ(typ′)))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_bitfield(typ(typ′)))) > 0

Expanding the definition of cv, Expanding the definition of c, which is trivially true. This completes the proof of ptr_to_nonzero_object.8.

ptr_to_nonzero_object.9:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} bitfield?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_bitfield(typ(typ′)))) > 0

Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, which is trivially true. This completes the proof of ptr_to_nonzero_object.9.

ptr_to_nonzero_object.10:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer_to_member?(typ(typ(typ′)))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_ptm(typ(typ′)))) > 0

Expanding the definition of dt_cv_ptm, Rewriting using dt_const_size, matching in *, we get 2 subgoals:

C Proof scripts

ptr_to_nonzero_object.10.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer_to_member?(typ(typ(typ′)))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_ptm(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_ptm, Adding type constraints for dt_ptm(typ(typ(typ!1))), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.10.1.
ptr_to_nonzero_object.10.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer_to_member?(typ(typ(typ′)))
{1} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(typ(typ(typ′))))))])): true
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_const(dt_cv_ptm(typ(typ(typ′)))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_ptm(cv_base(typ(typ(typ!1))))), we get 2 subgoals:

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

ptr_to_nonzero_object.10.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer_to_member?(typ(typ(typ′)))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_const(dt_cv_ptm(typ(typ(typ′)))))) > 0

which is trivially true.

This completes the proof of ptr_to_nonzero_object.10.2.1.
ptr_to_nonzero_object.10.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer_to_member?(typ(typ(typ′)))
{1} pointer_to_member?(cv_base(typ(typ(typ′))))
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_const(dt_cv_ptm(typ(typ(typ′)))))) > 0

Keeping (-14 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object.10.2.2.

C Proof scripts

ptr_to_nonzero_object.11:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer_to_member?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_ptm(typ(typ′)))) > 0

Expanding the definition of dt_cv_ptm, Rewriting using dt_volatile_size, matching in *, we get 2 subgoals:

ptr_to_nonzero_object.11.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer_to_member?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_ptm(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_ptm, Adding type constraints for dt_ptm(typ(typ(typ!1))), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.11.1.

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

ptr_to_nonzero_object.11.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer_to_member?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(typ(typ(typ′))))))])): true
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_ptm(typ(typ(typ′)))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_ptm(cv_base(typ(typ(typ!1))))), we get 2 subgoals:

ptr_to_nonzero_object.11.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer_to_member?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_ptm(typ(typ(typ′)))))) > 0

which is trivially true.

This completes the proof of ptr_to_nonzero_object.11.2.1.

C Proof scripts

ptr_to_nonzero_object.11.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer_to_member?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} pointer_to_member?(cv_base(typ(typ(typ′))))
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_ptm(typ(typ(typ′)))))) > 0

Keeping (-13 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object.11.2.2.
ptr_to_nonzero_object.12:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer?(typ(typ(typ′)))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_pointer(typ(typ′)))) > 0

Expanding the definition of dt_cv_pointer, Rewriting using dt_const_size, matching in *, we get 2 subgoals:

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

ptr_to_nonzero_object.12.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer?(typ(typ(typ′)))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_pointer(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_pointer, Adding type constraints for dt_pointer(typ(typ(typ!1))), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.12.1.
ptr_to_nonzero_object.12.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer?(typ(typ(typ′)))

{1} ∃ (x_{1}: (interpreted_data_type?[((range_pointer(cv_base(typ(typ(typ′))))))])):

true

{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_const(dt_cv_pointer(typ(typ(typ′)))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_pointer(cv_base(typ(typ(typ!1))))), we get 2 subgoals:

C Proof scripts

ptr_to_nonzero_object.12.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer?(typ(typ(typ′)))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_const(dt_cv_pointer(typ(typ(typ′)))))) > 0

which is trivially true.

This completes the proof of ptr_to_nonzero_object.12.2.1.
ptr_to_nonzero_object.12.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} const?(typ(typ′))
{-14} pointer?(typ(typ(typ′)))
{1} pointer?(cv_base(typ(typ(typ′))))
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_const(dt_cv_pointer(typ(typ(typ′)))))) > 0

Keeping (-14 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object.12.2.2.

C.11 Proofs for ArithmeticExpressions (expressions.pvs)

ptr_to_nonzero_object.13:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_pointer(typ(typ′)))) > 0

Expanding the definition of dt_cv_pointer, Rewriting using dt_volatile_size, matching in *, we get 2 subgoals:

ptr_to_nonzero_object.13.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} cv(bitfield?)(typ(typ′))
{2} size(uidt(dt_cv_pointer(typ(typ(typ′))))) > 0

Expanding the definition of dt_cv_pointer, Adding type constraints for dt_pointer(typ(typ(typ!1))), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of ptr_to_nonzero_object.13.1.

C Proof scripts

ptr_to_nonzero_object.13.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))

{1} ∃ (x_{1}: (interpreted_data_type?[((range_pointer(cv_base(typ(typ(typ′))))))])):

true

{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_pointer(typ(typ(typ′)))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt_pointer(cv_base(typ(typ(typ!1))))), we get 2 subgoals:

ptr_to_nonzero_object.13.2.1:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} true
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_pointer(typ(typ(typ′)))))) > 0

which is trivially true.

This completes the proof of ptr_to_nonzero_object.13.2.1.

ptr_to_nonzero_object.13.2.2:

{-1} no_cv_references?(typ′)
{-2} cv_array?(typ′)
{-3} enum_underlying_integral?(typ′)
{-4} enum_constants?(typ′)
{-5} const_volatile?(typ′)
{-6} const_stutter?(typ′)
{-7} volatile_stutter?(typ′)
{-8} no_cv_class?(typ′)
{-9} no_cv_union?(typ′)
{-10} no_cv_function?(typ′)
{-11} no_cv_void?(typ′)
{-12} pointer?(typ′)
{-13} pointer?(typ(typ(typ′)))
{-14} volatile?(typ(typ′))
{1} pointer?(cv_base(typ(typ(typ′))))
{2} cv(bitfield?)(typ(typ′))
{3} size(uidt(dt_volatile(dt_cv_pointer(typ(typ(typ′)))))) > 0

Keeping (-13 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of ptr_to_nonzero_object.13.2.2.

Q.E.D.

C.11.21 ArithmeticExpressions.minus_ptr_typ_is_Cpp_Type_TCC1

Terse proof for minus_ptr_typ_is_Cpp_Type_TCC1.
minus_ptr_typ_is_Cpp_Type_TCC1:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p)))))):

array?(cv_base(typ)) ∨ pointer?(cv_base(typ)) ∨ reference?(cv_base(typ)) ∨ bitfield?(cv_base(typ)) ∨ enum?(cv_base(typ)) ∨ pointer_to_member?(cv_base(typ)) ∨ const?(cv_base(typ)) ∨ volatile?(cv_base(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of minus_ptr_typ_is_Cpp_Type_TCC1.

Q.E.D.

C.11.22 ArithmeticExpressions.minus_ptr_typ_is_Cpp_Type

Terse proof for minus_ptr_typ_is_Cpp_Type.

C Proof scripts

minus_ptr_typ_is_Cpp_Type:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p)))))):

Cpp_Type?(typ(cv_base(typ)))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (t!1), Splitting conjunctions, we get 2 subgoals:

minus_ptr_typ_is_Cpp_Type.1:

{-1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

{-2} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{-3} subterm(t′, typ(cv_base(typ′)))

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

617

which is trivially true.

This completes the proof of minus_ptr_typ_is_Cpp_Type.1.
minus_ptr_typ_is_Cpp_Type.2:

{-1} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{-2} subterm(t′, typ(cv_base(typ′)))
{1} subterm(t′, typ′)

{2} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Hiding formulas: 2,

Using lemma subterm_cv_base,

Using lemma subterm_transitive,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-2 -3 1 2) and hiding *,

Using lemma cv_base_result,

we get 2 subgoals:

minus_ptr_typ_is_Cpp_Type.2.1:

{-1} extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p))) (cv_base(typ′))

{-2} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{-3} subterm(t′, typ(cv_base(typ′)))
{1} subterm(t′, cv_base(typ′))
{2} subterm(t′, typ′)

Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of subterm, which is trivially true.

This completes the proof of minus_ptr_typ_is_Cpp_Type.2.1.
minus_ptr_typ_is_Cpp_Type.2.2:

{-1} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{-2} subterm(t′, typ(cv_base(typ′)))
{1} (extend [Cpp_Type_, (pointer?), bool, false](λ (p : (pointer?)) : ¬ void?(typ(p)) ∧ ¬ function?(typ(p))) ⊆ interpreted?)
{2} subterm(t′, cv_base(typ′))
{3} subterm(t′, typ′)

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of minus_ptr_typ_is_Cpp_Type.2.2.

Q.E.D.

C.11.23 ArithmeticExpressions.minus_ptr_ptr_TCC1

Terse proof for minus_ptr_ptr_TCC1.
minus_ptr_ptr_TCC1:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))),

ptr_val1: (range_pointer(cv_base(typ))), ptr_val2: (range_pointer(cv_base(typ)))):

array?(typ(cv_base(typ))) ⊃ Cpp_Type?(typ(cv_base(typ)))

Repeatedly Skolemizing and flattening, Using lemma minus_ptr_typ_is_Cpp_Type, This completes the proof of minus_ptr_ptr_TCC1. Q.E.D.

C.11.24 ArithmeticExpressions.minus_ptr_ptr_TCC2

Terse proof for minus_ptr_ptr_TCC2.

minus_ptr_ptr_TCC2:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))),

ptr_val1: (range_pointer(cv_base(typ))), ptr_val2: (range_pointer(cv_base(typ)))):

(array?(typ(cv_base(typ))) ⊃ size_of(typ(cv_base(typ))) > 0) ⊃ cv(pointer?)(typ)

Repeatedly Skolemizing and flattening,

Keeping (-2 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of minus_ptr_ptr_TCC2.

Q.E.D.

C.11.25 ArithmeticExpressions.minus_ptr_ptr_TCC3

Terse proof for minus_ptr_ptr_TCC3.
minus_ptr_ptr_TCC3:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))),

ptr_val1: (range_pointer(cv_base(typ))), ptr_val2: (range_pointer(cv_base(typ)))):

(array?(typ(cv_base(typ))) ⊃ size_of(typ(cv_base(typ))) > 0) ∧ not_null?(typ)(ptr_val1) ∧ not_null?(typ)(ptr_val2) ∧ same_array(typ)(ptr_val1, ptr_val2) ∧ up?(address_of(typ)(ptr_val1)) ∧ up?(address_of(typ)(ptr_val2))

⊃ Cpp_Type?(typ(cv_base(typ)))

Repeatedly Skolemizing and flattening,

Using lemma minus_ptr_typ_is_Cpp_Type,

This completes the proof of minus_ptr_ptr_TCC3.

Q.E.D.

C.11.26 ArithmeticExpressions.minus_ptr_ptr_TCC4

Terse proof for minus_ptr_ptr_TCC4.

minus_ptr_ptr_TCC4:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))),

ptr_val1: (range_pointer(cv_base(typ))), ptr_val2: (range_pointer(cv_base(typ)))):

(array?(typ(cv_base(typ))) ⊃ size_of(typ(cv_base(typ))) > 0) ∧ not_null?(typ)(ptr_val1) ∧ not_null?(typ)(ptr_val2) ∧ same_array(typ)(ptr_val1, ptr_val2) ∧ up?(address_of(typ)(ptr_val1)) ∧ up?(address_of(typ)(ptr_val2))

⊃ size_of(typ(cv_base(typ))) > 0

Repeatedly Skolemizing and flattening,

Using lemma ptr_to_nonzero_object,

we get 2 subgoals:

minus_ptr_ptr_TCC4.1:

{-1} (array?(typ(cv_base(cv_base(typ′)))) ⊃

size_of(typ(cv_base(cv_base(typ′)))) > 0) ⊃ size_of(typ(cv_base(cv_base(typ′)))) > 0

{-2} Cpp_Type?(typ′)

{-3} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{-4} range_pointer(cv_base(typ′))(ptr_val1′)
{-5} range_pointer(cv_base(typ′))(ptr_val2′)
{-6} (array?(typ(cv_base(typ′))) ⊃ size_of(typ(cv_base(typ′))) > 0)
{-7} not_null?(typ′)(ptr_val1′)
{-8} not_null?(typ′)(ptr_val2′)
{-9} same_array(typ′)(ptr_val1′, ptr_val2′)
{-10} up?(address_of(typ′)(ptr_val1′))
{-11} up?(address_of(typ′)(ptr_val2′))
{1} size_of(typ(cv_base(typ′))) > 0

Expanding the definition of cv_base,

Using lemma cv_base_not_const,

Using lemma cv_base_not_volatile,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of cv_base,

which is trivially true.

This completes the proof of minus_ptr_ptr_TCC4.1.

minus_ptr_ptr_TCC4.2:

{-1} Cpp_Type?(typ′)

{-2} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{-3} range_pointer(cv_base(typ′))(ptr_val1′)
{-4} range_pointer(cv_base(typ′))(ptr_val2′)
{-5} (array?(typ(cv_base(typ′))) ⊃ size_of(typ(cv_base(typ′))) > 0)
{-6} not_null?(typ′)(ptr_val1′)
{-7} not_null?(typ′)(ptr_val2′)
{-8} same_array(typ′)(ptr_val1′, ptr_val2′)
{-9} up?(address_of(typ′)(ptr_val1′))
{-10} up?(address_of(typ′)(ptr_val2′))

{1} extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p))) (cv_base(typ′))

{2} size_of(typ(cv_base(typ′))) > 0

Keeping (-2 1) and hiding *, Using lemma cv_base_result, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC4.2. Q.E.D.

C.11.27 ArithmeticExpressions.minus_ptr_ptr_TCC5

Terse proof for minus_ptr_ptr_TCC5.
minus_ptr_ptr_TCC5:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))),

ptr_val1: (range_pointer(cv_base(typ))), ptr_val2: (range_pointer(cv_base(typ)))):

(array?(typ(cv_base(typ))) ⊃ size_of(typ(cv_base(typ))) > 0) ∧ not_null?(typ)(ptr_val1) ∧ not_null?(typ)(ptr_val2) ∧ same_array(typ)(ptr_val1, ptr_val2) ∧ up?(address_of(typ)(ptr_val1)) ∧ up?(address_of(typ)(ptr_val2))

⊃

(∀ (difference:

{q: int | offset(down [Memory_Address](address_of(typ)(ptr_val1))) − offset(down [Memory_Address](address_of(typ)(ptr_val2))) = rem(size_of(typ(cv_base(typ))))(offset(down [Memory_Address](address_of(typ)(ptr_val1))) − offset(down [Memory_Address](address_of(typ)(ptr_val2)))) + size_of(typ(cv_base(typ))) × q}):

difference =

ndiv(offset(down(address_of(typ)(ptr_val1))) − offset(down(address_of(typ)(ptr_val2))),

size_of(typ(cv_base(typ)))) ⊃ Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int))

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Applying propositional simplification, we get 2 subgoals:

minus_ptr_ptr_TCC5.1:

{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of minus_ptr_ptr_TCC5.1.

minus_ptr_ptr_TCC5.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC5.2. Q.E.D.

C.11.28 ArithmeticExpressions.minus_ptr_ptr_TCC6

Terse proof for minus_ptr_ptr_TCC6.
minus_ptr_ptr_TCC6:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))),

ptr_val1: (range_pointer(cv_base(typ))), ptr_val2: (range_pointer(cv_base(typ)))):

¬ ((array?(typ(cv_base(typ))) ⊃ size_of(typ(cv_base(typ))) > 0) ∧ not_null?(typ)(ptr_val1) ∧ not_null?(typ)(ptr_val2) ∧ same_array(typ)(ptr_val1, ptr_val2) ∧ up?(address_of(typ)(ptr_val1)) ∧ up?(address_of(typ)(ptr_val2)))

⊃ Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Keeping (2) and hiding *, Applying propositional simplification, we get 2 subgoals:

minus_ptr_ptr_TCC6.1:

{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of minus_ptr_ptr_TCC6.1.

minus_ptr_ptr_TCC6.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC6.2. Q.E.D.

C.11.29 ArithmeticExpressions.minus_ptr_ptr_TCC7

Terse proof for minus_ptr_ptr_TCC7.
minus_ptr_ptr_TCC7:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))),

ptr_val1: (range_pointer(cv_base(typ)))): pointer?(cv_base(typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

minus_ptr_ptr_TCC7.1:

{-1} Cpp_Type?(typ′)

{-2} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{-3} range_pointer(cv_base(typ′))(ptr_val1′)
{1} cv(pointer?)(typ′)
{2} pointer?(cv_base(typ′))

Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC7.1.

minus_ptr_ptr_TCC7.2:

{-1} Cpp_Type?(typ′)

{-2} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{-3} range_pointer(cv_base(typ′))(ptr_val1′)
{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(typ′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC7.2. Q.E.D.

C.11.30 ArithmeticExpressions.minus_ptr_ptr_TCC8

Terse proof for minus_ptr_ptr_TCC8.
minus_ptr_ptr_TCC8:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p))))),

ptr_val1: (range_pointer(cv_base(typ)))): Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Applying propositional simplification, we get 2 subgoals:

minus_ptr_ptr_TCC8.1:

{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of minus_ptr_ptr_TCC8.1.

minus_ptr_ptr_TCC8.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC8.2. Q.E.D.

C.11.31 ArithmeticExpressions.minus_ptr_ptr_TCC9

Terse proof for minus_ptr_ptr_TCC9.
minus_ptr_ptr_TCC9:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p)))))):

pointer?(cv_base(typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

minus_ptr_ptr_TCC9.1:

{-1} Cpp_Type?(typ′)

{-2} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{1} cv(pointer?)(typ′)
{2} pointer?(cv_base(typ′))

Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC9.1.

minus_ptr_ptr_TCC9.2:

{-1} Cpp_Type?(typ′)

{-2} cv(extend[Cpp_Type_, (pointer?), bool, false]

(λ (p: (pointer?)): ¬ void?(typ(p)) ∧ ¬ function?(typ(p)))) (typ′)

{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(typ′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC9.2. Q.E.D.

C.11.32 ArithmeticExpressions.minus_ptr_ptr_TCC10

Terse proof for minus_ptr_ptr_TCC10.
minus_ptr_ptr_TCC10:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, (pointer?), bool, false] (λ (p: (pointer?)):

¬ void?(typ(p)) ∧ ¬ function?(typ(p)))))):

Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Applying propositional simplification, we get 2 subgoals:

minus_ptr_ptr_TCC10.1:

{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of minus_ptr_ptr_TCC10.1.

minus_ptr_ptr_TCC10.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of minus_ptr_ptr_TCC10.2. Q.E.D.

C.11.33 ArithmeticExpressions.cmp_pointer_TCC1

Terse proof for cmp_pointer_TCC1.
cmp_pointer_TCC1:

{1} ∀ (p_typ: Cpp_Subtype(cv(pointer?)), ptr_val1: (range_pointer(cv_base(p_typ)))): pointer?(cv_base(p_typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cmp_pointer_TCC1. Q.E.D.

C.11.34 ArithmeticExpressions.cmp_pointer_TCC2

Terse proof for cmp_pointer_TCC2.
cmp_pointer_TCC2:

{1} ∀ (p_typ: Cpp_Subtype(cv(pointer?))): pointer?(cv_base(p_typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cmp_pointer_TCC2. Q.E.D.

C.12 Proofs for AssemblerStatements (statements.pvs)

This theory contains no provable formal statements.

C.13 Proofs for AssignmentExpressions (expressions.pvs)

C.13.1 AssignmentExpressions.assign_times_TCC1

Terse proof for assign_times_TCC1.
assign_times_TCC1:

{1} ∀ (i_typ: Cpp_Subtype(v(non_bool_integral_enum?))): cv(non_bool_integral_enum?)(i_typ)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of assign_times_TCC1. Q.E.D.

C.13.2 AssignmentExpressions.assign_plus_ptr_TCC1

Terse proof for assign_plus_ptr_TCC1.
assign_plus_ptr_TCC1:

{1} ∀ (p_typ: Cpp_Subtype(v(pointer?)), ci_typ: Cpp_Subtype(cv(non_bool_integral_enum?))): cv(pointer?)(p_typ)

Repeatedly Skolemizing and flattening, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of assign_plus_ptr_TCC1. Q.E.D.

C.13.3 AssignmentExpressions.assign_plus_ptr_TCC2

Terse proof for assign_plus_ptr_TCC2.
assign_plus_ptr_TCC2:

{1} ∀ (p_typ: Cpp_Subtype(v(pointer?)), ci_typ: Cpp_Subtype(cv(non_bool_integral_enum?))): pointer?(cv_base(p_typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *,

C.14 Proofs for AssignmentExpressions2 (expressions.pvs)

we get 2 subgoals:

assign_plus_ptr_TCC2.1:

{-1} Cpp_Type?(p_typ′)
{-2} v(pointer?)(p_typ′)
{-3} Cpp_Type?(ci_typ′)
{-4} cv(non_bool_integral_enum?)(ci_typ′)
{1} cv(pointer?)(p_typ′)
{2} pointer?(cv_base(p_typ′))

Using lemma assign_plus_ptr_TCC1, This completes the proof of assign_plus_ptr_TCC2.1.

assign_plus_ptr_TCC2.2:

{-1} Cpp_Type?(p_typ′)
{-2} v(pointer?)(p_typ′)
{-3} Cpp_Type?(ci_typ′)
{-4} cv(non_bool_integral_enum?)(ci_typ′)
{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(p_typ′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of assign_plus_ptr_TCC2.2. Q.E.D.

C.14 Proofs for AssignmentExpressions2 (expressions.pvs)

This theory contains no provable formal statements.

C.15 Proofs for Bitlist_ops (bits.pvs)

C.15.1 Bitlist_ops.binary_not_TCC1

Terse proof for binary_not_TCC1.
binary_not_TCC1:

{1} (∀ (x: nat): x < expt(2, bits_per_byte) ≡ x < max_byte) ∧ (∀ (x_{1}: below[expt(2, bits_per_byte)]): binary_not[bits_per_byte](x_{1}) < max_byte)

Expanding the definition of max_byte, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_not_TCC1. Q.E.D.

C.15.2 Bitlist_ops.binary_and_TCC1

Terse proof for binary_and_TCC1.

binary_and_TCC1:

{1} (∀ (x: nat): x < expt(2, bits_per_byte) ≡ x < max_byte) ∧

(∀ (x_{1}: [below[expt(2, bits_per_byte)], below[expt(2, bits_per_byte)]]): binary_and[bits_per_byte](x_{1}) < max_byte)

Expanding the definition of max_byte, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_and_TCC1. Q.E.D.

C.15.3 Bitlist_ops.binary_or_TCC1

Terse proof for binary_or_TCC1.
binary_or_TCC1:

{1} (∀ (x: nat): x < expt(2, bits_per_byte) ≡ x < max_byte) ∧

(∀ (x_{1}: [below[expt(2, bits_per_byte)], below[expt(2, bits_per_byte)]]): binary_or[bits_per_byte](x_{1}) < max_byte)

Expanding the definition of max_byte, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_or_TCC1. Q.E.D.

C.15.4 Bitlist_ops.binary_xor_TCC1

Terse proof for binary_xor_TCC1.
binary_xor_TCC1:

{1} (∀ (x: nat): x < expt(2, bits_per_byte) ≡ x < max_byte) ∧

(∀ (x_{1}: [below[expt(2, bits_per_byte)], below[expt(2, bits_per_byte)]]): binary_xor[bits_per_byte](x_{1}) < max_byte)

Expanding the definition of max_byte, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_xor_TCC1. Q.E.D.

C.15.5 Bitlist_ops.singleton_zero_mask

Terse proof for singleton_zero_mask.
singleton_zero_mask:

{1} ∀ (s: nat): singleton?(zero_mask?(s))

Inducting on s on formula 1, we get 2 subgoals:

C.15 Proofs for Bitlist_ops (bits.pvs)

singleton_zero_mask.1:

{1} singleton?(zero_mask?(0))

Expanding the definition of zero_mask?, Expanding the definition of length, Expanding the definition of singleton?, Instantiating quantified variables, we get 3 subgoals:

singleton_zero_mask.1.1:

{1} ∀ (y_1:

(λ (l: list[Byte]): cases l of null: 0, cons(x, y): length(y) + 1 endcases = 0 ∧ every(λ (t: Byte): t = 0)(l))):

null = y_1

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of singleton_zero_mask.1.1.

singleton_zero_mask.1.2:

{1} every[Byte](λ (t: Byte): t = 0)(null[Byte])

Expanding the definition of every, which is trivially true. This completes the proof of singleton_zero_mask.1.2.

singleton_zero_mask.1.3:

{1} every[Byte](λ (t: Byte): t = 0)(null[Byte])
{2} ∃ (x_1:

(λ (l: list[Byte]): cases l of null: 0, cons(x, y): length(y) + 1 endcases = 0 ∧ every(λ (t: Byte): t = 0)(l))):

∀ (y_1:

(λ (l: list[Byte]): cases l of null: 0, cons(x, y): length(y) + 1 endcases = 0 ∧ every(λ (t: Byte): t = 0)(l))):

x_1 = y_1

Expanding the definition of every, which is trivially true. This completes the proof of singleton_zero_mask.1.3.

singleton_zero_mask.2:

{1} ∀ j: singleton?(zero_mask?(j)) ⊃ singleton?(zero_mask?(j + 1))

Repeatedly Skolemizing and flattening, Expanding the definition of zero_mask?, Expanding the definition of singleton?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (cons(0, x!1)), we get 3 subgoals:

singleton_zero_mask.2.1:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(x′)

{-2} length(x′) = j′
{-3} every(λ (t: Byte): t = 0)(x′)
{-4} j′ ≥ 0

{-5} ∀ (y:

(λ (l: list[Byte]):

length(l) = j′ ∧ every(λ (t: Byte): t = 0)(l))):

x′ = y

{1} ∀ (y:

(λ (l: list[Byte]):

length(l) = 1 + j′ ∧ every(λ (t: Byte): t = 0)(l))):

cons(0, x′) = y

Repeatedly Skolemizing and flattening,

Case splitting on null?(y!1),

we get 2 subgoals:

singleton_zero_mask.2.1.1:

{-1} null?(y′)

{-2} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(y′)

{-3} length(y′) = 1 + j′
{-4} every(λ (t: Byte): t = 0)(y′)

{-5} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(x′)

{-6} length(x′) = j′
{-7} every(λ (t: Byte): t = 0)(x′)
{-8} j′ ≥ 0

{-9} ∀ (y:

(λ (l: list[Byte]):

length(l) = j′ ∧ every(λ (t: Byte): t = 0)(l))):

x′ = y
{1} cons(0, x′) = y′

Expanding the definition of length,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of singleton_zero_mask.2.1.1.

C.15 Proofs for Bitlist_ops (bits.pvs)

singleton_zero_mask.2.1.2:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(y′)

{-2} length(y′) = 1 + j′
{-3} every(λ (t: Byte): t = 0)(y′)

{-4} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(x′)

{-5} length(x′) = j′
{-6} every(λ (t: Byte): t = 0)(x′)
{-7} j′ ≥ 0

{-8} ∀ (y:

(λ (l: list[Byte]):

length(l) = j′ ∧ every(λ (t: Byte): t = 0)(l))):

x′ = y
{1} null?(y′)
{2} cons(0, x′) = y′

Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -8 with the terms: (cdr(y!1)), we get 2 subgoals:

singleton_zero_mask.2.1.2.1:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(y′)

{-2} length(cdr(y′)) = j′
{-3} every(λ (t: Byte): t = 0)(y′)

{-4} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(x′)

{-5} cases x′ of null: 0, cons(x, y): length(y) + 1 endcases = j′
{-6} every(λ (t: Byte): t = 0)(x′)
{-7} j′ ≥ 0
{-8} x′ = cdr(y′)
{1} null?(y′)
{2} cons(0, x′) = y′

Expanding the definition of every, Replacing using formula -8, Using lemma list_cons_eta, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of singleton_zero_mask.2.1.2.1.

singleton_zero_mask.2.1.2.2:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(y′)

{-2} length(cdr(y′)) = j′
{-3} every(λ (t: Byte): t = 0)(y′)

{-4} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(x′)

{-5} cases x′ of null: 0, cons(x, y): length(y) + 1 endcases = j′
{-6} every(λ (t: Byte): t = 0)(x′)
{-7} j′ ≥ 0
{1} every[Byte](λ (t: Byte): t = 0)(cdr[Byte](y′))
{2} null?(y′)
{3} cons(0, x′) = y′

Expanding the definition of every,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of singleton_zero_mask.2.1.2.2.
singleton_zero_mask.2.2:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(x′)

{-2} length(x′) = j′
{-3} every(λ (t: Byte): t = 0)(x′)
{-4} j′ ≥ 0

{-5} ∀ (y:

(λ (l: list[Byte]):

length(l) = j′ ∧ every(λ (t: Byte): t = 0)(l))):

x′ = y

{1} length[Byte](cons[Byte](0, x′)) = 1 + j′ ∧ every[Byte](λ (t: Byte): t = 0)(cons[Byte](0, x′))

Expanding the definition of length,

Expanding the definition of every,

which is trivially true.

This completes the proof of singleton_zero_mask.2.2.

C.16 Proofs for Bitops (bits.pvs)

singleton_zero_mask.2.3:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(x′)

{-2} length(x′) = j′
{-3} every(λ (t: Byte): t = 0)(x′)
{-4} j′ ≥ 0
{-5} ∀ (y:

(λ (l: list[Byte]):

length(l) = j′ ∧ every(λ (t: Byte): t = 0)(l))):

x′ = y
{1} 0 < max_byte

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of singleton_zero_mask.2.3. Q.E.D.

C.15.6 Bitlist_ops.bit_set?_TCC1

Terse proof for bit_set?_TCC1.

bit_set?_TCC1:

{1} ∀ (n: nat, l: list[Byte]): n < length(l) × max_byte⊃ max_byte > 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of bit_set?_TCC1. Q.E.D.

C.15.7 Bitlist_ops.bit_set?_TCC2

Terse proof for bit_set?_TCC2.

bit_set?_TCC2:

{1} ∀ (n: nat, l: list[Byte]):

n < length(l) × max_byte⊃ ndiv(n, max_byte) < length[Byte](l)

Repeatedly Skolemizing and flattening, Using lemma ndiv_lt, Using lemma both_sides_div_pos_lt1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bit_set?_TCC2. Q.E.D.

C.16 Proofs for Bitops (bits.pvs)

C.16.1 Bitops.bit_set_zero_mask

Terse proof for bit_set_zero_mask.

bit_set_zero_mask:

{1} ∀ (n: nat): ¬ bit_set?(n, 0)

Expanding the definition of bit_set?, Repeatedly Skolemizing and flattening, Rewriting using cut_bit_zero, matching in *, This completes the proof of bit_set_zero_mask. Q.E.D.

C.16.2 Bitops.bit_set_ndiv_expt2

Terse proof for bit_set_ndiv_expt2.
bit_set_ndiv_expt2:

{1} ∀ (n, val, m: nat):

bit_set?(n, ndiv(val, expt(2, m))) = bit_set?(n + m, val)

Repeatedly Skolemizing and flattening, Expanding the definition of bit_set?, Expanding the definition of cut_bit, Using lemma ndiv_times_2, Rewriting using expt_plus_aux, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of bit_set_ndiv_expt2. Q.E.D.

C.16.3 Bitops.bit_set_full_mask_TCC1

Terse proof for bit_set_full_mask_TCC1.
bit_set_full_mask_TCC1:

{1} ∀ (n: nat): n < p ⊃ expt(2, p) − 1 ≥ 0

Repeatedly Skolemizing and flattening, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bit_set_full_mask_TCC1. Q.E.D.

C.16.4 Bitops.bit_set_full_mask

Terse proof for bit_set_full_mask.
bit_set_full_mask:

{1} ∀ (n: nat): n < p ⊃ bit_set?(n, expt(2, p) − 1)

Repeatedly Skolemizing and flattening, Expanding the definition of bit_set?, Expanding the definition of cut_bit, Using lemma ndiv_plus_1, Case splitting on divides(expt(2, n!1), expt(2, p)), we get 2 subgoals:

bit_set_full_mask.1:

{-1} divides(expt(2, n′), expt(2, p))

{-2} divides(expt(2, n′), expt(2, p)) ⊃ ndiv(expt(2, p) + −1, expt(2, n′)) = ndiv(expt(2, p), expt(2, n′)) + ndiv(−1, expt(2, n′))

{-3} n′ ≥ 0
{-4} n′ < p
{1} rem(2)(ndiv(expt(2, p) − 1, expt(2, n′))) = 1

Simplifying, rewriting, and recording with decision procedures, Replacing using formula -2, Rewriting using ndiv_expt_expt, matching in *, Using lemma rem_sum1, Replacing using formula -1, Expanding the definition of expt, Rewriting using rem_multiple1, matching in *, Simplifying, rewriting, and recording with decision procedures, Using lemma rem_def, Using lemma ndiv_plus_2, Rewriting using divides_reflexive, matching in *, Rewriting using ndiv_self, matching in *, Rewriting using ndiv_bigger, matching in *, we get 2 subgoals:

bit_set_full_mask.1.1:

{-1} 0 = ndiv(−1, expt(2, n′)) + 1
{-2} rem(2)(ndiv(−1, expt(2, n′))) = 1 ≡
(∃ q: ndiv(−1, expt(2, n′)) = 2 × q + 1)
{-3} rem(2)(rem(2)(expt(2, p − n′)) + ndiv(−1, expt(2, n′))) =
rem(2)(ndiv(−1, expt(2, n′)) + expt(2, p − n′))
{-4} divides(expt(2, n′), expt(2, p))
{-5} ndiv(expt(2, p) − 1, expt(2, n′)) =
ndiv(−1, expt(2, n′)) + expt(2, p − n′)
{-6} n′ ≥ 0
{-7} n′ < p
{1} rem(2)(ndiv(−1, expt(2, n′))) = 1

Using lemma both_sides_plus1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Instantiating the top quantifier in 2 with the terms: (-1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bit_set_full_mask.1.1.

bit_set_full_mask.1.2:

{-1} ndiv(expt(2, n′) − 1, expt(2, n′)) = 1 + ndiv(−1, expt(2, n′))
{-2} rem(2)(rem(2)(expt(2, p − n′)) + ndiv(−1, expt(2, n′))) =
rem(2)(ndiv(−1, expt(2, n′)) + expt(2, p − n′))
{-3} divides(expt(2, n′), expt(2, p))
{-4} ndiv(expt(2, p) − 1, expt(2, n′)) =
ndiv(−1, expt(2, n′)) + expt(2, p − n′)
{-5} n′ ≥ 0
{-6} n′ < p
{1} expt(2, n′) − 1 ≥ 0
{2} ∃ q: ndiv(−1, expt(2, n′)) = 1 + 2 × q
{3} rem(2)(ndiv(−1, expt(2, n′))) = 1

Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bit_set_full_mask.1.2.

bit_set_full_mask.2:

{-1} divides(expt(2, n′), expt(2, p)) ⊃ ndiv(expt(2, p) + −1, expt(2, n′)) = ndiv(expt(2, p), expt(2, n′)) + ndiv(−1, expt(2, n′))

{-2} n′ ≥ 0
{-3} n′ < p
{1} divides(expt(2, n′), expt(2, p))
{2} rem(2)(ndiv(expt(2, p) − 1, expt(2, n′))) = 1

Hiding formulas: (-1 2), Expanding the definition of divides, Instantiating the top quantifier in 1 with the terms: (expt(2, p - n!1)), we get 2 subgoals:

bit_set_full_mask.2.1:

{-1} n′ ≥ 0
{-2} n′ < p
{1} expt(2, p) = expt(2, n′) × expt(2, p − n′)

Using lemma expt_plus_aux, we get 2 subgoals:

bit_set_full_mask.2.1.1:

{-1} expt(2, n′ + p − n′) = expt(2, n′) × expt(2, p − n′)
{-2} n′ ≥ 0
{-3} n′ < p
{1} expt(2, p) = expt(2, n′) × expt(2, p − n′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bit_set_full_mask.2.1.1.

bit_set_full_mask.2.1.2:

{-1} n′ ≥ 0
{-2} n′ < p
{1} p − n′ ≥ 0
{2} expt(2, p) = expt(2, n′) × expt(2, p − n′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bit_set_full_mask.2.1.2.

bit_set_full_mask.2.2:

\begin{matrix}\{-1\} & n′ ≥ 0 \\ \{-2\} & n′ < p \\ \{1\} & p − n′ ≥ 0 \end{matrix}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bit_set_full_mask.2.2. Q.E.D.

C.16.5 Bitops.bits_equal

Terse proof for bits_equal.

bits_equal:

{1} ∀ (v_{1}, v_{2}, p: nat):

(∀ (n: nat): n < p ⊃ bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ⊃

rem(expt(2, p))(v_{1}) = rem(expt(2, p))(v_{2})

Inducting on p on formula 1, we get 2 subgoals:

bits_equal.1:

{1} ∀ (v_{1}, v_{2}: nat):

(∀ (n: nat): n < 0 ⊃ bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ⊃

rem(expt(2, 0))(v_{1}) = rem(expt(2, 0))(v_{2})

Repeatedly Skolemizing and flattening, Expanding the definition of expt, Rewriting using rem_def, matching in *, Instantiating the top quantifier in 1 with the terms: (v1!1 - rem(1)(v2!1)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal.1.

bits_equal.2:

{1} ∀ j:
(∀ (v_{1}, v_{2}: nat):

(∀ (n: nat): n < j ⊃ bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ⊃

rem(expt(2, j))(v_{1}) = rem(expt(2, j))(v_{2}))
⊃
(∀ (v_{1}, v_{2}: nat):
(∀ (n: nat): n < j + 1 ⊃ bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ⊃
rem(expt(2, j + 1))(v_{1}) = rem(expt(2, j + 1))(v_{2}))

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -4 with the terms: (v1!1 v2!1), Splitting conjunctions, we get 2 subgoals:

bits_equal.2.1:

{-1} rem(expt(2, j′))(v′_{1}) = rem(expt(2, j′))(v′_{2})
{-2} v′_{1} ≥ 0
{-3} v′_{2} ≥ 0
{-4} j′ ≥ 0
{-5} ∀ (n: nat): n < j′ + 1 ⊃ bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} rem(expt(2, j′ + 1))(v′_{1}) = rem(expt(2, j′ + 1))(v′_{2})

Expanding the definition of expt, Expanding the definition of bit_set?, Expanding the definition of cut_bit, Using lemma rem_prod_3, Using lemma rem_prod_3, Replacing using formula -1, Replacing using formula -2, Replacing using formula -3, Instantiating the top quantifier in -7 with the terms: (j!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal.2.1.

bits_equal.2.2:

{-1} v′_{1} ≥ 0
{-2} v′_{2} ≥ 0
{-3} j′ ≥ 0
{-4} ∀ (n: nat): n < j′ + 1 ⊃ bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} ∀ (n: nat): n < j′ ⊃ bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{2} rem(expt(2, j′ + 1))(v′_{1}) = rem(expt(2, j′ + 1))(v′_{2})

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -6 with the terms: (n!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal.2.2. Q.E.D.

C.16.6 Bitops.bits_equal2

Terse proof for bits_equal2.

bits_equal2:

{1} ∀ (v_{1}, v_{2}: below[expt(2, p)]):

(∀ (n: nat): n < p ⊃ bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ≡ v_{1} = v_{2}

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

bits_equal2.1:

{-1} ∀ (n: nat): n < p ⊃ bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{-2} v′_{1} < expt(2, p)
{-3} v′_{2} < expt(2, p)
{1} v′_{1} = v′_{2}

Using lemma bits_equal, Replacing using formula -2, Rewriting using rem_mod, matching in *, Rewriting using rem_mod, matching in *, This completes the proof of bits_equal2.1.

bits_equal2.2:

{-1} v′_{1} = v′_{2}
{-2} v′_{1} < expt(2, p)
{-3} v′_{2} < expt(2, p)
{1} ∀ (n: nat): n < p ⊃ bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal2.2. Q.E.D.

C.16.7 Bitops.bits_equal3

Terse proof for bits_equal3.

bits_equal3:

{1} ∀ (v_{1}, v_{2}: nat): (∀ (n: nat): bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ⊃ v_{1} = v_{2}

Repeatedly Skolemizing and flattening, Applying bits_equal Case splitting on EXISTS (x: posnat): v1!1 < expt(2, x) AND v2!1 < expt(2, x), we get 2 subgoals:

bits_equal3.1:

{-1} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-2} ∀ (v_{1}, v_{2}, p: nat):

(∀ (n: nat): n < p ⊃ bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ⊃

rem(expt(2, p))(v_{1}) = rem(expt(2, p))(v_{2})
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{-5} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} v′_{1} = v′_{2}

Instantiating the top quantifier in -2 with the terms: (v1!1 v2!1 choose({p: posnat | v1!1 < expt(2,

p) AND v2!1 < expt(2, p)})), we get 2 subgoals:

bits_equal3.1.1:

{-1} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)

{-2} (∀ (n: nat):

n < choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)}) ⊃ bit_set?(n, v′_{1}) = bit_set?(n, v′_{2}))

⊃

rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{1}) = rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})

{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{-5} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} v′_{1} = v′_{2}

Splitting conjunctions, we get 2 subgoals:

bits_equal3.1.1.1:

{-1} rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{1}) = rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})

{-2} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{-5} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} v′_{1} = v′_{2}

Using lemma rem_mod, we get 3 subgoals:

bits_equal3.1.1.1.1:

{-1} rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{1})

= v′_{1}

{-2} rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{1}) = rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})

{-3} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-4} v′_{1} ≥ 0
{-5} v′_{2} ≥ 0
{-6} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} v′_{1} = v′_{2}

Replacing using formula -1, Hiding formulas: -1, Using lemma rem_mod, we get 3 subgoals:

bits_equal3.1.1.1.1.1:

{-1} rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})

= v′_{2}

{-2} v′_{1} =

rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})
{-3} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-4} v′_{1} ≥ 0
{-5} v′_{2} ≥ 0
{-6} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} v′_{1} = v′_{2}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.1.1.1.1.1.

bits_equal3.1.1.1.1.2:

{-1} v′_{1} =

rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})
{-2} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{-5} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})

{1} v′_{2} <

expt(2, choose[posnat]({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)}))

{2} v′_{1} = v′_{2}

Expanding the definition of choose, Using lemma epsilon_ax, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.1.1.1.1.2.

bits_equal3.1.1.1.1.3:

{-1} v′_{1} =

rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})
{-2} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{-5} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} nonempty?[posnat]({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})
{2} v′_{1} = v′_{2}

Expanding the definition of nonempty?, Expanding the definition of empty?, Rewriting using forall_not, matching in *, Expanding the definition of member, which is trivially true. This completes the proof of bits_equal3.1.1.1.1.3.

bits_equal3.1.1.1.2:

{-1} rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{1}) = rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})

{-2} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{-5} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} v′_{1} <

expt(2, choose[posnat]({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)}))

{2} v′_{1} = v′_{2}

Expanding the definition of choose, Using lemma epsilon_ax, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.1.1.1.2.

bits_equal3.1.1.1.3:

{-1} rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{1}) = rem(expt(2, choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})))

(v′_{2})

{-2} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{-5} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} nonempty?[posnat]({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})
{2} v′_{1} = v′_{2}

Expanding the definition of nonempty?, Expanding the definition of empty?, Rewriting using forall_not, matching in *, Expanding the definition of member, which is trivially true. This completes the proof of bits_equal3.1.1.1.3.

bits_equal3.1.1.2:

{-1} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-2} v′_{1} ≥ 0
{-3} v′_{2} ≥ 0
{-4} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} ∀ (n: nat):

n < choose({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)}) ⊃ bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})

{2} v′_{1} = v′_{2}

Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of bits_equal3.1.1.2.

bits_equal3.1.2:

{-1} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{-2} v′_{1} ≥ 0
{-3} v′_{2} ≥ 0
{-4} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} nonempty?[posnat]({p: posnat | v′_{1} < expt(2, p) ∧ v′_{2} < expt(2, p)})
{2} v′_{1} = v′_{2}

Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Rewriting using forall_not, matching in *, This completes the proof of bits_equal3.1.2.

bits_equal3.2:

{-1} ∀ (v_{1}, v_{2}, p: nat):

(∀ (n: nat): n < p ⊃ bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ⊃ rem(expt(2, p))(v_{1}) = rem(expt(2, p))(v_{2})

{-2} v′_{1} ≥ 0
{-3} v′_{2} ≥ 0
{-4} ∀ (n: nat): bit_set?(n, v′_{1}) = bit_set?(n, v′_{2})
{1} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{2} v′_{1} = v′_{2}

Using lemma large_expt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Copying formula number: -1 Hiding formulas: (-3 -6), Case splitting on v1!1 /= 0 AND v2!1 /= 0, we get 2 subgoals:

bits_equal3.2.1:

{-1} v′_{1} ≠ 0 ∧ v′_{2} ≠ 0
{-2} ∀ py: ∃ n: py < expt(2, n)
{-3} ∀ py: ∃ n: py < expt(2, n)
{-4} v′_{1} ≥ 0
{-5} v′_{2} ≥ 0
{1} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{2} v′_{1} = v′_{2}

Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -1 with the terms: (v1!1), we get 2 subgoals:

bits_equal3.2.1.1:

{-1} ∃ n: v′_{1} < expt(2, n)
{-2} ∀ py: ∃ n: py < expt(2, n)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{1} v′_{1} = 0
{2} v′_{2} = 0
{3} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{4} v′_{1} = v′_{2}

Instantiating the top quantifier in -2 with the terms: (v2!1), we get 2 subgoals:

bits_equal3.2.1.1.1:

{-1} ∃ n: v′_{1} < expt(2, n)
{-2} ∃ n: v′_{2} < expt(2, n)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{1} v′_{1} = 0
{2} v′_{2} = 0
{3} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{4} v′_{1} = v′_{2}

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 3 with the terms: (n!1 + n!2 + 1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

bits_equal3.2.1.1.1.1:

{-1} n′′ ≥ 0
{-2} n′ ≥ 0
{-3} v′_{1} < expt(2, n′)
{-4} v′_{2} < expt(2, n′′)
{-5} v′_{1} ≥ 0
{-6} v′_{2} ≥ 0
{1} v′_{1} = 0
{2} v′_{2} = 0
{3} v′_{2} < expt(2, 1 + n′ + n′′)
{4} v′_{1} = v′_{2}

Rewriting using expt_plus_aux, matching in *, Using lemma lt_times_lt_pos2, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.2.1.1.1.1.

bits_equal3.2.1.1.1.2:

{-1} n′′ ≥ 0
{-2} n′ ≥ 0
{-3} v′_{1} < expt(2, n′)
{-4} v′_{2} < expt(2, n′′)
{-5} v′_{1} ≥ 0
{-6} v′_{2} ≥ 0
{1} v′_{1} = 0
{2} v′_{2} = 0
{3} v′_{1} < expt(2, 1 + n′ + n′′)
{4} v′_{1} = v′_{2}

Rewriting using expt_plus_aux, matching in * where m gets n!1, n gets 1 + n!2, Using lemma lt_times_lt_pos2, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.2.1.1.1.2.

bits_equal3.2.1.1.2:

{-1} ∃ n: v′_{1} < expt(2, n)
{-2} v′_{1} ≥ 0
{-3} v′_{2} ≥ 0
{1} v′_{2} > 0
{2} v′_{1} = 0
{3} v′_{2} = 0
{4} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{5} v′_{1} = v′_{2}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.2.1.1.2.

bits_equal3.2.1.2:

{-1} ∀ py: ∃ n: py < expt(2, n)
{-2} v′_{1} ≥ 0
{-3} v′_{2} ≥ 0
{1} v′_{1} > 0
{2} v′_{1} = 0
{3} v′_{2} = 0
{4} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{5} v′_{1} = v′_{2}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.2.1.2.

bits_equal3.2.2:

{-1} ∀ py: ∃ n: py < expt(2, n)
{-2} ∀ py: ∃ n: py < expt(2, n)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{1} v′_{1} ≠ 0 ∧ v′_{2} ≠ 0
{2} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{3} v′_{1} = v′_{2}

Expanding the definition of /=, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

bits_equal3.2.2.1:

{-1} (v′_{1} = 0)
{-2} ∀ py: ∃ n: py < expt(2, n)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{1} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{2} v′_{1} = v′_{2}

Replacing using formula -1, Instantiating the top quantifier in -2 with the terms: (v2!1), Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (n!1 + 1), Rewriting using expt_plus_aux, matching in *, Using lemma lt_times_lt_pos2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of expt, Expanding the definition of expt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.2.2.1.

bits_equal3.2.2.2:

{-1} (v′_{2} = 0)
{-2} ∀ py: ∃ n: py < expt(2, n)
{-3} v′_{1} ≥ 0
{-4} v′_{2} ≥ 0
{1} ∃ (x: posnat): v′_{1} < expt(2, x) ∧ v′_{2} < expt(2, x)
{2} v′_{1} = v′_{2}

Replacing using formula -1, Instantiating the top quantifier in -2 with the terms: (v1!1), Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (n!1 + 1), Rewriting using expt_plus_aux, matching in *, Using lemma lt_times_lt_pos2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of expt, Expanding the definition of expt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bits_equal3.2.2.2. Q.E.D.

C.16.8 Bitops.bits_equal4

Terse proof for bits_equal4.

bits_equal4:

{1} ∀ (v_{1}, v_{2}: nat, m: nat):

(∀ (n: nat): n ≥ m ⊃ bit_set?(n, v_{1}) = bit_set?(n, v_{2})) ⊃

ndiv(v_{1}, expt(2, m)) = ndiv(v_{2}, expt(2, m))

Repeatedly Skolemizing and flattening, Using lemma bits_equal3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -5 with the terms: (n!1 + m!1), Simplifying, rewriting, and recording with decision procedures, Rewriting using bit_set_ndiv_expt2, matching in *, Rewriting using bit_set_ndiv_expt2, matching in *, This completes the proof of bits_equal4. Q.E.D.

C.16.9 Bitops.clear_bit_TCC1

Terse proof for clear_bit_TCC1.
clear_bit_TCC1:

{1} ∀ (n: nat, val: nat): bit_set?(n, val) ⊃ val − expt(2, n) ≥ 0

Repeatedly Skolemizing and flattening, Expanding the definition of bit_set?, Expanding the definition of cut_bit, Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Adding type constraints for ndiv(val!1, expt(2, n!1)), Repeatedly Skolemizing and flattening, Replacing using formula -4, Replacing using formula -2, Simplifying, rewriting, and recording with decision procedures, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of clear_bit_TCC1. Q.E.D.

C.16.10 Bitops.change_bit_single_bit_op

Terse proof for change_bit_single_bit_op.
change_bit_single_bit_op:

{1} ∀ (n, m, v: nat, c: [nat → bool]):

n ≠ m ⊃ bit_set?(n, v) = bit_set?(n, change_bit(v, c)(m))

Installing automatic rewrites from: change_bit set_bit clear_bit bit_set? cut_bit Repeatedly Skolemizing and flattening, Expanding the definition of change_bit, Expanding the definition of clear_bit, Expanding the definition of set_bit, Simplifying, rewriting, and recording with decision procedures, Case splitting on rem(2)(ndiv(v!1, expt(2, m!1))) = 1, we get 2 subgoals:

change_bit_single_bit_op.1:

{-1} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} n′ = m′
{2} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)

(ndiv(if c′(m′)

then if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ else expt(2, m′) + v′ endif

else if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ − expt(2, m′) else v′ endif

endif,

expt(2, n′)))

= 1)

Case splitting on c!1(m!1), we get 2 subgoals:

change_bit_single_bit_op.1.1:

{-1} c′(m′)
{-2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} n′ = m′
{2} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)

(ndiv(if c′(m′)

then if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ else expt(2, m′) + v′ endif

else if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ − expt(2, m′) else v′ endif

endif,

expt(2, n′)))

= 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.1.1.
change_bit_single_bit_op.1.2:

{-1} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} c′(m′)
{2} n′ = m′
{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)

(ndiv(if c′(m′)

then if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ else expt(2, m′) + v′ endif

else if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ − expt(2, m′) else v′ endif

endif,

expt(2, n′)))

= 1)

Simplifying, rewriting, and recording with decision procedures, Case splitting on v!1 - expt(2, m!1) >= 0, we get 2 subgoals:

change_bit_single_bit_op.1.2.1:

{-1} v′ − expt(2, m′) ≥ 0
{-2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} c′(m′)
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Case splitting on n!1 > m!1, we get 2 subgoals:

change_bit_single_bit_op.1.2.1.1:

{-1} n′ > m′
{-2} v′ − expt(2, m′) ≥ 0
{-3} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-4} n′ ≥ 0
{-5} m′ ≥ 0
{-6} v′ ≥ 0
{1} c′(m′)
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Rewriting using rem_def, matching in *, Repeatedly Skolemizing and flattening, Using lemma ndiv_times_2, we get 2 subgoals:

change_bit_single_bit_op.1.2.1.1.1:

{-1} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} integer_pred(q′)
{-3} n′ > m′
{-4} v′ − expt(2, m′) ≥ 0
{-5} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-6} n′ ≥ 0
{-7} m′ ≥ 0
{-8} v′ ≥ 0
{1} c′(m′)
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Using lemma ndiv_times_2, we get 2 subgoals:

change_bit_single_bit_op.1.2.1.1.1.1:

{-1} ndiv(v′ − expt(2, m′), expt(2, m′) × 2 × expt(2, n′ − m′ − 1))

=

ndiv(ndiv(v′ − expt(2, m′), expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-3} integer_pred(q′)
{-4} n′ > m′
{-5} v′ − expt(2, m′) ≥ 0
{-6} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-7} n′ ≥ 0
{-8} m′ ≥ 0
{-9} v′ ≥ 0
{1} c′(m′)
{2} n′ = m′
{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Case splitting on expt(2, m!1) * (2 * expt(2, n!1 - m!1 - 1)) = expt(2, n!1), we get 3 subgoals:

change_bit_single_bit_op.1.2.1.1.1.1.1:

{-1} expt(2, m′) × (2 × expt(2, n′ − m′ − 1)) = expt(2, n′)
{-2} ndiv(v′ − expt(2, m′), expt(2, m′) × 2 × expt(2, n′ − m′ − 1))

=

ndiv(ndiv(v′ − expt(2, m′), expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-3} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-4} integer_pred(q′)
{-5} n′ > m′
{-6} v′ − expt(2, m′) ≥ 0
{-7} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-8} n′ ≥ 0
{-9} m′ ≥ 0
{-10} v′ ≥ 0
{1} c′(m′)
{2} n′ = m′
{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Replacing using formula -1, Replacing using formula -2, Replacing using formula -3, Using lemma ndiv_minus_2, Rewriting using divides_reflexive, matching in *, Rewriting using ndiv_self, matching in *, Replacing using formula -1, Replacing using formula -8, Simplifying, rewriting, and recording with decision procedures, Rewriting using ndiv_times_2, matching in * where b gets 2, c gets expt(2, -1 - m!1 + n!1), Rewriting using ndiv_times_2, matching in * where b gets 2, c gets expt(2, -1 - m!1 + n!1), Using lemma ndiv_plus_mod, Splitting conjunctions, we get 2 subgoals:

change_bit_single_bit_op.1.2.1.1.1.1.1.1:

{-1} ndiv(2 × q′ + 1, 2) = ndiv(2 × q′, 2)
{-2} ndiv(v′ − expt(2, m′), expt(2, m′)) = 2 × q′
{-3} 2 × expt(2, −1 − m′ + n′) × expt(2, m′) = expt(2, n′)

{-4} ndiv(v′ − expt(2, m′), expt(2, n′)) =

ndiv(ndiv(2 × q′, 2), expt(2, −1 − m′ + n′)) {-5} ndiv(v′, expt(2, n′)) =

ndiv(ndiv(1 + 2 × q′, 2), expt(2, −1 − m′ + n′))

{-6} integer_pred(q′)
{-7} n′ > m′
{-8} v′ − expt(2, m′) ≥ 0
{-9} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-10} n′ ≥ 0
{-11} m′ ≥ 0
{-12} v′ ≥ 0
{1} c′(m′)
{2} n′ = m′

{3} rem(2)(ndiv(ndiv(1 + 2 × q′, 2), expt(2, −1 − m′ + n′))) = 1 = (rem(2)(ndiv(ndiv(2 × q′, 2), expt(2, −1 − m′ + n′))) = 1)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.1.2.1.1.1.1.1.1.
change_bit_single_bit_op.1.2.1.1.1.1.1.2:

{-1} ndiv(v′ − expt(2, m′), expt(2, m′)) = 2 × q′
{-2} 2 × expt(2, −1 − m′ + n′) × expt(2, m′) = expt(2, n′)

{-3} ndiv(v′ − expt(2, m′), expt(2, n′)) =

ndiv(ndiv(2 × q′, 2), expt(2, −1 − m′ + n′)) {-4} ndiv(v′, expt(2, n′)) =

ndiv(ndiv(1 + 2 × q′, 2), expt(2, −1 − m′ + n′))

{-5} integer_pred(q′)
{-6} n′ > m′
{-7} v′ − expt(2, m′) ≥ 0
{-8} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-9} n′ ≥ 0
{-10} m′ ≥ 0
{-11} v′ ≥ 0
{1} divides(2, 2 × q′)
{2} c′(m′)
{3} n′ = m′

{4} rem(2)(ndiv(ndiv(1 + 2 × q′, 2), expt(2, −1 − m′ + n′))) = 1 = (rem(2)(ndiv(ndiv(2 × q′, 2), expt(2, −1 − m′ + n′))) = 1)

Expanding the definition of divides, Instantiating quantified variables,

This completes the proof of change_bit_single_bit_op.1.2.1.1.1.1.1.2.

change_bit_single_bit_op.1.2.1.1.1.1.2:

{-1} ndiv(v′ − expt(2, m′), expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) = ndiv(ndiv(v′ − expt(2, m′), expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-3} integer_pred(q′)
{-4} n′ > m′
{-5} v′ − expt(2, m′) ≥ 0
{-6} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-7} n′ ≥ 0
{-8} m′ ≥ 0
{-9} v′ ≥ 0
{1} expt(2, m′) × (2 × expt(2, n′ − m′ − 1)) = expt(2, n′)
{2} c′(m′)
{3} n′ = m′

{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Keeping (-4 1) and hiding *, Expanding the definition of expt, Simplifying, rewriting, and recording with decision procedures, Using lemma expt_plus_aux, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.1.2.1.1.1.1.2.
change_bit_single_bit_op.1.2.1.1.1.1.3:

{-1} ndiv(v′ − expt(2, m′), expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) = ndiv(ndiv(v′ − expt(2, m′), expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-3} integer_pred(q′)
{-4} n′ > m′
{-5} v′ − expt(2, m′) ≥ 0
{-6} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-7} n′ ≥ 0
{-8} m′ ≥ 0
{-9} v′ ≥ 0
{1} −1 − m′ + n′ ≥ 0
{2} c′(m′)
{3} n′ = m′

{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.1.2.1.1.1.1.3.

change_bit_single_bit_op.1.2.1.1.1.2:

{-1} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} integer_pred(q′)
{-3} n′ > m′
{-4} v′ − expt(2, m′) ≥ 0
{-5} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-6} n′ ≥ 0
{-7} m′ ≥ 0
{-8} v′ ≥ 0
{1} −1 − m′ + n′ ≥ 0
{2} c′(m′)
{3} n′ = m′

{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.1.2.1.1.1.2.
change_bit_single_bit_op.1.2.1.1.2:

{-1} integer_pred(q′)
{-2} n′ > m′
{-3} v′ − expt(2, m′) ≥ 0
{-4} ndiv(v′, expt(2, m′)) = 1 + 2 × q′
{-5} n′ ≥ 0
{-6} m′ ≥ 0
{-7} v′ ≥ 0
{1} −1 − m′ + n′ ≥ 0
{2} c′(m′)
{3} n′ = m′

{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.1.2.1.1.2.
change_bit_single_bit_op.1.2.1.2:

{-1} v′ − expt(2, m′) ≥ 0
{-2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} n′ > m′
{2} c′(m′)
{3} n′ = m′

{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Using lemma ndiv_minus_2, Splitting conjunctions, we get 2 subgoals:

change_bit_single_bit_op.1.2.1.2.1:

{-1} ndiv(v′ − expt(2, m′), expt(2, n′)) =

ndiv(v′, expt(2, n′)) − ndiv(expt(2, m′), expt(2, n′))

{-2} v′ − expt(2, m′) ≥ 0
{-3} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-4} n′ ≥ 0
{-5} m′ ≥ 0
{-6} v′ ≥ 0
{1} n′ > m′
{2} c′(m′)
{3} n′ = m′

{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Replacing using formula -1, Rewriting using ndiv_expt_expt, matching in *, Simplifying, rewriting, and recording with decision procedures, Using lemma rem_diff2, Using lemma rem_multiple1, Expanding the definition of expt, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.1.2.1.2.1.
change_bit_single_bit_op.1.2.1.2.2:

{-1} v′ − expt(2, m′) ≥ 0
{-2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} divides(expt(2, n′), expt(2, m′))
{2} n′ > m′
{3} c′(m′)
{4} n′ = m′

{5} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Expanding the definition of divides, Instantiating the top quantifier in 1 with the terms: (expt(2, m!1 - n!1)), we get 2 subgoals:

change_bit_single_bit_op.1.2.1.2.2.1:

{-1} v′ − expt(2, m′) ≥ 0
{-2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} expt(2, m′) = expt(2, n′) × expt(2, m′ − n′)
{2} n′ > m′
{3} c′(m′)
{4} n′ = m′

{5} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Using lemma expt_plus_aux, we get 2 subgoals:

change_bit_single_bit_op.1.2.1.2.2.1.1:

{-1} expt(2, n′ + m′ − n′) = expt(2, n′) × expt(2, m′ − n′)
{-2} v′ − expt(2, m′) ≥ 0
{-3} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-4} n′ ≥ 0
{-5} m′ ≥ 0
{-6} v′ ≥ 0
{1} expt(2, m′) = expt(2, n′) × expt(2, m′ − n′)
{2} n′ > m′
{3} c′(m′)
{4} n′ = m′

{5} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.1.2.1.2.2.1.1.
change_bit_single_bit_op.1.2.1.2.2.1.2:

{-1} v′ − expt(2, m′) ≥ 0
{-2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} m′ − n′ ≥ 0
{2} expt(2, m′) = expt(2, n′) × expt(2, m′ − n′)
{3} n′ > m′
{4} c′(m′)
{5} n′ = m′

{6} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.1.2.1.2.2.1.2.
change_bit_single_bit_op.1.2.1.2.2.2:

{-1} v′ − expt(2, m′) ≥ 0
{-2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} m′ − n′ ≥ 0
{2} n′ > m′
{3} c′(m′)
{4} n′ = m′

{5} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.1.2.1.2.2.2.

C Proof scripts

change_bit_single_bit_op.1.2.2:

{-1} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} v′ − expt(2, m′) ≥ 0
{2} c′(m′)
{3} n′ = m′
{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 =
(rem(2)(ndiv(v′ − expt(2, m′), expt(2, n′))) = 1)

Hiding formulas: (-2 2 3 4), Case splitting on v!1 < expt(2, m!1), we get 2 subgoals:

change_bit_single_bit_op.1.2.2.1:

{-1} v′ < expt(2, m′)
{-2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} v′ − expt(2, m′) ≥ 0

Rewriting using ndiv_bigger, matching in *, Rewriting using rem_zero, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.1.2.2.1.
change_bit_single_bit_op.1.2.2.2:

{-1} rem(2)(ndiv(v′, expt(2, m′))) = 1
{-2} m′ ≥ 0
{-3} v′ ≥ 0
{1} v′ < expt(2, m′)
{2} v′ − expt(2, m′) ≥ 0

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.1.2.2.2.

change_bit_single_bit_op.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} v′ ≥ 0
{1} rem(2)(ndiv(v′, expt(2, m′))) = 1
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)

(ndiv(if c′(m′)

then if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ else expt(2, m′) + v′ endif

else if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ − expt(2, m′) else v′ endif

endif,

expt(2, n′)))

= 1)

Case splitting on c!1(m!1),

we get 2 subgoals:

change_bit_single_bit_op.2.1:

{-1} c′(m′)
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} rem(2)(ndiv(v′, expt(2, m′))) = 1
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)

(ndiv(if c′(m′)

then if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ else expt(2, m′) + v′ endif

else if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ − expt(2, m′) else v′ endif

endif,

expt(2, n′)))

= 1)

Simplifying, rewriting, and recording with decision procedures,

Case splitting on n!1 > m!1,

we get 2 subgoals:

change_bit_single_bit_op.2.1.1:

{-1} n′ > m′
{-2} c′(m′)
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} rem(2)(ndiv(v′, expt(2, m′))) = 1
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Case splitting on rem(2)(ndiv(v!1, expt(2, m!1))) = 0, we get 2 subgoals:

change_bit_single_bit_op.2.1.1.1:

{-1} rem(2)(ndiv(v′, expt(2, m′))) = 0
{-2} n′ > m′
{-3} c′(m′)
{-4} n′ ≥ 0
{-5} m′ ≥ 0
{-6} v′ ≥ 0
{1} rem(2)(ndiv(v′, expt(2, m′))) = 1
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Hiding formulas: 1, Using lemma ndiv_times_2, we get 2 subgoals:

change_bit_single_bit_op.2.1.1.1.1:

{-1} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} rem(2)(ndiv(v′, expt(2, m′))) = 0
{-3} n′ > m′
{-4} c′(m′)
{-5} n′ ≥ 0
{-6} m′ ≥ 0
{-7} v′ ≥ 0
{1} n′ = m′

{2} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Using lemma ndiv_times_2, we get 2 subgoals:

change_bit_single_bit_op.2.1.1.1.1.1:

{-1} ndiv(v′ + expt(2, m′), expt(2, m′) × 2 × expt(2, n′ − m′ − 1))

=

ndiv(ndiv(v′ + expt(2, m′), expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-3} rem(2)(ndiv(v′, expt(2, m′))) = 0
{-4} n′ > m′
{-5} c′(m′)
{-6} n′ ≥ 0
{-7} m′ ≥ 0
{-8} v′ ≥ 0
{1} n′ = m′
{2} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Case splitting on expt(2, m!1) * (2 * expt(2, n!1 - m!1 - 1)) = expt(2, n!1), we get 3 subgoals:

change_bit_single_bit_op.2.1.1.1.1.1.1:

{-1} expt(2, m′) × (2 × expt(2, n′ − m′ − 1)) = expt(2, n′)
{-2} ndiv(v′ + expt(2, m′), expt(2, m′) × 2 × expt(2, n′ − m′ − 1))

=

ndiv(ndiv(v′ + expt(2, m′), expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-3} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-4} rem(2)(ndiv(v′, expt(2, m′))) = 0
{-5} n′ > m′
{-6} c′(m′)
{-7} n′ ≥ 0
{-8} m′ ≥ 0
{-9} v′ ≥ 0
{1} n′ = m′
{2} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Replacing using formula -1, Replacing using formula -2, Replacing using formula -3, Using lemma ndiv_plus_2, Rewriting using divides_reflexive, matching in *, Rewriting using ndiv_self, matching in *, Replacing using formula -1, Hiding formulas: (-1 -2 -3 -4), Rewriting using rem_def, matching in *, Repeatedly Skolemizing and flattening, Replacing using formula -2, Rewriting using ndiv_times_2, matching in * where b gets 2, c gets expt(2, -1 - m!1 + n!1), Rewriting using ndiv_times_2, matching in * where b gets 2, c gets expt(2, -1 - m!1 + n!1), Using lemma ndiv_plus_mod, Splitting conjunctions, we get 2 subgoals:

change_bit_single_bit_op.2.1.1.1.1.1.1.1:

{-1} ndiv(2 × q′ + 1, 2) = ndiv(2 × q′, 2)
{-2} integer_pred(q′)
{-3} ndiv(v′, expt(2, m′)) = 2 × q′
{-4} n′ > m′
{-5} c′(m′)
{-6} n′ ≥ 0
{-7} m′ ≥ 0
{-8} v′ ≥ 0
{1} n′ = m′

{2} rem(2)(ndiv(ndiv(2 × q′, 2), expt(2, −1 − m′ + n′))) = 1 =

(rem(2)(ndiv(ndiv(1 + 2 × q′, 2), expt(2, −1 − m′ + n′))) = 1)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.2.1.1.1.1.1.1.1.
change_bit_single_bit_op.2.1.1.1.1.1.1.2:

{-1} integer_pred(q′)
{-2} ndiv(v′, expt(2, m′)) = 2 × q′
{-3} n′ > m′
{-4} c′(m′)
{-5} n′ ≥ 0
{-6} m′ ≥ 0
{-7} v′ ≥ 0
{1} divides(2, 2 × q′)
{2} n′ = m′

{3} rem(2)(ndiv(ndiv(2 × q′, 2), expt(2, −1 − m′ + n′))) = 1 =

(rem(2)(ndiv(ndiv(1 + 2 × q′, 2), expt(2, −1 − m′ + n′))) = 1)

Expanding the definition of divides, Instantiating quantified variables,

This completes the proof of change_bit_single_bit_op.2.1.1.1.1.1.1.2.
change_bit_single_bit_op.2.1.1.1.1.1.2:

{-1} ndiv(v′ + expt(2, m′), expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) = ndiv(ndiv(v′ + expt(2, m′), expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-3} rem(2)(ndiv(v′, expt(2, m′))) = 0
{-4} n′ > m′
{-5} c′(m′)
{-6} n′ ≥ 0
{-7} m′ ≥ 0
{-8} v′ ≥ 0
{1} expt(2, m′) × (2 × expt(2, n′ − m′ − 1)) = expt(2, n′)
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Keeping (-4 1) and hiding *, Expanding the definition of expt, Simplifying, rewriting, and recording with decision procedures, Using lemma expt_plus_aux, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.2.1.1.1.1.1.2.
change_bit_single_bit_op.2.1.1.1.1.1.3:

{-1} ndiv(v′ + expt(2, m′), expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) = ndiv(ndiv(v′ + expt(2, m′), expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-3} rem(2)(ndiv(v′, expt(2, m′))) = 0
{-4} n′ > m′
{-5} c′(m′)
{-6} n′ ≥ 0
{-7} m′ ≥ 0
{-8} v′ ≥ 0
{1} −1 − m′ + n′ ≥ 0
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.2.1.1.1.1.1.3.
change_bit_single_bit_op.2.1.1.1.1.2:

{-1} ndiv(v′, expt(2, m′) × 2 × expt(2, n′ − m′ − 1)) =

ndiv(ndiv(v′, expt(2, m′)), 2 × expt(2, n′ − m′ − 1))

{-2} rem(2)(ndiv(v′, expt(2, m′))) = 0
{-3} n′ > m′
{-4} c′(m′)
{-5} n′ ≥ 0
{-6} m′ ≥ 0
{-7} v′ ≥ 0
{1} −1 − m′ + n′ ≥ 0
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.2.1.1.1.1.2.
change_bit_single_bit_op.2.1.1.1.2:

{-1} rem(2)(ndiv(v′, expt(2, m′))) = 0
{-2} n′ > m′
{-3} c′(m′)
{-4} n′ ≥ 0
{-5} m′ ≥ 0
{-6} v′ ≥ 0
{1} −1 − m′ + n′ ≥ 0
{2} n′ = m′

{3} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.2.1.1.1.2.
change_bit_single_bit_op.2.1.1.2:

{-1} n′ > m′
{-2} c′(m′)
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} rem(2)(ndiv(v′, expt(2, m′))) = 0
{2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{3} n′ = m′
{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.2.1.1.2.
change_bit_single_bit_op.2.1.2:

{-1} c′(m′)
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} n′ > m′
{2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{3} n′ = m′
{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Using lemma ndiv_plus_2, Splitting conjunctions, we get 2 subgoals:

change_bit_single_bit_op.2.1.2.1:

{-1} ndiv(v′ + expt(2, m′), expt(2, n′)) =

ndiv(v′, expt(2, n′)) + ndiv(expt(2, m′), expt(2, n′))

{-2} c′(m′)
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} n′ > m′
{2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{3} n′ = m′
{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Rewriting using ndiv_expt_expt, matching in *, Simplifying, rewriting, and recording with decision procedures, Using lemma rem_sum1, Using lemma rem_multiple1, Expanding the definition of expt, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.2.1.2.1.

change_bit_single_bit_op.2.1.2.2:

{-1} c′(m′)
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} divides(expt(2, n′), expt(2, m′))
{2} n′ > m′
{3} rem(2)(ndiv(v′, expt(2, m′))) = 1
{4} n′ = m′

{5} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Expanding the definition of divides, Instantiating the top quantifier in 1 with the terms: (expt(2, m!1 - n!1)), we get 2 subgoals:

change_bit_single_bit_op.2.1.2.2.1:

{-1} c′(m′)
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} expt(2, m′) = expt(2, n′) × expt(2, m′ − n′)
{2} n′ > m′
{3} rem(2)(ndiv(v′, expt(2, m′))) = 1
{4} n′ = m′

{5} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Using lemma expt_plus_aux, we get 2 subgoals:

change_bit_single_bit_op.2.1.2.2.1.1:

{-1} expt(2, n′ + m′ − n′) = expt(2, n′) × expt(2, m′ − n′)
{-2} c′(m′)
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} v′ ≥ 0
{1} expt(2, m′) = expt(2, n′) × expt(2, m′ − n′)
{2} n′ > m′
{3} rem(2)(ndiv(v′, expt(2, m′))) = 1
{4} n′ = m′

{5} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.2.1.2.2.1.1.

change_bit_single_bit_op.2.1.2.2.1.2:

{-1} c′(m′)
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} m′ − n′ ≥ 0
{2} expt(2, m′) = expt(2, n′) × expt(2, m′ − n′)
{3} n′ > m′
{4} rem(2)(ndiv(v′, expt(2, m′))) = 1
{5} n′ = m′

{6} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.2.1.2.2.1.2.
change_bit_single_bit_op.2.1.2.2.2:

{-1} c′(m′)
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} v′ ≥ 0
{1} m′ − n′ ≥ 0
{2} n′ > m′
{3} rem(2)(ndiv(v′, expt(2, m′))) = 1
{4} n′ = m′

{5} rem(2)(ndiv(v′, expt(2, n′))) = 1 = (rem(2)(ndiv(expt(2, m′) + v′, expt(2, n′))) = 1)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of change_bit_single_bit_op.2.1.2.2.2.
change_bit_single_bit_op.2.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} v′ ≥ 0
{1} c′(m′)
{2} rem(2)(ndiv(v′, expt(2, m′))) = 1
{3} n′ = m′

{4} rem(2)(ndiv(v′, expt(2, n′))) = 1 =

(rem(2)

(ndiv(if c′(m′)

then if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ else expt(2, m′) + v′ endif

else if rem(2)(ndiv(v′, expt(2, m′))) = 1

then v′ − expt(2, m′) else v′ endif

endif,

expt(2, n′)))

= 1)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of change_bit_single_bit_op.2.2.

Q.E.D.

C.16.11 Bitops.change_bit_result

Terse proof for change_bit_result.
change_bit_result:

{1} ∀ (n, v: nat, c: [nat → bool]): bit_set?(n, change_bit(v, c)(n)) = c(n)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, we get 2 subgoals:

change_bit_result.1:

{-1} n′ ≥ 0
{-2} v′ ≥ 0
{-3} rem(2)(ndiv(v′, expt(2, n′))) = 1
{-4} rem(2)(ndiv(v′ − expt(2, n′), expt(2, n′))) = 1
{1} c′(n′)

Using lemma ndiv_minus_2, Rewriting using divides_reflexive, matching in *, Rewriting using ndiv_self, matching in *, Using lemma rem_add_one, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of change_bit_result.1.

change_bit_result.2:

{-1} n′ ≥ 0
{-2} v′ ≥ 0
{-3} c′(n′)
{1} rem(2)(ndiv(v′, expt(2, n′))) = 1
{2} rem(2)(ndiv(expt(2, n′) + v′, expt(2, n′))) = 1

Using lemma ndiv_plus_1, Rewriting using divides_reflexive, matching in *, Rewriting using ndiv_self, matching in *, Using lemma rem_add_one, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of change_bit_result.2. Q.E.D.

C.16.12 Bitops.change_bits_TCC1

Terse proof for change_bits_TCC1.
change_bits_TCC1:

{1} ∀ (n: nat): ¬ n = 0 ⊃ n − 1 ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of change_bits_TCC1. Q.E.D.

C.16.13 Bitops.change_bits_TCC2

Terse proof for change_bits_TCC2.
change_bits_TCC2:

{1} ∀ (n: nat): ¬ n = 0 ⊃ n − 1 < n

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of change_bits_TCC2. Q.E.D.

C.16.14 Bitops.change_bits_result

Terse proof for change_bits_result.
change_bits_result:

{1} ∀ (m, n: nat, val: nat, c: [nat → bool]):

m ≤ n ⊃ bit_set?(m, change_bits(val, c)(n)) = c(m)

Inducting on n on formula 1, we get 2 subgoals:

change_bits_result.1:

{1} ∀ (m, val: nat, c: [nat → bool]):

m ≤ 0 ⊃ bit_set?(m, change_bits(val, c)(0)) = c(m)

Repeatedly Skolemizing and flattening, Case splitting on m!1 = 0, we get 2 subgoals:

change_bits_result.1.1:

{-1} m′ = 0
{-2} m′ ≥ 0
{-3} val′ ≥ 0
{-4} m′ ≤ 0
{1} bit_set?(m′, change_bits(val′, c′)(0)) = c′(m′)

Replacing using formula -1, Expanding the definition of change_bits, Using lemma change_bit_result, This completes the proof of change_bits_result.1.1.

change_bits_result.1.2:

{-1} m′ ≥ 0
{-2} val′ ≥ 0
{-3} m′ ≤ 0
{1} m′ = 0
{2} bit_set?(m′, change_bits(val′, c′)(0)) = c′(m′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of change_bits_result.1.2.

change_bits_result.2:

{1} ∀ j:

(∀ (m, val: nat, c: [nat → bool]):

m ≤ j ⊃ bit_set?(m, change_bits(val, c)(j)) = c(m)) ⊃ (∀ (m, val: nat, c: [nat → bool]):

m ≤ j + 1 ⊃ bit_set?(m, change_bits(val, c)(j + 1)) = c(m))

Repeatedly Skolemizing and flattening, Expanding the definition of change_bits, Case splitting on m!1 = j!1 + 1, we get 2 subgoals:

change_bits_result.2.1:

{-1} m′ = j′ + 1
{-2} m′ ≥ 0
{-3} val′ ≥ 0
{-4} j′ ≥ 0
{-5} ∀ (m, val: nat, c: [nat → bool]):

m ≤ j′ ⊃ bit_set?(m, change_bits(val, c)(j′)) = c(m)

{-6} m′ ≤ j′ + 1
{1} bit_set?(m′, change_bit(change_bits(val′, c′)(j′), c′)(1 + j′)) = c′(m′)

Using lemma change_bit_result, Simplifying, rewriting, and recording with decision procedures, This completes the proof of change_bits_result.2.1.

change_bits_result.2.2:

{-1} m′ ≥ 0
{-2} val′ ≥ 0
{-3} j′ ≥ 0
{-4} ∀ (m, val: nat, c: [nat → bool]):

m ≤ j′ ⊃ bit_set?(m, change_bits(val, c)(j′)) = c(m)

{-5} m′ ≤ j′ + 1
{1} m′ = j′ + 1
{2} bit_set?(m′, change_bit(change_bits(val′, c′)(j′), c′)(1 + j′)) = c′(m′)

Using lemma change_bit_single_bit_op, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of change_bits_result.2.2. Q.E.D.

C.16.15 Bitops.change_bits_unchanged

Terse proof for change_bits_unchanged.
change_bits_unchanged:

{1} ∀ (m, n: nat, val: nat, c: [nat → bool]):

m > n ⊃ bit_set?(m, change_bits(val, c)(n)) = bit_set?(m, val)

Inducting on n on formula 1, we get 2 subgoals:

change_bits_unchanged.1:

{1} ∀ (m, val: nat, c: [nat → bool]):

m > 0 ⊃ bit_set?(m, change_bits(val, c)(0)) = bit_set?(m, val)

Repeatedly Skolemizing and flattening, Expanding the definition of change_bits, Using lemma change_bit_single_bit_op, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of change_bits_unchanged.1.

change_bits_unchanged.2:

{1} ∀ j:

(∀ (m, val: nat, c: [nat → bool]):

m > j ⊃ bit_set?(m, change_bits(val, c)(j)) = bit_set?(m, val)) ⊃ (∀ (m, val: nat, c: [nat → bool]):

m > j + 1 ⊃ bit_set?(m, change_bits(val, c)(j + 1)) = bit_set?(m, val))

Repeatedly Skolemizing and flattening, Expanding the definition of change_bits, Using lemma change_bit_single_bit_op, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of change_bits_unchanged.2. Q.E.D.

C.16.16 Bitops.change_bits_below_TCC1

Terse proof for change_bits_below_TCC1.
change_bits_below_TCC1:

{1} ∀ (v: below[expt(2, p)]): p − 1 ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of change_bits_below_TCC1. Q.E.D.

C.16.17 Bitops.change_bits_below

Terse proof for change_bits_below.
change_bits_below:

{1} ∀ (v: below[expt(2, p)], c: [nat → bool]):

change_bits(v, c)(p − 1) < expt(2, p)

Repeatedly Skolemizing and flattening, Using lemma number_split, we get 2 subgoals:

change_bits_below.1:

{-1} change_bits(v′, c′)(p − 1) =

expt(2, p) × ndiv(change_bits(v′, c′)(p − 1), expt(2, p)) + rem(expt(2, p))(change_bits(v′, c′)(p − 1))

{-2} v′ < expt(2, p)
{1} change_bits(v′, c′)(p − 1) < expt(2, p)

Replacing using formula -1, Hiding formulas: -1, Using lemma bit_split_less, we get 2 subgoals:

change_bits_below.1.1:

{-1} rem(expt(2, p))(change_bits(v′, c′)(p − 1)) < expt(2, p) ⊃

(ndiv(change_bits(v′, c′)(p − 1), expt(2, p)) × expt(2, p) + rem(expt(2, p))(change_bits(v′, c′)(p − 1)) < expt(2, p + 0) ≡ ndiv(change_bits(v′, c′)(p − 1), expt(2, p)) < expt(2, 0))

{-2} v′ < expt(2, p)

{1} expt(2, p) × ndiv(change_bits(v′, c′)(p − 1), expt(2, p)) + rem(expt(2, p))(change_bits(v′, c′)(p − 1)) < expt(2, p)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (1 3), Applying change_bits_unchanged Instantiating the top quantifier in -1 with the terms: (_p - 1 v!1 c!1), Using lemma bits_equal4, Splitting conjunctions, we get 2 subgoals:

change_bits_below.1.1.1:

{-1} ndiv(change_bits(v′, c′)(p − 1), expt(2, p)) = ndiv(v′, expt(2, p))
{-2} ∀ (m: nat):

m > p − 1 ⊃

bit_set?(m, change_bits(v′, c′)(p − 1)) = bit_set?(m, v′)

{-3} v′ < expt(2, p)
{1} ndiv(change_bits(v′, c′)(p − 1), expt(2, p)) < expt(2, 0)

Replacing using formula -1, Hiding formulas: (-1 -2), Rewriting using ndiv_bigger, matching in *, Expanding the definition of expt, Simplifying, rewriting, and recording with decision procedures, This completes the proof of change_bits_below.1.1.1.

change_bits_below.1.1.2:

{-1} ∀ (m: nat):

m > p − 1 ⊃

bit_set?(m, change_bits(v′, c′)(p − 1)) = bit_set?(m, v′)

{-2} v′ < expt(2, p)
{1} ∀ (n: nat):

n ≥ p ⊃ bit_set?(n, change_bits(v′, c′)(p − 1)) = bit_set?(n, v′)

{2} ndiv(change_bits(v′, c′)(p − 1), expt(2, p)) < expt(2, 0)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of change_bits_below.1.1.2.

change_bits_below.1.2:

{-1} v′ < expt(2, p)
{1} p − 1 ≥ 0

{2} expt(2, p) × ndiv(change_bits(v′, c′)(p − 1), expt(2, p)) + rem(expt(2, p))(change_bits(v′, c′)(p − 1))

< expt(2, p)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of change_bits_below.1.2.

change_bits_below.2:

{-1} v′ < expt(2, p)
{1} p − 1 ≥ 0
{2} change_bits(v′, c′)(p − 1) < expt(2, p)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of change_bits_below.2. Q.E.D.

C.16.18 Bitops.binary_not_TCC1

Terse proof for binary_not_TCC1.
binary_not_TCC1:

{1} ∀ (val: below[expt(2, p)]):

change_bits(val, λ (n: nat): ¬ bit_set?(n, val))(p − 1) < expt(2, p)

Repeatedly Skolemizing and flattening, Rewriting using change_bits_below, matching in *, This completes the proof of binary_not_TCC1. Q.E.D.

C.16.19 Bitops.binary_not_not

Terse proof for binary_not_not.
binary_not_not:

{1} ∀ (val: below[expt(2, p)]): binary_not(binary_not(val)) = val

Repeatedly Skolemizing and flattening, Using lemma bits_equal2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of binary_not, Using lemma change_bits_result, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Using lemma change_bits_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_not_not. Q.E.D.

C.16.20 Bitops.binary_and_TCC1

Terse proof for binary_and_TCC1.
binary_and_TCC1:

{1} ∀ (v_{1}, v_{2}: below[expt(2, p)]):

change_bits(v_{1}, λ (n: nat): bit_set?(n, v_{1}) ∧ bit_set?(n, v_{2}))(p − 1) <

expt(2, p)

Repeatedly Skolemizing and flattening, Rewriting using change_bits_below, matching in *, This completes the proof of binary_and_TCC1. Q.E.D.

C.16.21 Bitops.binary_and_not

Terse proof for binary_and_not.
binary_and_not:

{1} ∀ (val: below[expt(2, p)]): binary_and(val, binary_not(val)) = 0

Repeatedly Skolemizing and flattening, Using lemma bits_equal2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of binary_and, Using lemma change_bits_result, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Expanding the definition of binary_not, Using lemma change_bits_result, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Expanding the definition of bit_set?, Using lemma cut_bit_zero, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_and_not. Q.E.D.

C.16.22 Bitops.binary_and_full_TCC1

Terse proof for binary_and_full_TCC1.
binary_and_full_TCC1:

{1} ∀ (val: below[expt(2, p)]):

expt(2, p) − 1 ≥ 0 ∧ expt(2, p) − 1 < expt(2, p)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_and_full_TCC1. Q.E.D.

C.16.23 Bitops.binary_and_full

Terse proof for binary_and_full.
binary_and_full:

{1} ∀ (val: below[expt(2, p)]): binary_and(val, expt(2, p) − 1) = val

Repeatedly Skolemizing and flattening, Using lemma bits_equal2, we get 2 subgoals:

binary_and_full.1:

{-1} (∀ (n: nat):

n < p ⊃ bit_set?(n, binary_and(val′, expt(2, p) − 1)) = bit_set?(n, val′))

≡ binary_and(val′, expt(2, p) − 1) = val′

{-2} val′ < expt(2, p)
{1} binary_and(val′, expt(2, p) − 1) = val′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Hiding formulas: 2, Expanding the definition of binary_and, Using lemma change_bits_result, we get 2 subgoals:

binary_and_full.1.1:

{-1} n′ ≤ p − 1 ⊃
bit_set?(n′,

change_bits(val′,

λ (n: nat):

bit_set?(n, val′) ∧ bit_set?(n, expt(2, p) − 1)) (p − 1)) = (bit_set?(n′, val′) ∧ bit_set?(n′, expt(2, p) − 1))

{-2} n′ ≥ 0
{-3} n′ < p
{-4} val′ < expt(2, p)
{1} bit_set?(n′,

change_bits(val′,

λ (n: nat):

bit_set?(n, val′) ∧ bit_set?(n, expt(2, p) − 1)) (p − 1))

= bit_set?(n′, val′)

Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Rewriting using bit_set_full_mask, matching in *, This completes the proof of binary_and_full.1.1.

binary_and_full.1.2:

{-1} n′ ≥ 0
{-2} n′ < p
{-3} val′ < expt(2, p)
{1} ∀ (n: nat): bit_set?(n, val′) ⊃ expt(2, p) − 1 ≥ 0
{2} bit_set?(n′,

change_bits(val′,

λ (n: nat):

bit_set?(n, val′) ∧ bit_set?(n, expt(2, p) − 1)) (p − 1))

= bit_set?(n′, val′)

Repeatedly Skolemizing and flattening, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_and_full.1.2.

binary_and_full.2:

{-1} val′ < expt(2, p)
{1} expt(2, p) − 1 ≥ 0
{2} binary_and(val′, expt(2, p) − 1) = val′

Expanding the definition of binary_and, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_and_full.2. Q.E.D.

C.16.24 Bitops.binary_and_zero_TCC1

Terse proof for binary_and_zero_TCC1.
binary_and_zero_TCC1:

{1} ∀ (val: below[expt(2, p)]): 0 < expt(2, p)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of binary_and_zero_TCC1. Q.E.D.

C.16.25 Bitops.binary_and_zero

Terse proof for binary_and_zero.
binary_and_zero:

{1} ∀ (val: below[expt(2, p)]): binary_and(val, 0) = 0

Repeatedly Skolemizing and flattening, Using lemma bits_equal2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Hiding formulas: 2, Expanding the definition of binary_and, Rewriting using change_bits_result, matching in *, Rewriting using bit_set_zero_mask, matching in *, This completes the proof of binary_and_zero. Q.E.D.

C.16.26 Bitops.binary_or_TCC1

Terse proof for binary_or_TCC1.
binary_or_TCC1:

{1} ∀ (v_{1}, v_{2}: below[expt(2, p)]):

change_bits(v_{1}, λ (n: nat): bit_set?(n, v_{1}) ∨ bit_set?(n, v_{2}))(p − 1) <

expt(2, p)

Repeatedly Skolemizing and flattening, Rewriting using change_bits_below, matching in *, This completes the proof of binary_or_TCC1. Q.E.D.

C.16.27 Bitops.binary_or_not

Terse proof for binary_or_not.

binary_or_not:

{1} ∀ (val: below[expt(2, p)]): binary_or(val, binary_not(val)) = expt(2, p) − 1

Repeatedly Skolemizing and flattening, Using lemma bits_equal2, we get 2 subgoals:

binary_or_not.1:

{-1} (∀ (n: nat):

n < p ⊃ bit_set?(n, binary_or(val′, binary_not(val′))) = bit_set?(n, expt(2, p) − 1))

≡ binary_or(val′, binary_not(val′)) = expt(2, p) − 1

{-2} val′ < expt(2, p)
{1} binary_or(val′, binary_not(val′)) = expt(2, p) − 1

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of binary_or, Rewriting using change_bits_result, matching in *, Expanding the definition of binary_not, Rewriting using change_bits_result, matching in *, Rewriting using bit_set_full_mask, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_or_not.1.

binary_or_not.2:

{-1} val′ < expt(2, p)
{1} expt(2, p) − 1 ≥ 0
{2} binary_or(val′, binary_not(val′)) = expt(2, p) − 1

Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_or_not.2. Q.E.D.

C.16.28 Bitops.binary_xor_TCC1

Terse proof for binary_xor_TCC1.
binary_xor_TCC1:

{1} ∀ (v_{1}, v_{2}: below[expt(2, p)]):

change_bits(v_{1}, λ (n: nat): bit_set?(n, v_{1}) ≠ bit_set?(n, v_{2}))(p − 1) <

expt(2, p)

Repeatedly Skolemizing and flattening, Rewriting using change_bits_below, matching in *, This completes the proof of binary_xor_TCC1. Q.E.D.

C.16.29 Bitops.binary_xor_self

Terse proof for binary_xor_self.
binary_xor_self:

{1} ∀ (val: below[expt(2, p)]): binary_xor(val, val) = 0

Expanding the definition of binary_xor, Repeatedly Skolemizing and flattening, Using lemma bits_equal2, we get 3 subgoals:

binary_xor_self.1:

{-1} (∀ (n_1: nat):

n_1 < p ⊃ bit_set?(n_1, change_bits(val′, λ (n: nat): false)(p − 1)) = bit_set?(n_1, 0))

≡ change_bits(val′, λ (n: nat): false)(p − 1) = 0

{-2} val′ < expt(2, p)
{1} change_bits(val′, λ (n: nat): false)(p − 1) = 0

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Rewriting using bit_set_zero_mask, matching in *, Rewriting using change_bits_result, matching in *, This completes the proof of binary_xor_self.1.

binary_xor_self.2:

{-1} val′ < expt(2, p)
{1} change_bits(val′, λ (n: nat): false)(p − 1) < expt(2, p)
{2} change_bits(val′, λ (n: nat): false)(p − 1) = 0

Using lemma change_bits_below, This completes the proof of binary_xor_self.2.

binary_xor_self.3:

{-1} val′ < expt(2, p)
{1} p − 1 ≥ 0
{2} change_bits(val′, λ (n: nat): false)(p − 1) = 0

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_xor_self.3. Q.E.D.

C.16.30 Bitops.binary_or_full

Terse proof for binary_or_full.
binary_or_full:

{1} ∀ (val: below[expt(2, p)]): binary_or(val, expt(2, p) − 1) = expt(2, p) − 1

Repeatedly Skolemizing and flattening, Using lemma bits_equal2, we get 2 subgoals:

binary_or_full.1:

{-1} (∀ (n: nat):

n < p ⊃ bit_set?(n, binary_or(val′, expt(2, p) − 1)) = bit_set?(n, expt(2, p) − 1))

≡ binary_or(val′, expt(2, p) − 1) = expt(2, p) − 1

{-2} val′ < expt(2, p)
{1} binary_or(val′, expt(2, p) − 1) = expt(2, p) − 1

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Expanding the definition of binary_or, Hiding formulas: 2, Rewriting using change_bits_result, matching in *, we get 2 subgoals:

binary_or_full.1.1:

{-1} n′ ≥ 0
{-2} n′ < p
{-3} val′ < expt(2, p)
{1} (bit_set?(n′, val′) ∨ bit_set?(n′, expt(2, p) − 1)) =

bit_set?(n′, expt(2, p) − 1)

Rewriting using bit_set_full_mask, matching in *, This completes the proof of binary_or_full.1.1.

C.17 Proofs for Bits (bits.pvs)

binary_or_full.1.2:

{-1} n′ ≥ 0
{-2} n′ < p
{-3} val′ < expt(2, p)
{1} ∀ (n: nat): ¬ bit_set?(n, val′) ⊃ expt(2, p) − 1 ≥ 0
{2} bit_set?(n′,

change_bits(val′,

λ (n: nat):

bit_set?(n, val′) ∨ bit_set?(n, expt(2, p) − 1)) (p − 1))

= bit_set?(n′, expt(2, p) − 1)

Repeatedly Skolemizing and flattening, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_or_full.1.2.

binary_or_full.2:

{-1} val′ < expt(2, p)
{1} expt(2, p) − 1 ≥ 0
{2} binary_or(val′, expt(2, p) − 1) = expt(2, p) − 1

Expanding the definition of binary_or, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of binary_or_full.2. Q.E.D.

C.16.31 Bitops.binary_or_zero

Terse proof for binary_or_zero.
binary_or_zero:

{1} ∀ (val: below[expt(2, p)]): binary_or(val, 0) = val

Repeatedly Skolemizing and flattening, Using lemma bits_equal2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Expanding the definition of binary_or, Rewriting using change_bits_result, matching in *, Rewriting using bit_set_zero_mask, matching in *, This completes the proof of binary_or_zero. Q.E.D.

C.17 Proofs for Bits (bits.pvs)

C.17.1 Bits.bool_to_nat_below

Terse proof for bool_to_nat_below.

bool_to_nat_below:

{1} ∀ (b: bool): bool_to_nat(b) < 2

Repeatedly Skolemizing and flattening, Expanding the definition of bool_to_nat, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bool_to_nat_below. Q.E.D.

C.17.2 Bits.nat_bool_iso

Terse proof for nat_bool_iso.

nat_bool_iso:

{1} ∀ (b: bool): nat_to_bool(bool_to_nat(b)) = b

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nat_bool_iso. Q.E.D.

C.17.3 Bits.cut_bit_zero

Terse proof for cut_bit_zero.

cut_bit_zero:

{1} ∀ (i: nat): cut_bit(0, i) = false

Repeatedly Skolemizing and flattening, Expanding the definition of cut_bit, Rewriting using ndiv_0, matching in *, Rewriting using rem_zero, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of cut_bit_zero. Q.E.D.

C.17.4 Bits.cut_bits_below

Terse proof for cut_bits_below.
cut_bits_below:

{1} ∀ (i, k, n: nat): cut_bits(n, i, k) < expt(2, k)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cut_bits_below. Q.E.D.

C.17.5 Bits.cut_bits_aligned

Terse proof for cut_bits_aligned.

cut_bits_aligned:

{1} ∀ (n, i, k: nat): i ≤ k ∧ cut_bits(n, 0, k) = 0 ⊃ aligned?(i)(n)

Repeatedly Skolemizing and flattening, Expanding the definition of cut_bits, Expanding the definition of expt, Rewriting using ndiv_1, matching in *, Expanding the definition of aligned?, Rewriting using rem_def2, matching in *, Applying divides_expt_gt Instantiating the top quantifier in -1 with the terms: n′, k′, i′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of cut_bits_aligned. Q.E.D.

C.17.6 Bits.aligned_cut_bits

Terse proof for aligned_cut_bits.
aligned_cut_bits:

{1} ∀ (n, i, j: nat, k: nat):
i + j ≤ k ∧ aligned?(k)(n) ⊃ cut_bits(n, i, j) = 0

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Expanding the definition of cut_bits, Rewriting using rem_ndiv, matching in *, Rewriting using expt_plus_aux, matching in *, Applying rem_def2 Instantiating the top quantifier in -1 with the terms: expt(2, i′ + j′), n′, 0, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma divides_expt_gt, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_cut_bits. Q.E.D.

C.17.7 Bits.aligned_add_cut_bits

Terse proof for aligned_add_cut_bits.
aligned_add_cut_bits:

{1} ∀ (n, m, i, j, k: nat):

i + j ≤ k ∧ aligned?(k)(n) ⊃

cut_bits(n + m, i, j) = cut_bits(m, i, j)

Repeatedly Skolemizing and flattening, Applying aligned_cut_bits Instantiating the top quantifier in -1 with the terms: (n!1 i!1 j!1 k!1), Simplifying, rewriting, and recording with decision procedures, Expanding the definition of cut_bits, Using lemma ndiv_plus_2, Splitting conjunctions, we get 2 subgoals:

aligned_add_cut_bits.1:

{-1} ndiv(m′ + n′, expt(2, i′)) =

ndiv(m′, expt(2, i′)) + ndiv(n′, expt(2, i′))

{-2} rem(expt(2, j′))(ndiv(n′, expt(2, i′))) = 0
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} j′ ≥ 0
{-7} k′ ≥ 0
{-8} i′ + j′ ≤ k′
{-9} aligned?(k′)(n′)
{1} rem(expt(2, j′))(ndiv(m′ + n′, expt(2, i′))) =

rem(expt(2, j′))(ndiv(m′, expt(2, i′)))

Replacing using formula -1, Rewriting using rem_sum2, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of aligned_add_cut_bits.1.

aligned_add_cut_bits.2:

{-1} rem(expt(2, j′))(ndiv(n′, expt(2, i′))) = 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} j′ ≥ 0
{-6} k′ ≥ 0
{-7} i′ + j′ ≤ k′
{-8} aligned?(k′)(n′)
{1} divides(expt(2, i′), n′)
{2} rem(expt(2, j′))(ndiv(m′ + n′, expt(2, i′))) =

rem(expt(2, j′))(ndiv(m′, expt(2, i′)))

Hiding formulas: 2, Expanding the definition of aligned?, Rewriting using divides_transitive, matching in * where n gets expt(2, i!1), m gets expt(2, k!1), l gets

n!1, Hiding formulas: 2, Expanding the definition of divides, Instantiating the top quantifier in 1 with the terms: expt(2, k′ − i′), Keeping 1 and hiding *, Rewriting using expt_plus_aux, matching in *, This completes the proof of aligned_add_cut_bits.2. Q.E.D.

C.17.8 Bits.cut_bit_bits

Terse proof for cut_bit_bits.

cut_bit_bits:

{1} ∀ (i, n: nat): cut_bit(n, i) = if cut_bits(n, i, 1) = 1 then true else false en- dif

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cut_bit_bits. Q.E.D.

C.17.9 Bits.cut_bits_zero

Terse proof for cut_bits_zero.

cut_bits_zero:

{1} ∀ (i, k: nat): cut_bits(0, i, k) = 0

Repeatedly Skolemizing and flattening, Expanding the definition of cut_bits, Installing automatic rewrites from: ndiv_0 rem_zero Simplifying, rewriting, and recording with decision procedures, This completes the proof of cut_bits_zero. Q.E.D.

C.17.10 Bits.zero_cut_bits

Terse proof for zero_cut_bits.

zero_cut_bits:

{1} ∀ (n, i, k: nat): k = 0 ⊃ cut_bits(n, i, k) = 0

Repeatedly Skolemizing and flattening, Replacing using formula -4, Expanding the definition of cut_bits, Rewriting using expt_x0_aux, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of zero_cut_bits. Q.E.D.

C.17.11 Bits.cut_bits_cut_bits_TCC1

Terse proof for cut_bits_cut_bits_TCC1.
cut_bits_cut_bits_TCC1:

{1} ∀ (k_{1}, i_{2}, k_{2}: nat): i_{2} + k_{2} > k_{1} ∧ ¬ i_{2} ≥ k_{1} ⊃ k_{1} − i_{2} ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cut_bits_cut_bits_TCC1. Q.E.D.

C.17.12 Bits.cut_bits_cut_bits

Terse proof for cut_bits_cut_bits.

cut_bits_cut_bits:

{1} ∀ (n, i_{1}, k_{1}, i_{2}, k_{2}: nat):

cut_bits(cut_bits(n, i_{1}, k_{1}), i_{2}, k_{2}) = if i_{2} ≥ k_{1} then 0

elsif i_{2} + k_{2} > k_{1} then cut_bits(n, i_{1} + i_{2}, k_{1} − i_{2})

else cut_bits(n, i_{1} + i_{2}, k_{2})

endif

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

cut_bits_cut_bits.1:

{-1} n′ ≥ 0
{-2} i′_{1} ≥ 0
{-3} k′_{1} ≥ 0
{-4} i′_{2} ≥ 0
{-5} k′_{2} ≥ 0
{-6} i′_{2} ≥ k′_{1}
{1} cut_bits(cut_bits(n′, i′_{1}, k′_{1}), i′_{2}, k′_{2}) = 0

Expanding the definition of cut_bits, Applying ndiv_plus_mod Installing automatic rewrites from: divides_zero ndiv_0 rem_zero Instantiating the top quantifier in -1 with the terms: 0, expt(2, i′_{2}), rem(expt(2, k′_{1}))(ndiv(n′, expt(2,

i′_{1}))), we get 2 subgoals:

cut_bits_cut_bits.1.1:

{-1} divides(expt(2, i′_{2}), 0) ⊃

ndiv(0 + rem(expt(2, k′_{1}))(ndiv(n′, expt(2, i′_{1}))), expt(2, i′_{2})) = ndiv(0, expt(2, i′_{2}))

{-2} n′ ≥ 0
{-3} i′_{1} ≥ 0
{-4} k′_{1} ≥ 0
{-5} i′_{2} ≥ 0
{-6} k′_{2} ≥ 0
{-7} i′_{2} ≥ k′_{1}
{1} rem(expt(2, k′_{2}))

(ndiv(rem(expt(2, k′_{1}))(ndiv(n′, expt(2, i′_{1}))), expt(2, i′_{2}))) = 0

Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, This completes the proof of cut_bits_cut_bits.1.1.

cut_bits_cut_bits.1.2:

{-1} n′ ≥ 0
{-2} i′_{1} ≥ 0
{-3} k′_{1} ≥ 0
{-4} i′_{2} ≥ 0
{-5} k′_{2} ≥ 0
{-6} i′_{2} ≥ k′_{1}
{1} rem(expt(2, k′_{1}))(ndiv(n′, expt(2, i′_{1}))) < expt(2, i′_{2})

{2} rem(expt(2, k′_{2}))

(ndiv(rem(expt(2, k′_{1}))(ndiv(n′, expt(2, i′_{1}))), expt(2, i′_{2}))) = 0

Applying both_sides_expt_gt1_le Instantiating the top quantifier in -1 with the terms: 2, k′_{1}, i′_{2}, Simplifying, rewriting, and recording with decision procedures, This completes the proof of cut_bits_cut_bits.1.2.

cut_bits_cut_bits.2:

{-1} n′ ≥ 0
{-2} i′_{1} ≥ 0
{-3} k′_{1} ≥ 0
{-4} i′_{2} ≥ 0
{-5} k′_{2} ≥ 0
{-6} i′_{2} + k′_{2} > k′_{1}
{1} i′_{2} ≥ k′_{1}

{2} cut_bits(cut_bits(n′, i′_{1}, k′_{1}), i′_{2}, k′_{2}) = cut_bits(n′, i′_{1} + i′_{2}, k′_{1} − i′_{2})

Installing automatic rewrites from: cut_bits rem_ndiv expt_plus Simplifying, rewriting, and recording with decision procedures, Rewriting using ndiv_times_2, matching in *, Applying rem_mod Instantiating the top quantifier in -1 with the terms: expt(2, i′_{1} + i′_{2} + k′_{2}), rem(expt(2, i′_{1} + k′_{1}))(n′), we get 2 subgoals:

cut_bits_cut_bits.2.1:

{-1} rem(expt(2, i′_{1} + i′_{2} + k′_{2}))(rem(expt(2, i′_{1} + k′_{1}))(n′)) =

rem(expt(2, i′_{1} + k′_{1}))(n′)

{-2} n′ ≥ 0
{-3} i′_{1} ≥ 0
{-4} k′_{1} ≥ 0
{-5} i′_{2} ≥ 0
{-6} k′_{2} ≥ 0
{-7} i′_{2} + k′_{2} > k′_{1}
{1} i′_{2} ≥ k′_{1}

{2} ndiv(rem(expt(2, i′_{1} + i′_{2} + k′_{2}))

(rem(expt(2, i′_{1} + k′_{1}))(n′)),

expt(2, i′_{1} + i′_{2}))

= ndiv(rem(expt(2, i′_{1} + k′_{1}))(n′), expt(2, i′_{1} + i′_{2}))

Simplifying, rewriting, and recording with decision procedures, This completes the proof of cut_bits_cut_bits.2.1.

cut_bits_cut_bits.2.2:

{-1} n′ ≥ 0
{-2} i′_{1} ≥ 0
{-3} k′_{1} ≥ 0
{-4} i′_{2} ≥ 0
{-5} k′_{2} ≥ 0
{-6} i′_{2} + k′_{2} > k′_{1}
{1} rem(expt(2, i′_{1} + k′_{1}))(n′) < expt(2, i′_{1} + i′_{2} + k′_{2})
{2} i′_{2} ≥ k′_{1}
{3} ndiv(rem(expt(2, i′_{1} + i′_{2} + k′_{2}))
(rem(expt(2, i′_{1} + k′_{1}))(n′)),
expt(2, i′_{1} + i′_{2}))

= ndiv(rem(expt(2, i′_{1} + k′_{1}))(n′), expt(2, i′_{1} + i′_{2}))

Hiding formulas: 3, Applying both_sides_expt_gt1_le Instantiating the top quantifier in -1 with the terms: 2, i′_{1} + k′_{1}, i′_{1} + i′_{2} + k′_{2}, Simplifying, rewriting, and recording with decision procedures, Adding type constraints for rem(expt(2, i1!1 + k1!1))(n!1), Simplifying, rewriting, and recording with decision procedures, This completes the proof of cut_bits_cut_bits.2.2.

cut_bits_cut_bits.3:

{-1} n′ ≥ 0
{-2} i′_{1} ≥ 0
{-3} k′_{1} ≥ 0
{-4} i′_{2} ≥ 0
{-5} k′_{2} ≥ 0
{1} i′_{2} ≥ k′_{1}
{2} i′_{2} + k′_{2} > k′_{1}
{3} cut_bits(cut_bits(n′, i′_{1}, k′_{1}), i′_{2}, k′_{2}) = cut_bits(n′, i′_{1} + i′_{2}, k′_{2})

Installing automatic rewrites from: cut_bits rem_ndiv expt_plus Simplifying, rewriting, and recording with decision procedures, Rewriting using ndiv_times_2, matching in *, Rewriting using rem_rem, matching in *, Hiding formulas: 4, Rewriting using expt_divides, matching in *, This completes the proof of cut_bits_cut_bits.3. Q.E.D.

C.17.13 Bits.cut_bit_cut_bits

Terse proof for cut_bit_cut_bits.
cut_bit_cut_bits:

{1} ∀ (n, i_{1}, k_{1}, i_{2}: nat):
cut_bit(cut_bits(n, i_{1}, k_{1}), i_{2}) =

if i_{2} ≥ k_{1} then false else cut_bit(n, i_{1} + i_{2}) endif

Repeatedly Skolemizing and flattening, Rewriting using cut_bit_bits, matching in *, Rewriting using cut_bit_bits, matching in *, Rewriting using cut_bits_cut_bits, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cut_bit_cut_bits. Q.E.D.

C.17.14 Bits.shift_bits_left_less_TCC1

Terse proof for shift_bits_left_less_TCC1.
shift_bits_left_less_TCC1:

{1} ∀ (i, k: nat): k ≥ i ⊃ k − i ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of shift_bits_left_less_TCC1.

Q.E.D.

C.17.15 Bits.shift_bits_left_less

Terse proof for shift_bits_left_less.
shift_bits_left_less:

{1} ∀ (n, i, k: nat):

k ≥ i ∧ n < expt(2, k − i) ⊃ shift_bits_left(n, i) < expt(2, k)

Repeatedly Skolemizing and flattening, Expanding the definition of shift_bits_left, Applying both_sides_times_pos_lt1 Instantiating the top quantifier in -1 with the terms: expt(2, i′), n′, expt(2, k′ − i′), we get 2 subgoals:

shift_bits_left_less.1:

{-1} n′ × expt(2, i′) < expt(2, k′ − i′) × expt(2, i′) ≡
n′ < expt(2, k′ − i′)
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} k′ ≥ 0
{-5} k′ ≥ i′
{-6} n′ < expt(2, k′ − i′)
{1} n′ × expt(2, i′) < expt(2, k′)

Rewriting using expt_plus, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of shift_bits_left_less.1.

shift_bits_left_less.2:

{-1} n′ ≥ 0
{-2} i′ ≥ 0
{-3} k′ ≥ 0
{-4} k′ ≥ i′
{-5} n′ < expt(2, k′ − i′)
{1} k′ − i′ ≥ 0
{2} n′ × expt(2, i′) < expt(2, k′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of shift_bits_left_less.2. Q.E.D.

C.17.16 Bits.aligned_shift_bits_ok

Terse proof for aligned_shift_bits_ok.
aligned_shift_bits_ok:

{1} ∀ (n, i, j: nat): i ≤ j ⊃ aligned?(i)(shift_bits_left(n, j))

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Expanding the definition of shift_bits_left, Rewriting using divides_prod2, matching in *, Rewriting using expt_divides, matching in *, This completes the proof of aligned_shift_bits_ok. Q.E.D.

C.17.17 Bits.aligned_shift_bits_reduce_TCC1

Terse proof for aligned_shift_bits_reduce_TCC1.
aligned_shift_bits_reduce_TCC1:

{1} ∀ (i, j: nat): i > j ⊃ i − j ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of aligned_shift_bits_reduce_TCC1.

Q.E.D.

C.17.18 Bits.aligned_shift_bits_reduce

Terse proof for aligned_shift_bits_reduce.
aligned_shift_bits_reduce:

{1} ∀ (n, i, j: nat):

i > j ∧ aligned?(i − j)(n) ⊃ aligned?(i)(shift_bits_left(n, j))

Repeatedly Skolemizing and flattening, Expanding the definition of aligned?, Expanding the definition of shift_bits_left, Applying expt_plus Instantiating the top quantifier in -1 with the terms: 2, i′ − j′, j′, we get 2 subgoals:

aligned_shift_bits_reduce.1:

{-1} expt(2, i′ − j′) × expt(2, j′) = expt(2, i′ − j′ + j′)
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} j′ ≥ 0
{-5} i′ > j′
{-6} divides(expt(2, i′ − j′), n′)
{1} divides(expt(2, i′), n′ × expt(2, j′))

Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Using lemma divides_prod_elim2, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_shift_bits_reduce.1.
aligned_shift_bits_reduce.2:

{-1} n′ ≥ 0
{-2} i′ ≥ 0
{-3} j′ ≥ 0
{-4} i′ > j′
{-5} divides(expt(2, i′ − j′), n′)
{1} i′ − j′ ≥ 0
{2} divides(expt(2, i′), n′ × expt(2, j′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_shift_bits_reduce.2.

Q.E.D.

C.17.19 Bits.overwrite_bits_TCC1

Terse proof for overwrite_bits_TCC1.
overwrite_bits_TCC1:

{1} ∀ (n, m, i, k: nat): n − rem(expt(2, i + k))(n) + shift_bits_left (cut_bits(m, i, k), i) + rem(expt(2, i))(n) ≥ 0

Repeatedly Skolemizing and flattening, Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, This completes the proof of overwrite_bits_TCC1. Q.E.D.

C.17.20 Bits.overwrite_bits_less

Terse proof for overwrite_bits_less.
overwrite_bits_less:

{1} ∀ (n, m, i, k, j: nat):

n < expt(2, j) ∧ i + k ≤ j ⊃ overwrite_bits(n, m, i, k) < expt(2, j)

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_bits, Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Applying bit_split_less Instantiating the top quantifier in -1 with the terms: q′, rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(m′, i′, k′), i′),

j′ − i′ − k′, i′ + k′, Simplifying, rewriting, and recording with decision procedures, Splitting conjunctions, we get 2 subgoals:

overwrite_bits_less.1:

{-1} q′ ≥ 0
{-2} n′ = rem(expt(2, i′ + k′))(n′) + expt(2, i′ + k′) × q′
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} k′ ≥ 0
{-7} j′ ≥ 0
{-8} n′ < expt(2, j′)
{-9} i′ + k′ ≤ j′
{1} q′ < expt(2, −1 × i′ − k′ + j′)

{2} rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(m′, i′, k′), i′) − rem(expt(2, i′ + k′))(n′) + n′ < expt(2, j′)

Hiding formulas: 2, Applying both_sides_times_pos_ge2 Instantiating the top quantifier in -1 with the terms: expt(2, i′ + k′), q′, expt(2, −1 × i′ − k′ + j′), Rewriting using expt_plus, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of overwrite_bits_less.1.

overwrite_bits_less.2:

{-1} q′ ≥ 0
{-2} n′ = rem(expt(2, i′ + k′))(n′) + expt(2, i′ + k′) × q′
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} k′ ≥ 0
{-7} j′ ≥ 0
{-8} n′ < expt(2, j′)
{-9} i′ + k′ ≤ j′

{1} rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(m′, i′, k′), i′) <

expt(2, i′ + k′) {2} rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(m′, i′, k′), i′) − rem(expt(2, i′ + k′))(n′) + n′

< expt(2, j′)

Hiding formulas: 2, Expanding the definition of shift_bits_left, Applying bit_split_less Instantiating the top quantifier in -1 with the terms: cut_bits(m′, i′, k′), rem(expt(2, i′))(n′), k′, i′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of overwrite_bits_less.2. Q.E.D.

C.17.21 Bits.overwrite_bit_less

Terse proof for overwrite_bit_less.
overwrite_bit_less:

{1} ∀ (n, m, i, k: nat):

n < expt(2, k) ∧ i < k ⊃ overwrite_bit(n, m, i) < expt(2, k)

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_bit, Rewriting using overwrite_bits_less, matching in *, This completes the proof of overwrite_bit_less. Q.E.D.

C.17.22 Bits.overwrite_bool_bit_less

Terse proof for overwrite_bool_bit_less.
overwrite_bool_bit_less:

{1} ∀ (n: nat, b: bool, i, k: nat):

n < expt(2, k) ∧ i < k ⊃ overwrite_bool_bit(n, b, i) < expt(2, k)

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_bool_bit, Rewriting using overwrite_bit_less, matching in *, This completes the proof of overwrite_bool_bit_less. Q.E.D.

C.17.23 Bits.overwrite_shift_bits_less

Terse proof for overwrite_shift_bits_less.
overwrite_shift_bits_less:

{1} ∀ (n, m, i, k, j: nat):

n < expt(2, j) ∧ i + k ≤ j ⊃

overwrite_shift_bits(n, m, i, k) < expt(2, j)

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_shift_bits, Rewriting using overwrite_bits_less, matching in *,

This completes the proof of overwrite_shift_bits_less.

Q.E.D.

C.17.24 Bits.aligned_overwrite_shift_bits_more

Terse proof for aligned_overwrite_shift_bits_more.
aligned_overwrite_shift_bits_more:

{1} ∀ (a, n, m, i: nat, k: posnat):

a ≤ i ∧ aligned?(a)(n) ⊃ aligned?(a)(overwrite_shift_bits(n, m, i, k))

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_shift_bits, Expanding the definition of overwrite_bits, Applying aligned_plus_n Instantiating the top quantifier in -1 with the terms: a′, n′ − rem(expt(2, i′ + k′))(n′),

rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′), we get 3 subgoals:

aligned_overwrite_shift_bits_more.1:

{-1} aligned?(a′)

(n′ − rem(expt(2, i′ + k′))(n′) + rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′))

{-2} a′ ≥ 0
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} k′ > 0
{-7} a′ ≤ i′
{-8} aligned?(a′)(n′)

{1} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′) − rem(expt(2, i′ + k′))(n′) + n′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_more.1.
aligned_overwrite_shift_bits_more.2:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} a′ ≤ i′
{-7} aligned?(a′)(n′)

{1} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′))

{2} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′) − rem(expt(2, i′ + k′))(n′) + n′)

Hiding formulas: 2, Rewriting using aligned_plus_n, matching in *, we get 2 subgoals:

aligned_overwrite_shift_bits_more.2.1:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} a′ ≤ i′
{-7} aligned?(a′)(n′)
{1} aligned?(a′)(shift_bits_left(cut_bits(shift_bits_left(m′, i′), i′, k′), i′))

{2} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′))

Hiding formulas: 2, Rewriting using aligned_shift_bits_ok, matching in *,

This completes the proof of aligned_overwrite_shift_bits_more.2.1.

aligned_overwrite_shift_bits_more.2.2:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} a′ ≤ i′
{-7} aligned?(a′)(n′)
{1} aligned?(a′)(rem(expt(2, i′))(n′))

{2} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′))

Rewriting using aligned_rem, matching in *,

This completes the proof of aligned_overwrite_shift_bits_more.2.2.
aligned_overwrite_shift_bits_more.3:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} a′ ≤ i′
{-7} aligned?(a′)(n′)

{1} n′ − rem(expt(2, i′ + k′))(n′) ≥ 0 ∧

aligned?(a′)(n′ − rem(expt(2, i′ + k′))(n′)) {2} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′) − rem(expt(2, i′ + k′))(n′) + n′)

Hiding formulas: 2, Applying propositional simplification, we get 2 subgoals:

aligned_overwrite_shift_bits_more.3.1:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} a′ ≤ i′
{-7} aligned?(a′)(n′)
{1} n′ − rem(expt(2, i′ + k′))(n′) ≥ 0

Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_more.3.1.

aligned_overwrite_shift_bits_more.3.2:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} a′ ≤ i′
{-7} aligned?(a′)(n′)
{1} aligned?(a′)(n′ − rem(expt(2, i′ + k′))(n′))

Applying aligned_minus Instantiating the top quantifier in -1 with the terms: a′, a′, n′, rem(expt(2, i′ + k′))(n′), we get 2 subgoals:

aligned_overwrite_shift_bits_more.3.2.1:

{-1} n′ ≥ rem(expt(2, i′ + k′))(n′) ⊃

aligned?(min(a′, a′))(n′ − rem(expt(2, i′ + k′))(n′))

{-2} a′ ≥ 0
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} k′ > 0
{-7} a′ ≤ i′
{-8} aligned?(a′)(n′)
{1} aligned?(a′)(n′ − rem(expt(2, i′ + k′))(n′))

Expanding the definition of min, Simplifying, rewriting, and recording with decision procedures, Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_more.3.2.1.
aligned_overwrite_shift_bits_more.3.2.2:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} a′ ≤ i′
{-7} aligned?(a′)(n′)
{1} aligned?(a′)(rem(expt(2, i′ + k′))(n′))
{2} aligned?(a′)(n′ − rem(expt(2, i′ + k′))(n′))

Rewriting using aligned_rem, matching in *,

This completes the proof of aligned_overwrite_shift_bits_more.3.2.2.

Q.E.D.

C.17.25 Bits.aligned_overwrite_shift_bits_less_TCC1

Terse proof for aligned_overwrite_shift_bits_less_TCC1.

aligned_overwrite_shift_bits_less_TCC1:

{1} ∀ (a, n, i: nat): aligned?(a)(n) ∧ i < a ⊃ a − i ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of aligned_overwrite_shift_bits_less_TCC1.

Q.E.D.

C.17.26 Bits.aligned_overwrite_shift_bits_less

Terse proof for aligned_overwrite_shift_bits_less.
aligned_overwrite_shift_bits_less:

{1} ∀ (a, n, m, i: nat, k: posnat):

i < a ∧ aligned?(a)(n) ∧ aligned?(a − i)(m) ⊃ aligned?(a)(overwrite_shift_bits(n, m, i, k))

Installing automatic rewrites from: aligned_shift_bits_reduce ndiv_times_divident_2 ndiv_self aligned_rem divides_reflexive

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_shift_bits, Expanding the definition of overwrite_bits, Applying aligned_plus_n Instantiating the top quantifier in -1 with the terms: a′, n′ − rem(expt(2, i′ + k′))(n′),

rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′), we get 3 subgoals:

aligned_overwrite_shift_bits_less.1:

{-1} aligned?(a′)

(n′ − rem(expt(2, i′ + k′))(n′) + rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′))

{-2} a′ ≥ 0
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} k′ > 0
{-7} i′ < a′
{-8} aligned?(a′)(n′)
{-9} aligned?(a′ − i′)(m′)
{1} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′) − rem(expt(2, i′ + k′))(n′) + n′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_less.1.

aligned_overwrite_shift_bits_less.2:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} i′ < a′
{-7} aligned?(a′)(n′)
{-8} aligned?(a′ − i′)(m′)

{1} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′))

{2} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′) − rem(expt(2, i′ + k′))(n′) + n′)

Hiding formulas: 2, Rewriting using aligned_plus_n, matching in *, we get 2 subgoals:

aligned_overwrite_shift_bits_less.2.1:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} i′ < a′
{-7} aligned?(a′)(n′)
{-8} aligned?(a′ − i′)(m′)
{1} aligned?(a′)(shift_bits_left(cut_bits(shift_bits_left(m′, i′), i′, k′), i′))

{2} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′))

Hiding formulas: 2, Rewriting using aligned_shift_bits_reduce, matching in *, Hiding formulas: 2, Expanding the definition of cut_bits, Expanding the definition of shift_bits_left, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_less.2.1.
aligned_overwrite_shift_bits_less.2.2:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} i′ < a′
{-7} aligned?(a′)(n′)
{-8} aligned?(a′ − i′)(m′)
{1} aligned?(a′)(rem(expt(2, i′))(n′))

{2} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_less.2.2.

aligned_overwrite_shift_bits_less.3:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} i′ < a′
{-7} aligned?(a′)(n′)
{-8} aligned?(a′ − i′)(m′)

{1} n′ − rem(expt(2, i′ + k′))(n′) ≥ 0 ∧

aligned?(a′)(n′ − rem(expt(2, i′ + k′))(n′)) {2} aligned?(a′)

(rem(expt(2, i′))(n′) + shift_bits_left (cut_bits(shift_bits_left (m′, i′), i′, k′), i′) − rem(expt(2, i′ + k′))(n′) + n′)

Hiding formulas: 2, Applying propositional simplification, we get 2 subgoals:

aligned_overwrite_shift_bits_less.3.1:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} i′ < a′
{-7} aligned?(a′)(n′)
{-8} aligned?(a′ − i′)(m′)
{1} n′ − rem(expt(2, i′ + k′))(n′) ≥ 0

Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_less.3.1.
aligned_overwrite_shift_bits_less.3.2:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} i′ < a′
{-7} aligned?(a′)(n′)
{-8} aligned?(a′ − i′)(m′)
{1} aligned?(a′)(n′ − rem(expt(2, i′ + k′))(n′))

Applying aligned_minus Instantiating the top quantifier in -1 with the terms: a′, a′, n′, rem(expt(2, i′ + k′))(n′), we get 2 subgoals:

aligned_overwrite_shift_bits_less.3.2.1:

{-1} n′ ≥ rem(expt(2, i′ + k′))(n′) ⊃

aligned?(min(a′, a′))(n′ − rem(expt(2, i′ + k′))(n′))

{-2} a′ ≥ 0
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} i′ ≥ 0
{-6} k′ > 0
{-7} i′ < a′
{-8} aligned?(a′)(n′)
{-9} aligned?(a′ − i′)(m′)
{1} aligned?(a′)(n′ − rem(expt(2, i′ + k′))(n′))

Expanding the definition of min, Simplifying, rewriting, and recording with decision procedures, Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_less.3.2.1.
aligned_overwrite_shift_bits_less.3.2.2:

{-1} a′ ≥ 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ > 0
{-6} i′ < a′
{-7} aligned?(a′)(n′)
{-8} aligned?(a′ − i′)(m′)
{1} aligned?(a′)(rem(expt(2, i′ + k′))(n′))
{2} aligned?(a′)(n′ − rem(expt(2, i′ + k′))(n′))

Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of aligned_overwrite_shift_bits_less.3.2.2.

Q.E.D.

C.17.27 Bits.cut_bits_shift_bits_left_TCC1

Terse proof for cut_bits_shift_bits_left_TCC1.
cut_bits_shift_bits_left_TCC1:

{1} ∀ (si, ci, ck: nat): ci < si ∧ ¬ ci + ck ≤ si ⊃ si − ci ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of cut_bits_shift_bits_left_TCC1.

Q.E.D.

C.17.28 Bits.cut_bits_shift_bits_left_TCC2

Terse proof for cut_bits_shift_bits_left_TCC2.

cut_bits_shift_bits_left_TCC2:

{1} ∀ (si, ci, ck: nat): ¬ ci < si ∧ ¬ ci + ck ≤ si ⊃ ci − si ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of cut_bits_shift_bits_left_TCC2.

Q.E.D.

C.17.29 Bits.cut_bits_shift_bits_left

Terse proof for cut_bits_shift_bits_left.
cut_bits_shift_bits_left:

{1} ∀ (n, si, ci, ck: nat):

cut_bits(shift_bits_left(n, si), ci, ck) = if ci + ck ≤ si then 0

elsif ci < si then cut_bits(shift_bits_left(n, si − ci), 0, ck) else cut_bits(n, ci − si, ck) endif

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

cut_bits_shift_bits_left.1:

{-1} n′ ≥ 0
{-2} si′ ≥ 0
{-3} ci′ ≥ 0
{-4} ck′ ≥ 0
{-5} ci′ + ck′ ≤ si′
{1} cut_bits(shift_bits_left(n′, si′), ci′, ck′) = 0

Expanding the definition of cut_bits, Rewriting using rem_def2, matching in *, Expanding the definition of shift_bits_left, Installing automatic rewrites from: ndiv_times_divident_2 expt_divides ndiv_expt_expt Simplifying, rewriting, and recording with decision procedures, Rewriting using divides_prod2, matching in *,

This completes the proof of cut_bits_shift_bits_left.1.
cut_bits_shift_bits_left.2:

{-1} n′ ≥ 0
{-2} si′ ≥ 0
{-3} ci′ ≥ 0
{-4} ck′ ≥ 0
{-5} ci′ < si′
{1} ci′ + ck′ ≤ si′

{2} cut_bits(shift_bits_left(n′, si′), ci′, ck′) = cut_bits(shift_bits_left(n′, si′ − ci′), 0, ck′)

Expanding the definition of shift_bits_left, Expanding the definition of cut_bits,

Installing automatic rewrites from: ndiv_times_divident_2 expt_divides ndiv_expt_expt expt_x0_aux ndiv_1

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_shift_bits_left.2.
cut_bits_shift_bits_left.3:

{-1} n′ ≥ 0
{-2} si′ ≥ 0
{-3} ci′ ≥ 0
{-4} ck′ ≥ 0
{1} ci′ + ck′ ≤ si′
{2} ci′ < si′
{3} cut_bits(shift_bits_left(n′, si′), ci′, ck′) = cut_bits(n′, ci′ − si′, ck′)

Expanding the definition of shift_bits_left, Expanding the definition of cut_bits, Case splitting on ndiv(n!1 * expt(2, si!1), expt(2, ci!1)) = ndiv(n!1, expt(2, ci!1 - si!1)), we get 2 subgoals:

cut_bits_shift_bits_left.3.1:

{-1} ndiv(n′ × expt(2, si′), expt(2, ci′)) = ndiv(n′, expt(2, ci′ − si′))

{-2} n′ ≥ 0
{-3} si′ ≥ 0
{-4} ci′ ≥ 0
{-5} ck′ ≥ 0
{1} ci′ + ck′ ≤ si′
{2} ci′ < si′

{3} rem(expt(2, ck′))(ndiv(n′ × expt(2, si′), expt(2, ci′))) = rem(expt(2, ck′))(ndiv(n′, expt(2, ci′ − si′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_shift_bits_left.3.1.
cut_bits_shift_bits_left.3.2:

{-1} n′ ≥ 0
{-2} si′ ≥ 0
{-3} ci′ ≥ 0
{-4} ck′ ≥ 0

{1} ndiv(n′ × expt(2, si′), expt(2, ci′)) = ndiv(n′, expt(2, ci′ − si′))

{2} ci′ + ck′ ≤ si′
{3} ci′ < si′

{4} rem(expt(2, ck′))(ndiv(n′ × expt(2, si′), expt(2, ci′))) = rem(expt(2, ck′))(ndiv(n′, expt(2, ci′ − si′)))

Installing automatic rewrites from: expt_plus Rewriting using ndiv_reduce, matching in *, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_shift_bits_left.3.2.

Q.E.D.

C.17.30 Bits.cut_bits_shift_bits_left_outside

Terse proof for cut_bits_shift_bits_left_outside.

cut_bits_shift_bits_left_outside:

{1} ∀ (n, si, ci, ck: nat):

ci + ck ≤ si ⊃ cut_bits(shift_bits_left(n, si), ci, ck) = 0

Repeatedly Skolemizing and flattening, Rewriting using cut_bits_shift_bits_left, matching in *, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_shift_bits_left_outside.

Q.E.D.

C.17.31 Bits.cut_bits_shift_bits_left_overlap_TCC1

Terse proof for cut_bits_shift_bits_left_overlap_TCC1.
cut_bits_shift_bits_left_overlap_TCC1:

{1} ∀ (si, ci, ck: nat): ci + ck > si ∧ ci < si ∧ ci > 0 ⊃ si − ci ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of cut_bits_shift_bits_left_overlap_TCC1.

Q.E.D.

C.17.32 Bits.cut_bits_shift_bits_left_overlap

Terse proof for cut_bits_shift_bits_left_overlap.
cut_bits_shift_bits_left_overlap:

{1} ∀ (n, si, ci, ck: nat):

ci + ck > si ∧ ci < si ∧ ci > 0 ⊃

cut_bits(shift_bits_left(n, si), ci, ck) = cut_bits(shift_bits_left(n, si − ci), 0, ck)

Repeatedly Skolemizing and flattening, Rewriting using cut_bits_shift_bits_left, matching in *, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_shift_bits_left_overlap.

Q.E.D.

C.17.33 Bits.cut_bits_shift_bits_left_in

Terse proof for cut_bits_shift_bits_left_in.
cut_bits_shift_bits_left_in:

{1} ∀ (n, si, ci, ck: nat):

ci ≥ si ⊃ cut_bits(shift_bits_left(n, si), ci, ck) = cut_bits(n, ci − si, ck)

Repeatedly Skolemizing and flattening, Rewriting using cut_bits_shift_bits_left, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on ck!1 = 0, we get 2 subgoals:

cut_bits_shift_bits_left_in.1:

{-1} ck′ = 0
{-2} n′ ≥ 0
{-3} si′ ≥ 0
{-4} ci′ ≥ 0
{-5} ck′ ≥ 0
{-6} ci′ ≥ si′
{-7} ci′ + ck′ ≤ si′
{1} 0 = cut_bits(n′, ci′ − si′, ck′)

Expanding the definition of cut_bits, Replacing using formula -1, Rewriting using expt_x0_aux, matching in *, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_shift_bits_left_in.1.
cut_bits_shift_bits_left_in.2:

{-1} n′ ≥ 0
{-2} si′ ≥ 0
{-3} ci′ ≥ 0
{-4} ck′ ≥ 0
{-5} ci′ ≥ si′
{-6} ci′ + ck′ ≤ si′
{1} ck′ = 0
{2} 0 = cut_bits(n′, ci′ − si′, ck′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_shift_bits_left_in.2.

Q.E.D.

C.17.34 Bits.overwrite_shift_bits_zero

Terse proof for overwrite_shift_bits_zero.
overwrite_shift_bits_zero:

{1} ∀ (z, m, i, k: nat):

z = 0 ⊃ overwrite_shift_bits(z, m, i, k) = shift_bits_left(cut_bits(m, 0, k), i)

Repeatedly Skolemizing and flattening, Replacing using formula -5, Expanding the definition of overwrite_shift_bits, Expanding the definition of overwrite_bits, Rewriting using rem_zero, matching in *, Rewriting using rem_zero, matching in *, Simplifying, rewriting, and recording with decision procedures, Rewriting using cut_bits_shift_bits_left, matching in *, Case splitting on k!1 = 0, we get 2 subgoals:

overwrite_shift_bits_zero.1:

{-1} k′ = 0
{-2} 0 ≥ 0
{-3} m′ ≥ 0
{-4} i′ ≥ 0
{-5} k′ ≥ 0
{-6} z′ = 0

{1} shift_bits_left(if i′ + k′ ≤ i′ then 0 else cut_bits(m′, 0, k′) endif, i′) = shift_bits_left(cut_bits(m′, 0, k′), i′)

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Rewriting using zero_cut_bits, matching in *,

This completes the proof of overwrite_shift_bits_zero.1.
overwrite_shift_bits_zero.2:

{-1} 0 ≥ 0
{-2} m′ ≥ 0
{-3} i′ ≥ 0
{-4} k′ ≥ 0
{-5} z′ = 0
{1} k′ = 0

{2} shift_bits_left(if i′ + k′ ≤ i′ then 0 else cut_bits(m′, 0, k′) endif, i′) = shift_bits_left(cut_bits(m′, 0, k′), i′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of overwrite_shift_bits_zero.2.

Q.E.D.

C.17.35 Bits.zero_overwrite_shift_bits

Terse proof for zero_overwrite_shift_bits.
zero_overwrite_shift_bits:

{1} ∀ (n, m, i, k: nat): k = 0 ⊃ overwrite_shift_bits(n, m, i, k) = n

Repeatedly Skolemizing and flattening, Replacing using formula -5, Hiding formulas: -4, -5, Expanding the definition of overwrite_shift_bits, Expanding the definition of overwrite_bits, Rewriting using zero_cut_bits, matching in *, Expanding the definition of shift_bits_left, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of zero_overwrite_shift_bits.

Q.E.D.

C.17.36 Bits.bit_split_TCC1

Terse proof for bit_split_TCC1.
bit_split_TCC1:

{1} ∀ (n, i, k: nat): k ≤ i ∧ n < expt(2, i) ⊃ i − k ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of bit_split_TCC1. Q.E.D.

C.17.37 Bits.bit_split

Terse proof for bit_split.

bit_split:

{1} ∀ (n, i, k: nat):

k ≤ i ∧ n < expt(2, i) ⊃ n = overwrite_shift_bits(cut_bits(n, 0, k), cut_bits(n, k, i − k), k,

i − k)

Repeatedly Skolemizing and flattening, Case splitting on k!1 = i!1, we get 2 subgoals:

bit_split.1:

{-1} k′ = i′
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} k′ ≥ 0
{-5} k′ ≤ i′
{-6} n′ < expt(2, i′)
{1} n′ =

overwrite_shift_bits(cut_bits(n′, 0, k′), cut_bits(n′, k′, i′ − k′), k′, i′ − k′)

Simplifying, rewriting, and recording with decision procedures, Applying zero_cut_bits Instantiating the top quantifier in -1 with the terms: n′, k′, i′ − k′, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Rewriting using zero_overwrite_shift_bits, matching in *, Expanding the definition of cut_bits, Rewriting using rem_mod, matching in *, Rewriting using expt_x0_aux, matching in *, Rewriting using ndiv_1, matching in *, This completes the proof of bit_split.1.

bit_split.2:

{-1} n′ ≥ 0
{-2} i′ ≥ 0
{-3} k′ ≥ 0
{-4} k′ ≤ i′
{-5} n′ < expt(2, i′)
{1} k′ = i′
{2} n′ =

overwrite_shift_bits(cut_bits(n′, 0, k′), cut_bits(n′, k′, i′ − k′), k′, i′ − k′)

Expanding the definition of overwrite_shift_bits, Expanding the definition of overwrite_bits, Rewriting using cut_bits_shift_bits_left, matching in *, Simplifying, rewriting, and recording with decision procedures, Rewriting using cut_bits_cut_bits, matching in *, Rewriting using rem_mod, matching in *, Rewriting using rem_mod, matching in *, we get 2 subgoals:

bit_split.2.1:

{-1} n′ ≥ 0
{-2} i′ ≥ 0
{-3} k′ ≥ 0
{-4} k′ ≤ i′
{-5} n′ < expt(2, i′)
{1} k′ = i′
{2} n′ =

cut_bits(n′, 0, k′) + shift_bits_left (cut_bits(n′, k′, i′ − k′), k′) + cut_bits(n′, 0, k′) − cut_bits(n′, 0, k′)

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of shift_bits_left, Expanding the definition of cut_bits, Rewriting using expt_x0_aux, matching in *, Rewriting using ndiv_1, matching in *, Rewriting using rem_ndiv, matching in *, Rewriting using expt_plus, matching in *, Applying rem_mod Instantiating the top quantifier in -1 with the terms: expt(2, i′), n′, Replacing using formula -1, Hiding formulas: -1, Using lemma number_split, Simplifying, rewriting, and recording with decision procedures, This completes the proof of bit_split.2.1.

bit_split.2.2:

{-1} n′ ≥ 0
{-2} i′ ≥ 0
{-3} k′ ≥ 0
{-4} k′ ≤ i′
{-5} n′ < expt(2, i′)
{1} cut_bits(n′, 0, k′) < expt(2, i′)
{2} k′ = i′
{3} n′ =

shift_bits_left (cut_bits(n′, k′, i′ − k′), k′) + 2 × cut_bits(n′, 0, k′) − rem(expt(2, i′))(cut_bits(n′, 0, k′))

Hiding formulas: 3, Using lemma both_sides_expt_gt1_le, Simplifying, rewriting, and recording with decision procedures, This completes the proof of bit_split.2.2. Q.E.D.

C.17.38 Bits.shift_bits_left_cut_bits

Terse proof for shift_bits_left_cut_bits.

shift_bits_left_cut_bits:

{1} ∀ (n, i, k, j: nat):

i = j ∧ aligned?(i)(n) ∧ n < expt(2, i + k) ⊃ shift_bits_left(cut_bits(n, i, k), j) = n

Repeatedly Skolemizing and flattening, Case splitting on k!1 = 0, we get 2 subgoals:

shift_bits_left_cut_bits.1:

{-1} k′ = 0
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} k′ ≥ 0
{-5} j′ ≥ 0
{-6} i′ = j′
{-7} aligned?(i′)(n′)
{-8} n′ < expt(2, i′ + k′)
{1} shift_bits_left(cut_bits(n′, i′, k′), j′) = n′

Replacing using formula -1, Rewriting using zero_cut_bits, matching in *, Expanding the definition of shift_bits_left, Rewriting using zero_times1, matching in *, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of aligned?, Applying rem_mod Instantiating the top quantifier in -1 with the terms: expt(2, i′), n′, Applying rem_def2 Instantiating the top quantifier in -1 with the terms: expt(2, i′), n′, 0, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of shift_bits_left_cut_bits.1.
shift_bits_left_cut_bits.2:

{-1} n′ ≥ 0
{-2} i′ ≥ 0
{-3} k′ ≥ 0
{-4} j′ ≥ 0
{-5} i′ = j′
{-6} aligned?(i′)(n′)
{-7} n′ < expt(2, i′ + k′)
{1} k′ = 0
{2} shift_bits_left(cut_bits(n′, i′, k′), j′) = n′

Using lemma bit_split, Simplifying, rewriting, and recording with decision procedures, Using lemma aligned_cut_bits, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Rewriting using overwrite_shift_bits_zero, matching in *, Rewriting using cut_bits_cut_bits, matching in *, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of shift_bits_left_cut_bits.2.

Q.E.D.

C.17.39 Bits.cut_bits_0_to_below

Terse proof for cut_bits_0_to_below.
cut_bits_0_to_below:

{1} ∀ (n, k: nat): n < expt(2, k) ⊃ cut_bits(n, 0, k) = n

Repeatedly Skolemizing and flattening, Applying shift_bits_left_cut_bits Instantiating the top quantifier in -1 with the terms: n′, 0, k′, 0, Rewriting using zero_aligned, matching in *, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of shift_bits_left, Rewriting using expt_x0_aux, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of cut_bits_0_to_below. Q.E.D.

C.17.40 Bits.cut_bits_overwrite_bits_disjoined

Terse proof for cut_bits_overwrite_bits_disjoined.
cut_bits_overwrite_bits_disjoined:

{1} ∀ (n, m, oi, ok: nat, ci, ck: nat): oi + ok ≤ ci ∨ ci + ck ≤ oi ⊃ cut_bits(overwrite_bits(n, m, oi, ok), ci, ck) = cut_bits(n, ci, ck)

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_bits, Expanding the definition of cut_bits, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cut_bits_overwrite_bits_disjoined.1:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ + ok′ ≤ ci′

{1} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Case splitting on ndiv(rem(expt(2, oi!1))(n!1) + shift_bits_left(rem(expt(2, ok!1))(ndiv(m!1, expt(2, oi!1))), oi!1) - rem(expt(2, oi!1 + ok!1))(n!1) + n!1, expt(2, ci!1)) = ndiv(rem(expt(2, oi!1))(n!1) + shift_bits_left(rem(expt(2, ok!1))(ndiv(m!1, expt(2, oi!1))), oi!1) - rem(expt(2, oi!1 + ok!1))(n!1) + n!1, expt(2, oi!1 + ok!1) * expt(2, ci!1 - oi!1 - ok!1)),

we get 2 subgoals:

cut_bits_overwrite_bits_disjoined.1.1:

{-1} ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)) = ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, oi′ + ok′) × expt(2, ci′ − oi′ − ok′))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ + ok′ ≤ ci′

{1} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Replacing using formula -1, Hiding formulas: -1, Rewriting using ndiv_times_2, matching in *, Applying rem_def2 Instantiating the top quantifier in -1 with the terms: expt(2, oi′ + ok′), n′, rem(expt(2, oi′ + ok′))(n′), Simplifying, rewriting, and recording with decision procedures, Applying ndiv_plus_mod_2 Instantiating the top quantifier in -1 with the terms: n′ − rem(expt(2, oi′ + ok′))(n′),

expt(2, oi′ + ok′), rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′), rem(expt(2, oi′ + ok′))(n′),

we get 2 subgoals:

cut_bits_overwrite_bits_disjoined.1.1.1:

{-1} divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′)) ⊃

ndiv(n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′),

expt(2, oi′ + ok′)) = ndiv(n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ + ok′))(n′),

expt(2, oi′ + ok′))

{-2} divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′))
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} oi′ ≥ 0
{-6} ok′ ≥ 0
{-7} ci′ ≥ 0
{-8} ck′ ≥ 0
{-9} oi′ + ok′ ≤ ci′

{1} rem(expt(2, ck′))

(ndiv(ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, oi′ + ok′)), expt(2, −1 × oi′ − ok′ + ci′)))

= rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Rewriting using ndiv_times_2, matching in *, Rewriting using expt_plus, matching in *,

This completes the proof of cut_bits_overwrite_bits_disjoined.1.1.1.
cut_bits_overwrite_bits_disjoined.1.1.2:

{-1} divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′))
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ + ok′ ≤ ci′

{1} rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′)

< expt(2, oi′ + ok′) {2} rem(expt(2, ck′))

(ndiv(ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, oi′ + ok′)), expt(2, −1 × oi′ − ok′ + ci′)))

= rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Hiding formulas: 2, Expanding the definition of shift_bits_left, Applying bit_split_less Instantiating the top quantifier in -1 with the terms: rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))),

rem(expt(2, oi′))(n′), ok′, oi′, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_disjoined.1.1.2.
cut_bits_overwrite_bits_disjoined.1.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ + ok′ ≤ ci′

{1} ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)) = ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, oi′ + ok′) × expt(2, ci′ − oi′ − ok′))

{2} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Rewriting using expt_plus, matching in *,

This completes the proof of cut_bits_overwrite_bits_disjoined.1.2.

cut_bits_overwrite_bits_disjoined.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′

{1} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Rewriting using rem_ndiv, matching in *, Rewriting using expt_plus, matching in *, Applying same_remainder Instantiating the top quantifier in -1 with the terms: expt(2, ci′ + ck′), rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

n′, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cut_bits_overwrite_bits_disjoined.2.1:

{-1} rem(expt(2, ci′ + ck′))

(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′) = rem(expt(2, ci′ + ck′))(n′)

{-2} divides(expt(2, ci′ + ck′),

rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′))

{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} oi′ ≥ 0
{-6} ok′ ≥ 0
{-7} ci′ ≥ 0
{-8} ck′ ≥ 0
{-9} ci′ + ck′ ≤ oi′

{1} ndiv(rem(expt(2, ci′ + ck′))

(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′), expt(2, ci′))

= rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Replacing using formula -1, Hiding formulas: -1, -2, Rewriting using ndiv_rem_divisible, matching in *, we get 3 subgoals:

cut_bits_overwrite_bits_disjoined.2.1.1:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′

{1} rem(ndiv(expt(2, ci′ + ck′), expt(2, ci′)))(ndiv(n′, expt(2, ci′))) = rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Rewriting using ndiv_expt_expt, matching in *,

This completes the proof of cut_bits_overwrite_bits_disjoined.2.1.1.
cut_bits_overwrite_bits_disjoined.2.1.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′
{1} divides(expt(2, ci′), expt(2, ci′ + ck′))

{2} ndiv(rem(expt(2, ci′ + ck′))(n′), expt(2, ci′)) = rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Rewriting using expt_divides, matching in *,

This completes the proof of cut_bits_overwrite_bits_disjoined.2.1.2.
cut_bits_overwrite_bits_disjoined.2.1.3:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′
{1} expt(2, ci′) ≤ expt(2, ci′ + ck′)

{2} ndiv(rem(expt(2, ci′ + ck′))(n′), expt(2, ci′)) = rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Using lemma both_sides_expt_gt1_le, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_disjoined.2.1.3.
cut_bits_overwrite_bits_disjoined.2.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′

{1} rem(expt(2, ci′ + ck′))

(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′) = rem(expt(2, ci′ + ck′))(n′)

{2} divides(expt(2, ci′ + ck′),

rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′))

{3} ndiv(rem(expt(2, ci′ + ck′))

(rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′) + n′), expt(2, ci′))

= rem(expt(2, ck′))(ndiv(n′, expt(2, ci′)))

Hiding formulas: 1, 3, Applying divides_sum Instantiating the top quantifier in -1 with the terms: rem(expt(2, oi′))(n′) − rem(expt(2, oi′ + ok′))(n′), shift_bits_left(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′), expt(2, ci′ + ck′),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cut_bits_overwrite_bits_disjoined.2.2.1:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′

{1} divides(expt(2, ci′ + ck′),

rem(expt(2, oi′))(n′) − rem(expt(2, oi′ + ok′))(n′))

{2} divides(expt(2, ci′ + ck′),

rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′))

Hiding formulas: 2, Applying divides_diff Instantiating the top quantifier in -1 with the terms: n′ − rem(expt(2, oi′))(n′), n′ − rem(expt(2, oi′ + ok′))(n′),

expt(2, ci′ + ck′), Simplifying, rewriting, and recording with decision procedures, Hiding formulas: 2, Splitting conjunctions, we get 2 subgoals:

cut_bits_overwrite_bits_disjoined.2.2.1.1:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′
{1} divides(expt(2, ci′ + ck′), n′ − rem(expt(2, oi′ + ok′))(n′))

Applying rem_def2 Instantiating the top quantifier in -1 with the terms: expt(2, oi′ + ok′), n′, rem(expt(2, oi′ + ok′))(n′), Simplifying, rewriting, and recording with decision procedures, Applying divides_expt_gt Instantiating the top quantifier in -1 with the terms: n′ − rem(expt(2, oi′ + ok′))(n′), oi′ + ok′,

ci′ + ck′, we get 2 subgoals:

cut_bits_overwrite_bits_disjoined.2.2.1.1.1:

{-1} ci′ + ck′ ≤ oi′ + ok′ ∧ divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′)) ⊃ divides(expt(2, ci′ + ck′), n′ − rem(expt(2, oi′ + ok′))(n′))

{-2} divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′))
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} oi′ ≥ 0
{-6} ok′ ≥ 0
{-7} ci′ ≥ 0
{-8} ck′ ≥ 0
{-9} ci′ + ck′ ≤ oi′
{1} divides(expt(2, ci′ + ck′), n′ − rem(expt(2, oi′ + ok′))(n′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_disjoined.2.2.1.1.1.
cut_bits_overwrite_bits_disjoined.2.2.1.1.2:

{-1} divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′))
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} ci′ + ck′ ≤ oi′
{1} n′ − rem(expt(2, oi′ + ok′))(n′) ≥ 0
{2} divides(expt(2, ci′ + ck′), n′ − rem(expt(2, oi′ + ok′))(n′))

Hiding formulas: -1, 2, Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_disjoined.2.2.1.1.2.
cut_bits_overwrite_bits_disjoined.2.2.1.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′
{1} divides(expt(2, ci′ + ck′), n′ − rem(expt(2, oi′))(n′))

Applying rem_def2 Instantiating the top quantifier in -1 with the terms: expt(2, oi′), n′, rem(expt(2, oi′))(n′), Simplifying, rewriting, and recording with decision procedures, Applying divides_expt_gt Instantiating the top quantifier in -1 with the terms: n′ − rem(expt(2, oi′))(n′), oi′, ci′ + ck′, we get 2 subgoals:

cut_bits_overwrite_bits_disjoined.2.2.1.2.1:

{-1} ci′ + ck′ ≤ oi′ ∧ divides(expt(2, oi′), n′ − rem(expt(2, oi′))(n′)) ⊃ divides(expt(2, ci′ + ck′), n′ − rem(expt(2, oi′))(n′))

{-2} divides(expt(2, oi′), n′ − rem(expt(2, oi′))(n′))
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} oi′ ≥ 0
{-6} ok′ ≥ 0
{-7} ci′ ≥ 0
{-8} ck′ ≥ 0
{-9} ci′ + ck′ ≤ oi′
{1} divides(expt(2, ci′ + ck′), n′ − rem(expt(2, oi′))(n′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_disjoined.2.2.1.2.1.
cut_bits_overwrite_bits_disjoined.2.2.1.2.2:

{-1} divides(expt(2, oi′), n′ − rem(expt(2, oi′))(n′))
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} ci′ + ck′ ≤ oi′
{1} n′ − rem(expt(2, oi′))(n′) ≥ 0
{2} divides(expt(2, ci′ + ck′), n′ − rem(expt(2, oi′))(n′))

Hiding formulas: -1, 2, Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_disjoined.2.2.1.2.2.
cut_bits_overwrite_bits_disjoined.2.2.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} ci′ + ck′ ≤ oi′

{1} divides(expt(2, ci′ + ck′),

shift_bits_left(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′))

{2} divides(expt(2, ci′ + ck′), rem(expt(2, oi′))(n′) + shift_bits_left (rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), oi′) − rem(expt(2, oi′ + ok′))(n′))

Hiding formulas: 2, Expanding the definition of shift_bits_left, Rewriting using divides_prod2, matching in *, Rewriting using expt_divides, matching in *,

This completes the proof of cut_bits_overwrite_bits_disjoined.2.2.2.

Q.E.D.

C.17.41 Bits.cut_bits_overwrite_bool_bit_disjoined

Terse proof for cut_bits_overwrite_bool_bit_disjoined.
cut_bits_overwrite_bool_bit_disjoined:

{1} ∀ (n: nat, b: bool, oi, ci, ck: nat): oi < ci ∨ ci + ck ≤ oi ⊃ cut_bits(overwrite_bool_bit(n, b, oi), ci, ck) = cut_bits(n, ci, ck)

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_bool_bit, Expanding the definition of overwrite_bit, Rewriting using cut_bits_overwrite_bits_disjoined, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cut_bits_overwrite_bool_bit_disjoined.

Q.E.D.

C.17.42 Bits.cut_bits_overwrite_bits_contained

Terse proof for cut_bits_overwrite_bits_contained.
cut_bits_overwrite_bits_contained:

{1} ∀ (n, m, oi, ok, ci, ck: nat):

oi ≤ ci ∧ ci + ck ≤ oi + ok ⊃ cut_bits(overwrite_bits(n, m, oi, ok), ci, ck) = cut_bits(m, ci, ck)

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_bits, Expanding the definition of shift_bits_left, Expanding the definition of cut_bits, Applying number_split Instantiating the top quantifier in -1 with the terms: rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), expt(2,

ci′ − oi′), we get 2 subgoals:

cut_bits_overwrite_bits_contained.1:

{-1} rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) =

expt(2, ci′ − oi′) × ndiv(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), expt(2, ci′ − oi′)) + rem(expt(2, ci′ − oi′))(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Installing automatic rewrites from: expt_divides expt_plus Rewriting using rem_rem, matching in *, we get 2 subgoals:

cut_bits_overwrite_bits_contained.1.1:

{-1} rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) =

expt(2, ci′ − oi′) × ndiv(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), expt(2, ci′ − oi′)) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′)))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Rewriting using ndiv_rem_divisible, matching in -1, we get 3 subgoals:

cut_bits_overwrite_bits_contained.1.1.1:

{-1} rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) =

expt(2, ci′ − oi′) × rem(ndiv(expt(2, ok′), expt(2, ci′ − oi′)))(ndiv(ndiv(m′, expt(2, oi′)), expt(2, ci′ − oi′))) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′)))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Rewriting using ndiv_times_2, matching in *, Rewriting using expt_plus, matching in *, Rewriting using ndiv_expt_expt, matching in *, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Simplifying, rewriting, and recording with decision procedures, Rewriting using associative_mult, matching in *, Applying ndiv_plus_mod Instantiating the top quantifier in -1 with the terms: n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′),

expt(2, ci′), rem(expt(2, oi′))(n′) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′), we get 2 subgoals:

cut_bits_overwrite_bits_contained.1.1.1.1:

{-1} divides(expt(2, ci′),

n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′))

⊃

ndiv(n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′) + rem(expt(2, oi′))(n′) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′),

expt(2, ci′)) = ndiv(n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′),

expt(2, ci′))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Splitting conjunctions, we get 2 subgoals:

cut_bits_overwrite_bits_contained.1.1.1.1.1:

{-1} ndiv(n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′) + rem(expt(2, oi′))(n′) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′),

expt(2, ci′)) = ndiv(n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′),

expt(2, ci′))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Applying ndiv_plus_1 Instantiating the top quantifier in -1 with the terms: rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′),

n′ − rem(expt(2, oi′ + ok′))(n′), expt(2, ci′), Rewriting using divides_prod2, matching in *, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Rewriting using ndiv_times_divident_2, matching in *, Rewriting using ndiv_self, matching in *, Simplifying, rewriting, and recording with decision procedures, Case splitting on n!1 - rem(expt(2, oi!1 + ok!1))(n!1) = ndiv(n!1, expt(2, oi!1 + ok!1)) * expt(2, oi!1

+ ok!1), we get 2 subgoals:

cut_bits_overwrite_bits_contained.1.1.1.1.1.1:

{-1} n′ − rem(expt(2, oi′ + ok′))(n′) =

ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ + ok′)

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, ck′))

(rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) + ndiv(n′ − rem(expt(2, oi′ + ok′))(n′), expt(2, ci′))) = rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Replacing using formula -1, Hiding formulas: -1, Rewriting using ndiv_times_divident_2, matching in *, Rewriting using ndiv_expt_expt, matching in *, Applying rem_sum_elim1 Instantiating the top quantifier in -1 with the terms: expt(2, ck′), rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′,

expt(2, ci′))), ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ − ci′ + ok′), 0, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cut_bits_overwrite_bits_contained.1.1.1.1.1.1.1:

{-1} rem(expt(2, ck′))

(rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) + ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ − ci′ + ok′)) = rem(expt(2, ck′))

(rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))))

{-2} rem(expt(2, ck′))

(ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ − ci′ + ok′)) = rem(expt(2, ck′))(0)

{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} oi′ ≥ 0
{-6} ok′ ≥ 0
{-7} ci′ ≥ 0
{-8} ck′ ≥ 0
{-9} oi′ ≤ ci′
{-10} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, ck′))

(rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) + ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ − ci′ + ok′)) = rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Replacing using formula -1, Rewriting using rem_rem, matching in *,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.1.1.1.1.1.
cut_bits_overwrite_bits_contained.1.1.1.1.1.1.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ ≤ ci′
{-8} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, ck′))

(rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) + ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ − ci′ + ok′)) = rem(expt(2, ck′))

(rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))))

{2} rem(expt(2, ck′))

(ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ − ci′ + ok′)) = rem(expt(2, ck′))(0)

{3} rem(expt(2, ck′))

(rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) + ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ − ci′ + ok′)) = rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Hiding formulas: 1, 3,

Rewriting using rem_zero, matching in *,

Rewriting using rem_def2, matching in *,

Rewriting using divides_prod2, matching in *,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.1.1.1.1.2.
cut_bits_overwrite_bits_contained.1.1.1.1.1.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ ≤ ci′
{-8} ci′ + ck′ ≤ oi′ + ok′

{1} n′ − rem(expt(2, oi′ + ok′))(n′) =

ndiv(n′, expt(2, oi′ + ok′)) × expt(2, oi′ + ok′) {2} rem(expt(2, ck′))

(rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) + ndiv(n′ − rem(expt(2, oi′ + ok′))(n′), expt(2, ci′))) = rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.1.1.1.2.

C Proof scripts

cut_bits_overwrite_bits_contained.1.1.1.1.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ ≤ ci′
{-8} ci′ + ck′ ≤ oi′ + ok′

{1} divides(expt(2, ci′),

n′ − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′))

{2} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Hiding formulas: 2, Rewriting using divides_sum, matching in *, we get 2 subgoals:

cut_bits_overwrite_bits_contained.1.1.1.1.2.1:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ ≤ ci′
{-8} ci′ + ck′ ≤ oi′ + ok′
{1} divides(expt(2, ci′), n′ − rem(expt(2, oi′ + ok′))(n′))

{2} divides(expt(2, ci′),

rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′) − rem(expt(2, oi′ + ok′))(n′) + n′)

Hiding formulas: 2, Applying rem_def2 Instantiating the top quantifier in -1 with the terms: expt(2, oi′ + ok′), n′, rem(expt(2, oi′ + ok′))(n′), Simplifying, rewriting, and recording with decision procedures, Applying divides_expt_gt Instantiating the top quantifier in -1 with the terms: n′ − rem(expt(2, oi′ + ok′))(n′), oi′ + ok′, ci′, we get 2 subgoals:

cut_bits_overwrite_bits_contained.1.1.1.1.2.1.1:

{-1} ci′ ≤ oi′ + ok′ ∧ divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′)) ⊃ divides(expt(2, ci′), n′ − rem(expt(2, oi′ + ok′))(n′))

{-2} divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′))
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} oi′ ≥ 0
{-6} ok′ ≥ 0
{-7} ci′ ≥ 0
{-8} ck′ ≥ 0
{-9} oi′ ≤ ci′
{-10} ci′ + ck′ ≤ oi′ + ok′
{1} divides(expt(2, ci′), n′ − rem(expt(2, oi′ + ok′))(n′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.1.1.2.1.1.
cut_bits_overwrite_bits_contained.1.1.1.1.2.1.2:

{-1} divides(expt(2, oi′ + ok′), n′ − rem(expt(2, oi′ + ok′))(n′))
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′
{1} n′ − rem(expt(2, oi′ + ok′))(n′) ≥ 0
{2} divides(expt(2, ci′), n′ − rem(expt(2, oi′ + ok′))(n′))

Hiding formulas: -1, 2, Using lemma rem_def_pos, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.1.1.2.1.2.
cut_bits_overwrite_bits_contained.1.1.1.1.2.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ ≤ ci′
{-8} ci′ + ck′ ≤ oi′ + ok′

{1} divides(expt(2, ci′),

rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′))

{2} divides(expt(2, ci′), rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′) − rem(expt(2, oi′ + ok′))(n′) + n′)

Hiding formulas: 2, Rewriting using divides_prod2, matching in *,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.1.1.2.2.

C Proof scripts

cut_bits_overwrite_bits_contained.1.1.1.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ ≤ ci′
{-8} ci′ + ck′ ≤ oi′ + ok′

{1} rem(expt(2, oi′))(n′) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′)

< expt(2, ci′) {2} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + rem(expt(2, oi′ − ci′ + ok′))(ndiv(m′, expt(2, ci′))) × expt(2, ci′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Hiding formulas: 2, Applying bit_split_less Instantiating the top quantifier in -1 with the terms: rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))),

rem(expt(2, oi′))(n′), ci′ − oi′, oi′, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.1.2.
cut_bits_overwrite_bits_contained.1.1.2:

{-1} rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) =

rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) + expt(2, ci′ − oi′) × ndiv(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), expt(2, ci′ − oi′))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′
{1} divides(expt(2, ci′ − oi′), expt(2, ok′))

{2} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.2.

C.17 Proofs for Bits (bits.pvs)

cut_bits_overwrite_bits_contained.1.1.3:

{-1} rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) =

rem(expt(2, ci′ − oi′))(ndiv(m′, expt(2, oi′))) + expt(2, ci′ − oi′) × ndiv(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), expt(2, ci′ − oi′))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′
{1} expt(2, ci′ − oi′) ≤ expt(2, ok′)

{2} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Hiding formulas: -1, 2, Using lemma both_sides_expt_gt1_le, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_contained.1.1.3.
cut_bits_overwrite_bits_contained.1.2:

{-1} rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) =

rem(expt(2, ci′ − oi′))(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′)))) + expt(2, ci′ − oi′) × ndiv(rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))), expt(2, ci′ − oi′))

{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} oi′ ≥ 0
{-5} ok′ ≥ 0
{-6} ci′ ≥ 0
{-7} ck′ ≥ 0
{-8} oi′ ≤ ci′
{-9} ci′ + ck′ ≤ oi′ + ok′
{1} divides(expt(2, ci′ − oi′), expt(2, ok′))

{2} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_contained.1.2.

cut_bits_overwrite_bits_contained.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} oi′ ≥ 0
{-4} ok′ ≥ 0
{-5} ci′ ≥ 0
{-6} ck′ ≥ 0
{-7} oi′ ≤ ci′
{-8} ci′ + ck′ ≤ oi′ + ok′
{1} ci′ − oi′ ≥ 0

{2} rem(expt(2, ck′))

(ndiv(rem(expt(2, oi′))(n′) + rem(expt(2, ok′))(ndiv(m′, expt(2, oi′))) × expt(2, oi′) − rem(expt(2, oi′ + ok′))(n′) + n′,

expt(2, ci′)))

= rem(expt(2, ck′))(ndiv(m′, expt(2, ci′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bits_overwrite_bits_contained.2.

Q.E.D.

C.17.43 Bits.cut_bits_overwrite_shift_bits_disjoint

Terse proof for cut_bits_overwrite_shift_bits_disjoint.
cut_bits_overwrite_shift_bits_disjoint:

{1} ∀ (n, m, i_{1}, k_{1}, i_{2}, k_{2}: nat):
i_{1} + k_{1} ≤ i_{2} ∨ i_{2} + k_{2} ≤ i_{1} ⊃

cut_bits(overwrite_shift_bits(n, m, i_{1}, k_{1}), i_{2}, k_{2}) = cut_bits(n, i_{2}, k_{2})

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_shift_bits, Rewriting using cut_bits_overwrite_bits_disjoined, matching in *,

This completes the proof of cut_bits_overwrite_shift_bits_disjoint.

Q.E.D.

C.17.44 Bits.cut_bits_overwrite_shift_bits_contained_TCC1

Terse proof for cut_bits_overwrite_shift_bits_contained_TCC1.
cut_bits_overwrite_shift_bits_contained_TCC1:

{1} ∀ (i_{1}, k_{1}, i_{2}, k_{2}: nat): i_{1} ≤ i_{2} ∧ i_{2} + k_{2} ≤ i_{1} + k_{1} ⊃ i_{2} − i_{1} ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of cut_bits_overwrite_shift_bits_contained_TCC1.

Q.E.D.

C.17.45 Bits.cut_bits_overwrite_shift_bits_contained

Terse proof for cut_bits_overwrite_shift_bits_contained.

cut_bits_overwrite_shift_bits_contained:

{1} ∀ (n, m, i_{1}, k_{1}, i_{2}, k_{2}: nat): i_{1} ≤ i_{2} ∧ i_{2} + k_{2} ≤ i_{1} + k_{1} ⊃ cut_bits(overwrite_shift_bits(n, m, i_{1}, k_{1}), i_{2}, k_{2}) = cut_bits(m, i_{2} − i_{1}, k_{2})

Repeatedly Skolemizing and flattening, Expanding the definition of overwrite_shift_bits, Rewriting using cut_bits_overwrite_bits_contained, matching in *, Rewriting using cut_bits_shift_bits_left, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using zero_cut_bits, matching in *,

This completes the proof of cut_bits_overwrite_shift_bits_contained.

Q.E.D.

C.17.46 Bits.cut_bit_overwrite_shift_bits_TCC1

Terse proof for cut_bit_overwrite_shift_bits_TCC1.
cut_bit_overwrite_shift_bits_TCC1:

{1} ∀ (i_{1}, k_{1}, i_{2}: nat): i_{1} ≤ i_{2} ∧ i_{2} < i_{1} + k_{1} ⊃ i_{2} − i_{1} ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of cut_bit_overwrite_shift_bits_TCC1.

Q.E.D.

C.17.47 Bits.cut_bit_overwrite_shift_bits

Terse proof for cut_bit_overwrite_shift_bits.
cut_bit_overwrite_shift_bits:

{1} ∀ (n, m, i_{1}, k_{1}, i_{2}: nat):

cut_bit(overwrite_shift_bits(n, m, i_{1}, k_{1}), i_{2}) = if i_{1} ≤ i_{2} ∧ i_{2} < i_{1} + k_{1} then cut_bit(m, i_{2} − i_{1})

else cut_bit(n, i_{2})

endif

Repeatedly Skolemizing and flattening, Lifting IF-conditions to the top level, Splitting conjunctions, we get 2 subgoals:

cut_bit_overwrite_shift_bits.1:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} i′_{1} ≥ 0
{-4} k′_{1} ≥ 0
{-5} i′_{2} ≥ 0
{1} i′_{1} ≤ i′_{2} ∧ i′_{2} < i′_{1} + k′_{1} ⊃

cut_bit(overwrite_shift_bits(n′, m′, i′_{1}, k′_{1}), i′_{2}) = cut_bit(m′, i′_{2} − i′_{1})

Applying disjunctive simplification to flatten sequent, Rewriting using cut_bit_bits, matching in *, Rewriting using cut_bits_overwrite_shift_bits_contained, matching in *, Rewriting using cut_bit_bits, matching in *,

This completes the proof of cut_bit_overwrite_shift_bits.1.
cut_bit_overwrite_shift_bits.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} i′_{1} ≥ 0
{-4} k′_{1} ≥ 0
{-5} i′_{2} ≥ 0
{1} ¬ (i′_{1} ≤ i′_{2} ∧ i′_{2} < i′_{1} + k′_{1}) ⊃

cut_bit(overwrite_shift_bits(n′, m′, i′_{1}, k′_{1}), i′_{2}) = cut_bit(n′, i′_{2})

Applying disjunctive simplification to flatten sequent, Rewriting using cut_bit_bits, matching in *, Rewriting using cut_bits_overwrite_shift_bits_disjoint, matching in *, we get 2 subgoals:

cut_bit_overwrite_shift_bits.2.1:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} i′_{1} ≥ 0
{-4} k′_{1} ≥ 0
{-5} i′_{2} ≥ 0
{1} i′_{1} ≤ i′_{2} ∧ i′_{2} < i′_{1} + k′_{1}
{2} if cut_bits(n′, i′_{2}, 1) = 1 then true else false endif = cut_bit(n′, i′_{2})

Rewriting using cut_bit_bits, matching in *,

This completes the proof of cut_bit_overwrite_shift_bits.2.1.
cut_bit_overwrite_shift_bits.2.2:

{-1} n′ ≥ 0
{-2} m′ ≥ 0
{-3} i′_{1} ≥ 0
{-4} k′_{1} ≥ 0
{-5} i′_{2} ≥ 0
{1} i′_{1} + k′_{1} ≤ i′_{2} ∨ 1 + i′_{2} ≤ i′_{1}
{2} i′_{1} ≤ i′_{2} ∧ i′_{2} < i′_{1} + k′_{1}

{3} if cut_bits(overwrite_shift_bits(n′, m′, i′_{1}, k′_{1}), i′_{2}, 1) = 1

then true else false endif = cut_bit(n′, i′_{2})

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cut_bit_overwrite_shift_bits.2.2.

Q.E.D.

C.17.48 Bits.cut_bit_overwrite_bool_bit

Terse proof for cut_bit_overwrite_bool_bit.

cut_bit_overwrite_bool_bit:

{1} ∀ (n: nat, b: bool, i, j: nat):

cut_bit(overwrite_bool_bit(n, b, i), j) = if i = j then b else cut_bit(n, j) endif

Repeatedly Skolemizing and flattening, Lifting IF-conditions to the top level, Splitting conjunctions, we get 2 subgoals:

cut_bit_overwrite_bool_bit.1:

{-1} n′ ≥ 0
{-2} i′ ≥ 0
{-3} j′ ≥ 0
{1} i′ = j′ ⊃ cut_bit(overwrite_bool_bit(n′, b′, i′), j′) = b′

Applying disjunctive simplification to flatten sequent, Rewriting using cut_bit_bits, matching in *, Expanding the definition of overwrite_bool_bit, Expanding the definition of overwrite_bit, Rewriting using cut_bits_overwrite_bits_contained, matching in *, Rewriting using cut_bits_shift_bits_left, matching in *, Simplifying, rewriting, and recording with decision procedures, Case splitting on j!1 - i!1 = 0, we get 2 subgoals:

cut_bit_overwrite_bool_bit.1.1:

{-1} j′ − i′ = 0
{-2} i′ = j′
{-3} n′ ≥ 0
{-4} i′ ≥ 0
{-5} j′ ≥ 0
{1} if cut_bits(bool_to_nat(b′), j′ − i′, 1) = 1 then true else false endif = b′

Replacing using formula -1, Hiding formulas: -1, Expanding the definition of cut_bits, Expanding the definition of expt, Expanding the definition of expt, Rewriting using ndiv_1, matching in *, Rewriting using rem_mod, matching in *, Expanding the definition of bool_to_nat, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cut_bit_overwrite_bool_bit.1.1.
cut_bit_overwrite_bool_bit.1.2:

{-1} i′ = j′
{-2} n′ ≥ 0
{-3} i′ ≥ 0
{-4} j′ ≥ 0
{1} j′ − i′ = 0
{2} if cut_bits(bool_to_nat(b′), j′ − i′, 1) = 1 then true else false endif = b′

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of cut_bit_overwrite_bool_bit.1.2.
cut_bit_overwrite_bool_bit.2:

{-1} n′ ≥ 0
{-2} i′ ≥ 0
{-3} j′ ≥ 0
{1} ¬ i′ = j′ ⊃ cut_bit(overwrite_bool_bit(n′, b′, i′), j′) = cut_bit(n′, j′)

Applying disjunctive simplification to flatten sequent, Rewriting using cut_bit_bits, matching in *, Rewriting using cut_bit_bits, matching in *, Expanding the definition of overwrite_bool_bit, Expanding the definition of overwrite_bit, Rewriting using cut_bits_overwrite_bits_disjoined, matching in *, Hiding formulas: 3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cut_bit_overwrite_bool_bit.2.

Q.E.D.

C.17.49 Bits.overwrite_shift_bits_merge

Terse proof for overwrite_shift_bits_merge.
overwrite_shift_bits_merge:

{1} ∀ (m, ci1, ck1, si, ci2, ck2, os, ok: nat): ci1 + ck1 = ci2 ∧ si + ck1 = os ∧ ck2 = ok ⊃ overwrite_shift_bits(shift_bits_left(cut_bits(m, ci1, ck1), si), cut_bits(m, ci2, ck2),

os, ok) = shift_bits_left(cut_bits(m, ci1, ck1 + ck2), si)

Repeatedly Skolemizing and flattening, Replacing using formula -11, Replacing using formula -9, Replacing using formula -10, Hiding formulas: -9, -10, -11, Case splitting on ck2!1 = 0, we get 2 subgoals:

overwrite_shift_bits_merge.1:

{-1} ck2′ = 0
{-2} m′ ≥ 0
{-3} ci1′ ≥ 0
{-4} ck1′ ≥ 0
{-5} si′ ≥ 0
{-6} ci1′ + ck1′ ≥ 0
{-7} ck2′ ≥ 0
{-8} si′ + ck1′ ≥ 0
{-9} ck2′ ≥ 0

{1} overwrite_shift_bits(shift_bits_left(cut_bits(m′, ci1′, ck1′), si′),

cut_bits(m′, ci1′ + ck1′, ck2′), si′ + ck1′, ck2′)

= shift_bits_left(cut_bits(m′, ci1′, ck1′ + ck2′), si′)

Replacing using formula -1, Case splitting on cut_bits(m!1, ci1!1 + ck1!1, 0) = 0, we get 2 subgoals:

overwrite_shift_bits_merge.1.1:

{-1} cut_bits(m′, ci1′ + ck1′, 0) = 0
{-2} ck2′ = 0
{-3} m′ ≥ 0
{-4} ci1′ ≥ 0
{-5} ck1′ ≥ 0
{-6} si′ ≥ 0
{-7} ci1′ + ck1′ ≥ 0
{-8} 0 ≥ 0
{-9} si′ + ck1′ ≥ 0
{-10} 0 ≥ 0

{1} overwrite_shift_bits(shift_bits_left(cut_bits(m′, ci1′, ck1′), si′),

cut_bits(m′, ci1′ + ck1′, 0), si′ + ck1′, 0)

= shift_bits_left(cut_bits(m′, ci1′, ck1′ + 0), si′)

Replacing using formula -1, Hiding formulas: -1, Expanding the definition of overwrite_shift_bits, Expanding the definition of shift_bits_left, Rewriting using zero_times1, matching in *, Expanding the definition of overwrite_bits, Rewriting using zero_cut_bits, matching in *, Expanding the definition of shift_bits_left, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of overwrite_shift_bits_merge.1.1.
overwrite_shift_bits_merge.1.2:

{-1} ck2′ = 0
{-2} m′ ≥ 0
{-3} ci1′ ≥ 0
{-4} ck1′ ≥ 0
{-5} si′ ≥ 0
{-6} ci1′ + ck1′ ≥ 0
{-7} 0 ≥ 0
{-8} si′ + ck1′ ≥ 0
{-9} 0 ≥ 0
{1} cut_bits(m′, ci1′ + ck1′, 0) = 0

{2} overwrite_shift_bits(shift_bits_left(cut_bits(m′, ci1′, ck1′), si′),

cut_bits(m′, ci1′ + ck1′, 0), si′ + ck1′, 0)

= shift_bits_left(cut_bits(m′, ci1′, ck1′ + 0), si′)

Hiding formulas: 2, Rewriting using zero_cut_bits, matching in *,

This completes the proof of overwrite_shift_bits_merge.1.2.

overwrite_shift_bits_merge.2:

{-1} m′ ≥ 0
{-2} ci1′ ≥ 0
{-3} ck1′ ≥ 0
{-4} si′ ≥ 0
{-5} ci1′ + ck1′ ≥ 0
{-6} ck2′ ≥ 0
{-7} si′ + ck1′ ≥ 0
{-8} ck2′ ≥ 0
{1} ck2′ = 0

{2} overwrite_shift_bits(shift_bits_left(cut_bits(m′, ci1′, ck1′), si′),

cut_bits(m′, ci1′ + ck1′, ck2′), si′ + ck1′, ck2′)

= shift_bits_left(cut_bits(m′, ci1′, ck1′ + ck2′), si′)

Expanding the definition of overwrite_shift_bits, Expanding the definition of overwrite_bits, Rewriting using cut_bits_shift_bits_left, matching in *, Simplifying, rewriting, and recording with decision procedures, Rewriting using cut_bits_cut_bits, matching in *, Rewriting using rem_mod, matching in *, we get 2 subgoals:

overwrite_shift_bits_merge.2.1:

{-1} m′ ≥ 0
{-2} ci1′ ≥ 0
{-3} ck1′ ≥ 0
{-4} si′ ≥ 0
{-5} ci1′ + ck1′ ≥ 0
{-6} ck2′ ≥ 0
{-7} ck1′ + si′ ≥ 0
{-8} ck2′ ≥ 0
{1} ck2′ = 0

{2} shift_bits_left (cut_bits(m′, ci1′, ck1′), si′) + shift_bits_left (cut_bits(m′, ci1′ + ck1′, ck2′), ck1′ + si′) + shift_bits_left (cut_bits(m′, ci1′, ck1′), si′) − rem(expt(2, ck1′ + ck2′ + si′))(shift_bits_left (cut_bits(m′, ci1′, ck1′), si′)) = shift_bits_left(cut_bits(m′, ci1′, ck1′ + ck2′), si′)

Rewriting using rem_mod, matching in *, we get 2 subgoals:

overwrite_shift_bits_merge.2.1.1:

{-1} m′ ≥ 0
{-2} ci1′ ≥ 0
{-3} ck1′ ≥ 0
{-4} si′ ≥ 0
{-5} ci1′ + ck1′ ≥ 0
{-6} ck2′ ≥ 0
{-7} ck1′ + si′ ≥ 0
{-8} ck2′ ≥ 0
{1} ck2′ = 0

{2} shift_bits_left (cut_bits(m′, ci1′, ck1′), si′) + shift_bits_left (cut_bits(m′, ci1′ + ck1′, ck2′), ck1′ + si′) + shift_bits_left (cut_bits(m′, ci1′, ck1′), si′) − shift_bits_left (cut_bits(m′, ci1′, ck1′), si′) = shift_bits_left(cut_bits(m′, ci1′, ck1′ + ck2′), si′)

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of shift_bits_left, Using lemma expt_plus, Replacing using formula -1, Hiding formulas: -1, Rewriting using associative_mult, matching in *, Applying both_sides_times1 Instantiating the top quantifier in -1 with the terms: expt(2, si′), expt(2, ck1′) × cut_bits(m′, ci1′ + ck1′, ck2′) + cut_bits(m′, ci1′, ck1′),

cut_bits(m′, ci1′, ck1′ + ck2′), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 1, 4, Expanding the definition of cut_bits, Installing automatic rewrites from: expt_divides both_sides_times_pos_lt1 ndiv_expt_expt Applying number_split Instantiating the top quantifier in -1 with the terms: rem(expt(2, ck1′ + ck2′))(ndiv(m′, expt(2,

ci1′))), expt(2, ck1′), Replacing using formula -1, Hiding formulas: -1, Rewriting using ndiv_rem_divisible, matching in *, we get 2 subgoals:

overwrite_shift_bits_merge.2.1.1.1:

{-1} m′ ≥ 0
{-2} ci1′ ≥ 0
{-3} ck1′ ≥ 0
{-4} si′ ≥ 0
{-5} ci1′ + ck1′ ≥ 0
{-6} ck2′ ≥ 0
{-7} ck1′ + si′ ≥ 0

{1} rem(expt(2, ck1′))(ndiv(m′, expt(2, ci1′))) + expt(2, ck1′) × rem(expt(2, ck2′))(ndiv(m′, expt(2, ci1′ + ck1′))) = expt(2, ck1′) × rem(expt(2, ck2′))(ndiv(ndiv(m′, expt(2, ci1′)), expt(2, ck1′))) + rem(expt(2, ck1′))(rem(expt(2, ck1′ + ck2′))(ndiv(m′, expt(2, ci1′))))

{2} ck2′ = 0

Rewriting using ndiv_times_2, matching in *, Rewriting using expt_plus, matching in *, Simplifying, rewriting, and recording with decision procedures, Rewriting using rem_rem, matching in *,

This completes the proof of overwrite_shift_bits_merge.2.1.1.1.
overwrite_shift_bits_merge.2.1.1.2:

{-1} m′ ≥ 0
{-2} ci1′ ≥ 0
{-3} ck1′ ≥ 0
{-4} si′ ≥ 0
{-5} ci1′ + ck1′ ≥ 0
{-6} ck2′ ≥ 0
{-7} ck1′ + si′ ≥ 0
{1} expt(2, ck1′) ≤ expt(2, ck1′ + ck2′)

{2} rem(expt(2, ck1′))(ndiv(m′, expt(2, ci1′))) + expt(2, ck1′) × rem(expt(2, ck2′))(ndiv(m′, expt(2, ci1′ + ck1′))) = rem(expt(2, ck1′))(rem(expt(2, ck1′ + ck2′))(ndiv(m′, expt(2, ci1′)))) + expt(2, ck1′) × ndiv(rem(expt(2, ck1′ + ck2′))(ndiv(m′, expt(2, ci1′))), expt(2, ck1′))

{3} ck2′ = 0

Hiding formulas: 2, Using lemma both_sides_expt_gt1_le, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of overwrite_shift_bits_merge.2.1.1.2.
overwrite_shift_bits_merge.2.1.2:

{-1} m′ ≥ 0
{-2} ci1′ ≥ 0
{-3} ck1′ ≥ 0
{-4} si′ ≥ 0
{-5} ci1′ + ck1′ ≥ 0
{-6} ck2′ ≥ 0
{-7} ck1′ + si′ ≥ 0
{-8} ck2′ ≥ 0
{1} shift_bits_left(cut_bits(m′, ci1′, ck1′), si′) < expt(2, ck1′ + ck2′ + si′)
{2} ck2′ = 0

{3} shift_bits_left (cut_bits(m′, ci1′ + ck1′, ck2′), ck1′ + si′) + 2 × shift_bits_left (cut_bits(m′, ci1′, ck1′), si′) − rem(expt(2, ck1′ + ck2′ + si′))(shift_bits_left (cut_bits(m′, ci1′, ck1′), si′))

= shift_bits_left(cut_bits(m′, ci1′, ck1′ + ck2′), si′)

Hiding formulas: 3, Expanding the definition of shift_bits_left, Installing automatic rewrites from: expt_plus Applying both_sides_times_pos_lt1 Instantiating the top quantifier in -1 with the terms: expt(2, si′), cut_bits(m′, ci1′, ck1′), expt(2,

ck1′ + ck2′), Simplifying, rewriting, and recording with decision procedures, Applying both_sides_expt_gt1_le Instantiating the top quantifier in -1 with the terms: 2, ck1′, ck1′ + ck2′, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of overwrite_shift_bits_merge.2.1.2.
overwrite_shift_bits_merge.2.2:

{-1} m′ ≥ 0
{-2} ci1′ ≥ 0
{-3} ck1′ ≥ 0
{-4} si′ ≥ 0
{-5} ci1′ + ck1′ ≥ 0
{-6} ck2′ ≥ 0
{-7} ck1′ + si′ ≥ 0
{-8} ck2′ ≥ 0
{1} shift_bits_left(cut_bits(m′, ci1′, ck1′), si′) < expt(2, ck1′ + si′)
{2} ck2′ = 0

{3} rem(expt(2, ck1′ + si′))(shift_bits_left (cut_bits(m′, ci1′, ck1′), si′)) + shift_bits_left (cut_bits(m′, ci1′ + ck1′, ck2′), ck1′ + si′) + shift_bits_left (cut_bits(m′, ci1′, ck1′), si′) − rem(expt(2, ck1′ + ck2′ + si′))(shift_bits_left (cut_bits(m′, ci1′, ck1′), si′)) = shift_bits_left(cut_bits(m′, ci1′, ck1′ + ck2′), si′)

Hiding formulas: 3, Expanding the definition of shift_bits_left, Using lemma expt_plus, Replacing using formula -1, Hiding formulas: -1, Using lemma both_sides_times_pos_lt1, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of overwrite_shift_bits_merge.2.2.

Q.E.D.

C.18 Proofs for BitwiseExpressions (expressions.pvs)

C.18 Proofs for BitwiseExpressions (expressions.pvs)

This theory contains no provable formal statements.

C.19 Proofs for Block_Disjoint_Rewrites (plain_memory_rewrites.pvs)

C.19.1 Block_Disjoint_Rewrites.different_registers_blocks_disjoint

Terse proof for different_registers_blocks_disjoint.
different_registers_blocks_disjoint:

{1} ∀ (addr1, addr2: Address, sz1, sz2: nat):

type_of(addr1) ≠ type_of(addr2) ⊃ blocks_disjoint?(addr1, sz1, addr2, sz2)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of different_registers_blocks_disjoint.

Q.E.D.

C.20 Proofs for BooleanConversions (conversions.pvs)

C.20.1 BooleanConversions.pointer_to_bool_TCC1

Terse proof for pointer_to_bool_TCC1.
pointer_to_bool_TCC1:

{1} ∀ (p_typ: Cpp_Subtype(cv(pointer?))): pointer?(cv_base(p_typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pointer_to_bool_TCC1. Q.E.D.

C.21 Proofs for CatchAux (statements.pvs)

This theory contains no provable formal statements.

C.22 Proofs for Challenge_Device_Memory (device_memory.pvs)

C.22.1 Challenge_Device_Memory.pm_dev_plain

Terse proof for pm_dev_plain.

pm_dev_plain:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ plain_memory?(pm_phy)

Expanding the definition of is_device_plain_memory?, Repeatedly Skolemizing and flattening, This completes the proof of pm_dev_plain. Q.E.D.

C.22.2 Challenge_Device_Memory.pm_dev_states

Terse proof for pm_dev_states.

pm_dev_states:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ pm`states = em_lift(pm_phy`states)

Expanding the definition of is_device_plain_memory?, Repeatedly Skolemizing and flattening, This completes the proof of pm_dev_states. Q.E.D.

C.22.3 Challenge_Device_Memory.pm_dev_read

Terse proof for pm_dev_read.

pm_dev_read:

{1} ∀ (device_read_side_effect,

device_write_side_effect:

[[Address, list[Byte], bool] →

[Device_memory[Physical_memory, pm_phy, Device_state] →

ExprResult[Device_memory, list[Byte]]]],

pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ memory_read(pm`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

C.22 Proofs for Challenge_Device_Memory (device_memory.pvs)

Expanding the definition of is_device_plain_memory?, Expanding the definition of device_pm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_dev_read. Q.E.D.

C.22.4 Challenge_Device_Memory.pm_dev_write

Terse proof for pm_dev_write.

pm_dev_write:

{1} ∀ (device_read_side_effect,

device_write_side_effect:

[[Address, list[Byte], bool] →

[Device_memory[Physical_memory, pm_phy, Device_state] →

ExprResult[Device_memory, list[Byte]]]],

pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ memory_write(pm`mem) = (λ (a: Address, b: Byte):

em_lift[Physical_memory, Device_state, Unit](memory_write(pm_phy`mem)(a, b)))

Expanding the definition of is_device_plain_memory?, Repeatedly Skolemizing and flattening, Expanding the definition of device_pm, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_dev_write. Q.E.D.

C.22.5 Challenge_Device_Memory.pm_dev_read_side_effect

Terse proof for pm_dev_read_side_effect.
pm_dev_read_side_effect:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ memory_read_side_effect(pm`mem) = (λ (a: Address, bl: list[Byte], cp: bool): em_lift[Physical_memory, Device_state, list[Byte]] (memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect(a, bl1, cp)))

Expanding the definition of is_device_plain_memory?, Repeatedly Skolemizing and flattening, Replacing using formula -1, Expanding the definition of device_pm, which is trivially true. This completes the proof of pm_dev_read_side_effect. Q.E.D.

C.22.6 Challenge_Device_Memory.pm_dev_write_side_effect

Terse proof for pm_dev_write_side_effect.
pm_dev_write_side_effect:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ memory_write_side_effect(pm`mem) = (λ (a: Address, bl: list[Byte], cp: bool): em_lift[Physical_memory, Device_state, list[Byte]] (memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect(a, bl1, cp)))

Expanding the definition of is_device_plain_memory?, Repeatedly Skolemizing and flattening, Replacing using formula -1, Expanding the definition of device_pm, which is trivially true.

This completes the proof of pm_dev_write_side_effect.

Q.E.D.

C.22.7 Challenge_Device_Memory.pm_dev_ro_rw_addr

Terse proof for pm_dev_ro_rw_addr.
pm_dev_ro_rw_addr:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ ((pm‘ro_addr∪ pm‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of is_device_plain_memory?, Repeatedly Skolemizing and flattening, Keeping (-5 -6 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_dev_ro_rw_addr. Q.E.D.

C.22.8 Challenge_Device_Memory.device_plain_transformers_ok

Terse proof for device_plain_transformers_ok.
device_plain_transformers_ok:

{1} ∀ (device_read_side_effect,

device_write_side_effect:

[[Address, list[Byte], bool] →

[Device_memory[Physical_memory, pm_phy, Device_state] →

ExprResult[Device_memory, list[Byte]]]],

pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ transformers_ok?(pm`states,

(memory_read_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_transformers (pm‘mem, pm‘rw_addr)))

Repeatedly Skolemizing and flattening, Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using transformers_ok_union_transformers, matching in *, we get 2 subgoals:

device_plain_transformers_ok.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{1} transformers_ok?(pm′`states,

memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{2} transformers_ok?(pm′`states, (memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr)))

Hiding formulas: 2, Using lemma pm_dev_read, Using lemma em_memory_read_transformers[Physical_memory, Device_state], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Replacing using formula -5, Rewriting using em_transformers_ok, matching in *, Using lemma plain_memory_transformers_ok_read_ro_rw, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -5 1) and hiding *, Rewriting using transformers_ok_mono_transformers, matching in * where transformers_2 gets mem-

ory_read_transformers(pm_phy‘mem, union(pm_phy‘ro_addr, pm_phy‘rw_addr)), transformers_1 gets memory_read_transformers(pm_phy‘mem, union(pm!1‘ro_addr, pm!1‘rw_addr)),

Hiding formulas: (-1 2), Rewriting using memory_read_transformers_mono, matching in *, Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_transformers_ok.1.

device_plain_transformers_ok.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)
{1} transformers_ok?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr))

{2} transformers_ok?(pm′`states, (memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr)))

Hiding formulas: 2, Using lemma pm_dev_write, Using lemma em_memory_write_transformers[Physical_memory, Device_state], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Replacing using formula -5, Rewriting using em_transformers_ok, matching in *, Keeping (-3 -4 1) and hiding *, Using lemma plain_memory_transformers_ok_write_rw, Rewriting using transformers_ok_mono_transformers, matching in * where transformers_2

gets memory_write_transformers(pm_phy‘mem, pm_phy‘rw_addr), transformers_1 gets memory_write_transformers(pm_phy‘mem, pm!1‘rw_addr),

Rewriting using memory_write_transformers_mono, matching in *, Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_transformers_ok.2.

Q.E.D.

C.22.9 Challenge_Device_Memory.device_plain_unchanged_memory_invariant

Terse proof for device_plain_unchanged_memory_invariant.
device_plain_unchanged_memory_invariant:

{1} ∀ (device_read_side_effect,

device_write_side_effect:

[[Address, list[Byte], bool] →

[Device_memory[Physical_memory, pm_phy, Device_state] →

ExprResult[Device_memory, list[Byte]]]],

pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

((pm‘other_actions∪ memory_read_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))), (pm‘ro_addr∪ pm‘rw_addr))

Repeatedly Skolemizing and flattening, Rewriting using unchanged_memory_invariant_union_transformers, matching in * where pm gets

pm!1‘mem, we get 2 subgoals:

device_plain_unchanged_memory_invariant.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, (pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Hiding formulas: 2, Using lemma pm_dev_plain, Using lemma pm_dev_states, Using lemma pm_dev_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma em_memory_read_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Replacing using formula -4, Rewriting using unchanged_memory_invariant_union_transformers, matching in *, we get 2 subgoals:

device_plain_unchanged_memory_invariant.1.1:

{-1} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-2} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)) =

em_lift(memory_read_transformers(pm_phy`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} pm′`states = em_lift(pm_phy`states)
{-5} plain_memory?(pm_phy)

{1} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), pm′`other_actions,

(pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), (pm′‘other_actions∪ em_lift(memory_read_transformers (pm_phy‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)))), (pm′‘ro_addr∪ pm′‘rw_addr))

Hiding formulas: 2, Rewriting using unchanged_memory_invariant_mono, matching in * where transformers_1 gets

pm!1‘other_actions, transformers_2 gets em_lift[Physical_memory, Device_state](pm_phy‘other_actions), addresses_1 gets union(pm!1‘ro_addr, pm!1‘rw_addr), addresses_2 gets union(pm_phy‘ro_addr, pm_phy‘rw_addr),

we get 3 subgoals:

device_plain_unchanged_memory_invariant.1.1.1:

{-1} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-2} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)) =

em_lift(memory_read_transformers(pm_phy`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} pm′`states = em_lift(pm_phy`states)
{-5} plain_memory?(pm_phy)
{1} (pm′‘other_actions⊆ em_lift[Physical_memory, Device_state](pm_phy‘other_actions))

{2} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), pm′`other_actions, (pm′‘ro_addr∪ pm′‘rw_addr))

Keeping (-3 1) and hiding *, Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_unchanged_memory_invariant.1.1.1.
device_plain_unchanged_memory_invariant.1.1.2:

{-1} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-2} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)) =

em_lift(memory_read_transformers(pm_phy`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} pm′`states = em_lift(pm_phy`states)
{-5} plain_memory?(pm_phy)
{1} ((pm′‘ro_addr∪ pm′‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), pm′`other_actions, (pm′‘ro_addr∪ pm′‘rw_addr))

Keeping (-3 1) and hiding *, Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.1.1.2.
device_plain_unchanged_memory_invariant.1.1.3:

{-1} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-2} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)) =

em_lift(memory_read_transformers(pm_phy`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} pm′`states = em_lift(pm_phy`states)
{-5} plain_memory?(pm_phy)

{1} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states),

em_lift[Physical_memory, De-

vice_state](pm_phy`other_actions),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), pm′`other_actions, (pm′‘ro_addr∪ pm′‘rw_addr))

Using lemma em_unchanged_memory_invariant[Physical_memory, Device_state], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-5 1) and hiding *, Using lemma plain_memory_unchanged_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma unchanged_memory_invariant_mono[Physical_memory], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

device_plain_unchanged_memory_invariant.1.1.3.1:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy)
{1} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, pm_phy`other_actions, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Rewriting using subset_reflexive, matching in *,

This completes the proof of device_plain_unchanged_memory_invariant.1.1.3.1.
device_plain_unchanged_memory_invariant.1.1.3.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy)
{1} (pm_phy‘other_actions⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, pm_phy`other_actions, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.1.1.3.2.
device_plain_unchanged_memory_invariant.1.2:

{-1} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-2} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)) =

em_lift(memory_read_transformers(pm_phy`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} pm′`states = em_lift(pm_phy`states)
{-5} plain_memory?(pm_phy)

{1} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states),

em_lift(memory_read_transformers(pm_phy`mem,

(pm′‘ro_addr∪ pm′‘rw_addr))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), (pm′‘other_actions∪ em_lift(memory_read_transformers (pm_phy‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)))), (pm′‘ro_addr∪ pm′‘rw_addr))

Using lemma em_unchanged_memory_invariant[Physical_memory, Device_state], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using unchanged_memory_invariant_mono, matching in * where transformers_1 gets

memory_read_transformers(pm_phy‘mem, union(pm!1‘ro_addr, pm!1‘rw_addr)), transformers_2 gets memory_read_transformers(pm_phy‘mem, union(pm_phy‘ro_addr, pm_phy‘rw_addr)), addresses_1 gets union(pm!1‘ro_addr, pm!1‘rw_addr), addresses_2 gets union(pm_phy‘ro_addr, pm_phy‘rw_addr), we get 3 subgoals:

device_plain_unchanged_memory_invariant.1.2.1:

{-1} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-2} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)) =

em_lift(memory_read_transformers(pm_phy`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} pm′`states = em_lift(pm_phy`states)
{-5} plain_memory?(pm_phy)
{1} (memory_read_transformers (pm_phy‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ⊆ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_transformers(pm_phy`mem,

(pm′‘ro_addr∪ pm′‘rw_addr)),

(pm′‘ro_addr∪ pm′‘rw_addr))

{3} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states),

em_lift(memory_read_transformers(pm_phy`mem,

(pm′‘ro_addr∪ pm′‘rw_addr))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{4} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), (pm′‘other_actions∪ em_lift(memory_read_transformers (pm_phy‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)))), (pm′‘ro_addr∪ pm′‘rw_addr))

Keeping (-3 1) and hiding *, Rewriting using memory_read_transformers_mono, matching in *, Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.1.2.1.
device_plain_unchanged_memory_invariant.1.2.2:

{-1} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-2} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)) =

em_lift(memory_read_transformers(pm_phy`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} pm′`states = em_lift(pm_phy`states)
{-5} plain_memory?(pm_phy)
{1} ((pm′‘ro_addr∪ pm′‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_transformers(pm_phy`mem,

(pm′‘ro_addr∪ pm′‘rw_addr)),

(pm′‘ro_addr∪ pm′‘rw_addr))

{3} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states),

em_lift(memory_read_transformers(pm_phy`mem,

(pm′‘ro_addr∪ pm′‘rw_addr))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{4} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), (pm′‘other_actions∪ em_lift(memory_read_transformers (pm_phy‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)))), (pm′‘ro_addr∪ pm′‘rw_addr))

Keeping (-3 1) and hiding *, Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.1.2.2.
device_plain_unchanged_memory_invariant.1.2.3:

{-1} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-2} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)) =

em_lift(memory_read_transformers(pm_phy`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} pm′`states = em_lift(pm_phy`states)
{-5} plain_memory?(pm_phy)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_transformers(pm_phy`mem,

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_transformers(pm_phy`mem,

(pm′‘ro_addr∪ pm′‘rw_addr)),

(pm′‘ro_addr∪ pm′‘rw_addr))

{3} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states),

em_lift(memory_read_transformers(pm_phy`mem,

(pm′‘ro_addr∪ pm′‘rw_addr))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{4} unchanged_memory_invariant?(pm′`mem, em_lift(pm_phy`states), (pm′‘other_actions∪ em_lift(memory_read_transformers (pm_phy‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)))), (pm′‘ro_addr∪ pm′‘rw_addr))

Keeping (-5 1) and hiding *,

Using lemma plain_memory_unchanged_invariant,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma unchanged_memory_invariant_mono[Physical_memory],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

device_plain_unchanged_memory_invariant.1.2.3.1:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy)
{1} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_transformers(pm_phy`mem,

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Rewriting using subset_reflexive, matching in *,

This completes the proof of device_plain_unchanged_memory_invariant.1.2.3.1.

device_plain_unchanged_memory_invariant.1.2.3.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy)
{1} (memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_transformers(pm_phy`mem,

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.1.2.3.2.
device_plain_unchanged_memory_invariant.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)), (pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Rewriting using unchanged_memory_invariant_union_transformers, matching in * where pm gets pm!1‘mem,

we get 2 subgoals:

device_plain_unchanged_memory_invariant.2.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_read_side_effect_super_transformers(pm′`mem,

(pm′‘ro_addr∪ pm′‘rw_addr)),

(pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)), (pm′‘ro_addr∪ pm′‘rw_addr))

{3} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Rewriting using unchanged_memory_invariant_all_transformers, matching in *, Expanding the definition of memory_read_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 -4 1) and hiding *, Using lemma pm_dev_read_side_effect, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Simplifying, rewriting, and recording with decision procedures, Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma fexpr_unchanged_memory_invariant_composition[Device_memory, list[Byte], list[Byte]],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 5 subgoals:

device_plain_unchanged_memory_invariant.2.1.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(device_read_side_effect′(a′,

                                                                                             d,

cp′))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_read_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Repeatedly Skolemizing and flattening, Hiding formulas: (-1 2), Expanding the definition of is_device_plain_memory?, Applying disjunctive simplification to flatten sequent, Using lemma unchanged_memory_invariant_mono, Installing automatic rewrites from: subset_reflexive Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -13 1) and hiding *, Expanding the definition of drse_super_transformers, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Expanding the definition of member, Expanding the definition of union, Expanding the definition of member, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Expanding the definition of singleton, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.1.1.

device_plain_unchanged_memory_invariant.2.1.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ∀ (s: (pm′`states)):

OK?(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′))(s))

⊃

data(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′))(s))

= bl′

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_read_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Repeatedly Skolemizing and flattening,

Hiding formulas: (-6 2),

Using lemma plain_memory_side_effect_content_unchanged_read_block,

Expanding the definition of em_lift,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

device_plain_unchanged_memory_invariant.2.1.2.1:

{-1} plain_memory?(pm_phy)

{-2} side_effect_content_unchanged(address_block(a′, length(bl′)), pm_phy`states,

memory_read_side_effect(pm_phy`mem))

{-3} pm′`states(s′)
{-4} OK?(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))

{-5} OK?(OK(s′

with [(state)

:= state(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s′`state))],

data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))))

{-6} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-7} pm′`states =

(λ (em: Expand_state[Physical_memory, Device_state]): pm_phy`states(em`state))

{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state)) = bl′

Replacing using formula -7, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Installing automatic rewrites from: subset_reflexive Using lemma side_effect_content_unchanged_content, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.1.2.1.
device_plain_unchanged_memory_invariant.2.1.2.2:

{-1} plain_memory?(pm_phy)
{-2} pm′`states(s′)
{-3} OK?(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))

{-4} OK?(OK(s′

with [(state)

:= state(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s′`state))],

data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))))

{-5} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-6} pm′`states =

(λ (em: Expand_state[Physical_memory, Device_state]): pm_phy`states(em`state))

{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} (address_block(a′, length(bl′)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{2} data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state)) = bl′

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets union(pm!1‘ro_addr, pm!1‘rw_addr), c gets union(pm_phy‘ro_addr, pm_phy‘rw_addr),

Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.1.2.2.

device_plain_unchanged_memory_invariant.2.1.3:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_read_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Rewriting using em_lift_expr_2_super, matching in *,

Hiding formulas: 2,

Rewriting using em_lift_singleton, matching in *,

Replacing using formula -3,

Using lemma pm_dev_read,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma em_unchanged_memory_invariant[Physical_memory, Device_state],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-2 -3 -6 1) and hiding *,

Using lemma plain_memory_unchanged_read_side_effect_block_ro_rw,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

device_plain_unchanged_memory_invariant.2.1.3.1:

{-1} plain_memory?(pm_phy)
{-2} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_side_effect_super_transformers(pm_phy`mem,

ad-

dress_block

(a′, length(bl′))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{3} (address_block(a′, length(bl′)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets union(pm!1‘ro_addr, pm!1‘rw_addr), c gets union(pm_phy‘ro_addr, pm_phy‘rw_addr),

Using lemma pm_dev_ro_rw_addr,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.1.3.1.
device_plain_unchanged_memory_invariant.2.1.3.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_side_effect_super_transformers(pm_phy`mem,

ad-

dress_block

(a′, length(bl′))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy)
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ((pm′‘ro_addr∪ pm′‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Using lemma pm_dev_ro_rw_addr,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.1.3.2.

device_plain_unchanged_memory_invariant.2.1.3.3:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_read_side_effect_super_transformers(pm_phy`mem,

ad-

dress_block

(a′, length(bl′))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy)
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} (singleton(expr_2_super (memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′))) ⊆ memory_read_side_effect_super_transformers (pm_phy‘mem, address_block(a′, length(bl′))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.1.3.3.
device_plain_unchanged_memory_invariant.2.1.4:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_read_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Using lemma device_plain_transformers_ok, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.1.4.

device_plain_unchanged_memory_invariant.2.1.5:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} singleton(expr_2_super(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′))))

(expr_2_super(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_read_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Expanding the definition of singleton, which is trivially true.

This completes the proof of device_plain_unchanged_memory_invariant.2.1.5.
device_plain_unchanged_memory_invariant.2.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_side_effect_super_transformers(pm′`mem, pm′`rw_addr), (pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)), (pm′‘ro_addr∪ pm′‘rw_addr))

{3} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Rewriting using unchanged_memory_invariant_all_transformers, matching in *, Expanding the definition of memory_write_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 -4 1) and hiding *, Using lemma pm_dev_write_side_effect, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Simplifying, rewriting, and recording with decision procedures, Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma fexpr_unchanged_memory_invariant_composition[Device_memory, list[Byte],

list[Byte]], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 5 subgoals:

device_plain_unchanged_memory_invariant.2.2.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(device_write_side_effect′(a′,

                                                                                              d,

cp′))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_write_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Repeatedly Skolemizing and flattening, Hiding formulas: (-1 2), Expanding the definition of is_device_plain_memory?, Applying disjunctive simplification to flatten sequent, Using lemma unchanged_memory_invariant_mono, Installing automatic rewrites from: subset_reflexive Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -13 1) and hiding *, Expanding the definition of subset?, Expanding the definition of union, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of dwse_super_transformers, Instantiating quantified variables, Expanding the definition of singleton, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.2.1.

device_plain_unchanged_memory_invariant.2.2.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ∀ (s: (pm′`states)):

OK?(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′))(s))

⊃

data(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′))(s))

= bl′

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_write_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Repeatedly Skolemizing and flattening,

Hiding formulas: (-6 2),

Using lemma plain_memory_side_effect_content_unchanged_write_block,

Expanding the definition of em_lift,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

device_plain_unchanged_memory_invariant.2.2.2.1:

{-1} plain_memory?(pm_phy)

{-2} side_effect_content_unchanged(address_block(a′, length(bl′)), pm_phy`states,

memory_write_side_effect(pm_phy`mem))

{-3} pm′`states(s′)
{-4} OK?(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))

{-5} OK?(OK(s′

with [(state)

:= state(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s′`state))],

data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))))

{-6} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-7} pm′`states =

(λ (em: Expand_state[Physical_memory, Device_state]): pm_phy`states(em`state))

{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state)) = bl′

Replacing using formula -7, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Installing automatic rewrites from: subset_reflexive Using lemma side_effect_content_unchanged_content, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.2.2.1.
device_plain_unchanged_memory_invariant.2.2.2.2:

{-1} plain_memory?(pm_phy)
{-2} pm′`states(s′)
{-3} OK?(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))

{-4} OK?(OK(s′

with [(state)

:= state(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s′`state))],

data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))))

{-5} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-6} pm′`states =

(λ (em: Expand_state[Physical_memory, Device_state]): pm_phy`states(em`state))

{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} (address_block(a′, length(bl′)) ⊆ pm_phy‘rw_addr)
{2} data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state)) = bl′

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets pm!1‘rw_addr, c gets pm_phy‘rw_addr,

Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_unchanged_memory_invariant.2.2.2.2.

device_plain_unchanged_memory_invariant.2.2.3:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_write_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Hiding formulas: 2,

Rewriting using em_lift_expr_2_super, matching in *,

Rewriting using em_lift_singleton, matching in *,

Replacing using formula -3,

Using lemma pm_dev_read,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma em_unchanged_memory_invariant[Physical_memory, Device_state],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-2 -3 -6 1) and hiding *,

Using lemma plain_memory_unchanged_write_side_effect_block_ro_rw,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

device_plain_unchanged_memory_invariant.2.2.3.1:

{-1} plain_memory?(pm_phy)
{-2} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_write_side_effect_super_transformers(pm_phy`mem,

ad-

dress_block

(a′,

length(bl′))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{3} (address_block(a′, length(bl′)) ⊆ pm_phy‘rw_addr)

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets pm!1‘rw_addr, c gets pm_phy‘rw_addr,

Expanding the definition of is_device_plain_memory?,

which is trivially true.

This completes the proof of device_plain_unchanged_memory_invariant.2.2.3.1.
device_plain_unchanged_memory_invariant.2.2.3.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_write_side_effect_super_transformers(pm_phy`mem,

ad-

dress_block

(a′,

length(bl′))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy)
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ((pm′‘ro_addr∪ pm′‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Using lemma pm_dev_ro_rw_addr,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.2.3.2.

device_plain_unchanged_memory_invariant.2.2.3.3:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_write_side_effect_super_transformers(pm_phy`mem,

ad-

dress_block

(a′,

length(bl′))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy)
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} (singleton(expr_2_super (memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′))) ⊆ memory_write_side_effect_super_transformers (pm_phy‘mem, address_block(a′, length(bl′))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.2.3.3.
device_plain_unchanged_memory_invariant.2.2.4:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_write_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Hiding formulas: 2, Using lemma device_plain_transformers_ok, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant.2.2.4.
device_plain_unchanged_memory_invariant.2.2.5:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = em_lift(pm_phy`states)

{-4} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} singleton(expr_2_super(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′))))

(expr_2_super(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)) ## (λ (bl1: list[Byte]):

device_write_side_effect′(a′, bl1, cp′)))),

(pm′‘ro_addr∪ pm′‘rw_addr))

Expanding the definition of singleton, which is trivially true.

This completes the proof of device_plain_unchanged_memory_invariant.2.2.5.

Q.E.D.

C.22.10 Challenge_Device_Memory.device_plain_unchanged_memory_invariant_write

Terse proof for device_plain_unchanged_memory_invariant_write.
device_plain_unchanged_memory_invariant_write:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ unchanged_memory_invariant?(pm`mem, pm`states, mem- ory_write_transformers(pm`mem, pm`rw_addr), pm`ro_addr)

Repeatedly Skolemizing and flattening, Rewriting using em_memory_write_transformers, matching in * where em_pm gets pm!1‘mem, pm

gets pm_phy‘mem, we get 2 subgoals:

device_plain_unchanged_memory_invariant_write.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, em_lift(memory_write_transformers(pm_phy`mem, pm′`rw_addr)), pm′`ro_addr)

Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma em_unchanged_memory_invariant, Using lemma pm_dev_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

device_plain_unchanged_memory_invariant_write.1.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-3} plain_memory?(pm_phy)
{-4} pm′`states = em_lift(pm_phy`states)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm′`rw_addr), (pm_phy‘ro_addr∪ (pm_phy‘rw_addr\ pm′‘rw_addr)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm′`rw_addr), pm′`ro_addr)

Hiding formulas: 2, Rewriting using unchanged_memory_invariant_union_addresses[Physical_memory], matching in *, we get 2 subgoals:

device_plain_unchanged_memory_invariant_write.1.1.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-3} plain_memory?(pm_phy)
{-4} pm′`states = em_lift(pm_phy`states)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

memory_write_transformers(pm_phy`mem, pm′`rw_addr), pm_phy`ro_addr)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm′`rw_addr), (pm_phy‘ro_addr∪ (pm_phy‘rw_addr\ pm′‘rw_addr)))

Using lemma unchanged_memory_invariant_mono, Rewriting using subset_reflexive, matching in *, Using lemma plain_memory_unchanged_memory_invariant_write, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using memory_write_transformers_mono, matching in *, Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_unchanged_memory_invariant_write.1.1.1.
device_plain_unchanged_memory_invariant_write.1.1.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-3} plain_memory?(pm_phy)
{-4} pm′`states = em_lift(pm_phy`states)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm′`rw_addr), (pm_phy‘rw_addr\ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm′`rw_addr), (pm_phy‘ro_addr∪ (pm_phy‘rw_addr\ pm′‘rw_addr)))

Rewriting using unchanged_memory_invariant_all_transformers, matching in *, Expanding the definition of memory_write_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Hiding formulas: (-3 2 3), Using lemma plain_memory_unchanged_memory_write_invariant, Expanding the definition of unchanged_memory_write_invariant?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

device_plain_unchanged_memory_invariant_write.1.1.2.1:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(a′, b′))), (pm_phy‘rw_addr\ {a′}))

{-2} b′ < max_byte
{-3} pm′`rw_addr(a′)
{-4} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-5} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-6} plain_memory?(pm_phy)
{-7} pm′`states = em_lift(pm_phy`states)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(a′, b′))), (pm_phy‘rw_addr\ pm′‘rw_addr))

Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

device_plain_unchanged_memory_invariant_write.1.1.2.1.1:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(a′, b′))), (pm_phy‘rw_addr\ {a′}))

{-2} b′ < max_byte
{-3} pm′`rw_addr(a′)
{-4} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-5} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-6} plain_memory?(pm_phy)
{-7} pm′`states = em_lift(pm_phy`states)
{1} ((pm_phy‘rw_addr\ pm′‘rw_addr) ⊆ (pm_phy‘rw_addr\ {a′}))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(a′, b′))), (pm_phy‘rw_addr\ pm′‘rw_addr))

Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant_write.1.1.2.1.1.
device_plain_unchanged_memory_invariant_write.1.1.2.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(a′, b′))), (pm_phy‘rw_addr\ {a′}))

{-2} b′ < max_byte
{-3} pm′`rw_addr(a′)
{-4} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-5} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-6} plain_memory?(pm_phy)
{-7} pm′`states = em_lift(pm_phy`states)
{1} (singleton(expr_2_super (memory_write(pm_phy‘mem)(a′, b′))) ⊆ singleton(expr_2_super (memory_write(pm_phy‘mem)(a′, b′))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(a′, b′))), (pm_phy‘rw_addr\ pm′‘rw_addr))

Rewriting using subset_reflexive, matching in *,

This completes the proof of device_plain_unchanged_memory_invariant_write.1.1.2.1.2.
device_plain_unchanged_memory_invariant_write.1.1.2.2:

{-1} b′ < max_byte
{-2} pm′`rw_addr(a′)
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-4} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-5} plain_memory?(pm_phy)
{-6} pm′`states = em_lift(pm_phy`states)
{1} pm_phy`rw_addr(a′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(a′, b′))), (pm_phy‘rw_addr\ pm′‘rw_addr))

Expanding the definition of is_device_plain_memory?, Applying disjunctive simplification to flatten sequent, Keeping (-2 -5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant_write.1.1.2.2.
device_plain_unchanged_memory_invariant_write.1.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-3} plain_memory?(pm_phy)
{-4} pm′`states = em_lift(pm_phy`states)
{1} (pm′‘ro_addr⊆ (pm_phy‘ro_addr∪ (pm_phy‘rw_addr\ pm′‘rw_addr)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm′`rw_addr), pm′`ro_addr)

Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_unchanged_memory_invariant_write.1.2.
device_plain_unchanged_memory_invariant_write.1.3:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-3} plain_memory?(pm_phy)
{-4} pm′`states = em_lift(pm_phy`states)
{1} (memory_write_transformers (pm_phy‘mem, pm′‘rw_addr) ⊆ memory_write_transformers (pm_phy‘mem, pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm′`rw_addr), pm′`ro_addr)

Rewriting using memory_write_transformers_mono, matching in *, Rewriting using subset_reflexive, matching in *,

This completes the proof of device_plain_unchanged_memory_invariant_write.1.3.
device_plain_unchanged_memory_invariant_write.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} (pm′`mem`memory_write =

(λ (a: Address, b: Byte):

em_lift[Physical_memory, Device_state, Unit](pm_phy`mem`memory_write(a, b))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), pm′`ro_addr)

Using lemma pm_dev_write, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_invariant_write.2.

Q.E.D.

C.22.11 Challenge_Device_Memory.device_plain_unchanged_memory_write_invariant

Terse proof for device_plain_unchanged_memory_write_invariant.

C.22 Proofs for Challenge_Device_Memory (device_memory.pvs)

device_plain_unchanged_memory_write_invariant:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ unchanged_memory_write_invariant?(pm`mem, pm`states, pm`rw_addr)

Expanding the definition of unchanged_memory_write_invariant?, Repeatedly Skolemizing and flattening, Using lemma pm_dev_write, Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -4, Simplifying, rewriting, and recording with decision procedures, Rewriting using em_lift_expr_2_super, matching in *, Rewriting using em_lift_singleton, matching in *, Using lemma em_unchanged_memory_invariant[Physical_memory, Device_state], Using lemma pm_dev_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_unchanged_memory_write_invariant, Expanding the definition of unchanged_memory_write_invariant?, Instantiating quantified variables, Using lemma unchanged_memory_invariant_mono, Rewriting using subset_reflexive, matching in *, Case splitting on subset?(pm!1‘rw_addr, pm_phy‘rw_addr), we get 2 subgoals:

device_plain_unchanged_memory_write_invariant.1:

{-1} (pm′‘rw_addr⊆ pm_phy‘rw_addr)

{-2} ((pm′‘rw_addr\ {waddr′}) ⊆ (pm_phy‘rw_addr\ {waddr′})) ∧

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm_phy‘rw_addr\ {waddr′}))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm′‘rw_addr\ {waddr′}))

{-3} pm_phy`rw_addr(waddr′) ⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm_phy‘rw_addr\ {waddr′}))

{-4} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-5} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-6} plain_memory?(pm_phy)
{-7} pm′`states = em_lift(pm_phy`states)

{-8} memory_write(pm′`mem) =

(λ (a: Address, b: Byte):

em_lift[Physical_memory, Device_state, Unit](memory_write(pm_phy`mem)(a, b)))

{-9} b′ < max_byte
{-10} pm′`rw_addr(waddr′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm′‘rw_addr\ {waddr′}))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

em_lift(singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′)))),

(pm′‘rw_addr\ {waddr′}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

device_plain_unchanged_memory_write_invariant.1.1:

{-1} (pm′‘rw_addr⊆ pm_phy‘rw_addr)
{-2} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-3} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-4} plain_memory?(pm_phy)
{-5} pm′`states = em_lift(pm_phy`states)

{-6} memory_write(pm′`mem) =

(λ (a: Address, b: Byte):

em_lift[Physical_memory, Device_state, Unit](memory_write(pm_phy`mem)(a, b)))

{-7} b′ < max_byte
{-8} pm′`rw_addr(waddr′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm_phy‘rw_addr\ {waddr′}))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm′‘rw_addr\ {waddr′}))

{3} pm_phy`rw_addr(waddr′)

{4} unchanged_memory_invariant?(pm′`mem, pm′`states,

em_lift(singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′)))),

(pm′‘rw_addr\ {waddr′}))

Keeping (-1 -8 3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of device_plain_unchanged_memory_write_invariant.1.1.

C Proof scripts

device_plain_unchanged_memory_write_invariant.1.2:

{-1} (pm′‘rw_addr⊆ pm_phy‘rw_addr)

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm_phy‘rw_addr\ {waddr′}))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-4} memory_read(pm′`mem) = (λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-5} plain_memory?(pm_phy)
{-6} pm′`states = em_lift(pm_phy`states)

{-7} memory_write(pm′`mem) =

(λ (a: Address, b: Byte):

em_lift[Physical_memory, Device_state, Unit](memory_write(pm_phy`mem)(a, b)))

{-8} b′ < max_byte
{-9} pm′`rw_addr(waddr′)
{1} ((pm′‘rw_addr\ {waddr′}) ⊆ (pm_phy‘rw_addr\ {waddr′}))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm′‘rw_addr\ {waddr′}))

{3} unchanged_memory_invariant?(pm′`mem, pm′`states,

em_lift(singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′)))),

(pm′‘rw_addr\ {waddr′}))

Expanding the definition of subset?, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of remove, Expanding the definition of /=, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of member, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_write_invariant.1.2.

device_plain_unchanged_memory_write_invariant.2:

{-1} ((pm′‘rw_addr\ {waddr′}) ⊆ (pm_phy‘rw_addr\ {waddr′})) ∧

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm_phy‘rw_addr\ {waddr′}))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm′‘rw_addr\ {waddr′}))

{-2} pm_phy`rw_addr(waddr′) ⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm_phy‘rw_addr\ {waddr′}))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-4} memory_read(pm′`mem) =

(λ (a: Address):

em_lift[Physical_memory, Device_state, Byte](memory_read(pm_phy`mem)(a)))

{-5} plain_memory?(pm_phy)
{-6} pm′`states = em_lift(pm_phy`states)

{-7} memory_write(pm′`mem) =

(λ (a: Address, b: Byte):

em_lift[Physical_memory, Device_state, Unit](memory_write(pm_phy`mem)(a, b)))

{-8} b′ < max_byte
{-9} pm′`rw_addr(waddr′)
{1} (pm′‘rw_addr⊆ pm_phy‘rw_addr)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′))),

(pm′‘rw_addr\ {waddr′}))

{3} unchanged_memory_invariant?(pm′`mem, pm′`states,

em_lift(singleton(expr_2_super(memory_write(pm_phy`mem)

(waddr′, b′)))),

(pm′‘rw_addr\ {waddr′}))

Expanding the definition of is_device_plain_memory?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_unchanged_memory_write_invariant.2.

Q.E.D.

C.22.12 Challenge_Device_Memory.device_plain_changed_memory_invariant

Terse proof for device_plain_changed_memory_invariant.

device_plain_changed_memory_invariant:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ changed_memory_invariant?(pm`mem, pm`states, pm`rw_addr)

Repeatedly Skolemizing and flattening, Using lemma pm_dev_plain, Using lemma pm_dev_states, Using lemma pm_dev_read, Using lemma pm_dev_write, Using lemma em_changed_memory_invariant[Physical_memory, Device_state], Using lemma plain_memory_changed_memory_invariant, Using lemma changed_memory_invariant_mono, Expanding the definition of is_device_plain_memory?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_changed_memory_invariant.

Q.E.D.

C.22.13 Challenge_Device_Memory.device_plain_read_side_effect_unchanged

Terse proof for device_plain_read_side_effect_unchanged.
device_plain_read_side_effect_unchanged:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, memory_read_side_effect(pm`mem))

Repeatedly Skolemizing and flattening, Using lemma pm_dev_read_side_effect, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Rewriting using side_effect_content_unchanged_composition, matching in * where states gets

pm!1‘states, we get 3 subgoals:

device_plain_read_side_effect_unchanged.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{1} transformer_invariant?(pm′`states,

se_super_transformers((pm′‘ro_addr∪ pm′‘rw_addr),

λ (a: Ad-

dress, bl: list[Byte], cp: bool):

em_lift

[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a, bl, cp))))

{2} side_effect_content_unchanged((pm′‘ro_addr∪ pm′‘rw_addr), pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]):

device_read_side_effect′(a, bl1, cp)))

Hiding formulas: 2, Using lemma pm_dev_plain, Using lemma pm_dev_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_invariant, Using lemma transformer_invariant_all_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of se_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Rewriting using em_lift_expr_2_super, matching in *, Rewriting using em_lift_singleton, matching in *, Using lemma em_transformer_invariant[Physical_memory, Device_state], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -5 -6 1) and hiding *, Rewriting using transformer_invariant_mono_transformers, matching in * where transformers_1

gets singleton(expr_2_super(memory_read_side_effect(pm_phy‘mem) (a!1, bl!1, cp!1))), transformers_2 gets union(pm_phy‘other_actions, union(union(memory_read_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr)), memory_write_transformers(pm_phy‘mem, pm_phy‘rw_addr)), union(memory_read_side_effect_super_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr)), memory_write_side_effect_super_transformers(pm_phy‘mem, pm_phy‘rw_addr)))),

Using lemma pm_dev_ro_rw_addr, Using lemma subset_transitive, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Expanding the definition of union, Expanding the definition of member, Applying disjunctive simplification to flatten sequent, Expanding the definition of singleton, Expanding the definition of memory_read_side_effect_super_transformers, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_read_side_effect_unchanged.1.
device_plain_read_side_effect_unchanged.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{1} side_effect_content_unchanged((pm′‘ro_addr∪ pm′‘rw_addr), pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)))

{2} side_effect_content_unchanged((pm′‘ro_addr∪ pm′‘rw_addr), pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]):

device_read_side_effect′(a, bl1, cp)))

Hiding formulas: 2, Using lemma pm_dev_plain, Using lemma pm_dev_states, Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma side_effect_content_unchanged_mono[Device_memory], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -3, Rewriting using em_side_effect_content_unchanged, matching in *, Expanding the definition of plain_memory?, which is trivially true.

This completes the proof of device_plain_read_side_effect_unchanged.2.

device_plain_read_side_effect_unchanged.3:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{1} side_effect_content_unchanged((pm′‘ro_addr∪ pm′‘rw_addr), pm′`states,

device_read_side_effect′)

{2} side_effect_content_unchanged((pm′‘ro_addr∪ pm′‘rw_addr), pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]):

device_read_side_effect′(a, bl1, cp)))

Hiding formulas: 2, Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_read_side_effect_unchanged.3.

Q.E.D.

C.22.14 Challenge_Device_Memory.device_plain_write_side_effect_unchanged

Terse proof for device_plain_write_side_effect_unchanged.
device_plain_write_side_effect_unchanged:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ side_effect_content_unchanged(pm`rw_addr, pm`states, mem- ory_write_side_effect(pm`mem))

Repeatedly Skolemizing and flattening, Using lemma pm_dev_write_side_effect, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Rewriting using side_effect_content_unchanged_composition, matching in * where states gets

pm!1‘states, we get 3 subgoals:

device_plain_write_side_effect_unchanged.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{1} transformer_invariant?(pm′`states,

se_super_transformers(pm′`rw_addr,

λ (a: Ad-

dress, bl: list[Byte], cp: bool):

em_lift

[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a, bl, cp))))

{2} side_effect_content_unchanged(pm′`rw_addr, pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]):

device_write_side_effect′(a, bl1, cp)))

Hiding formulas: 2, Using lemma pm_dev_plain, Using lemma pm_dev_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_invariant, Using lemma transformer_invariant_all_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of se_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Rewriting using em_lift_expr_2_super, matching in *, Rewriting using em_lift_singleton, matching in *, Using lemma em_transformer_invariant[Physical_memory, Device_state], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -5 -6 1) and hiding *, Rewriting using transformer_invariant_mono_transformers, matching in * where transformers_1

gets singleton(expr_2_super(memory_write_side_effect(pm_phy‘mem) (a!1, bl!1, cp!1))), transformers_2 gets union(pm_phy‘other_actions, union(union(memory_read_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr)), memory_write_transformers(pm_phy‘mem, pm_phy‘rw_addr)), union(memory_read_side_effect_super_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr)), memory_write_side_effect_super_transformers(pm_phy‘mem, pm_phy‘rw_addr)))),

Using lemma subset_transitive, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

C.22 Proofs for Challenge_Device_Memory (device_memory.pvs)

device_plain_write_side_effect_unchanged.1.1:

{-1} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-2} (address_block(a′, length(bl′)) ⊆ pm_phy‘rw_addr)

{-3} transformer_invariant?(pm_phy`states,

(pm_phy‘other_actions∪ ((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr)))))

{-4} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{1} (singleton(expr_2_super (memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′))) ⊆ (pm_phy‘other_actions∪ ((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr)))))

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))))

Keeping (-2 1) and hiding *, Expanding the definition of subset?, Expanding the definition of union, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_side_effect_super_transformers, Expanding the definition of singleton, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_write_side_effect_unchanged.1.1.
device_plain_write_side_effect_unchanged.1.2:

{-1} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-2} transformer_invariant?(pm_phy`states,

(pm_phy‘other_actions∪ ((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr)))))

{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{1} (pm′‘rw_addr⊆ pm_phy‘rw_addr)
{2} (singleton(expr_2_super (memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′))) ⊆ (pm_phy‘other_actions∪ ((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr)))))

{3} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))))

Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_write_side_effect_unchanged.1.2.

device_plain_write_side_effect_unchanged.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{1} side_effect_content_unchanged(pm′`rw_addr, pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)))

{2} side_effect_content_unchanged(pm′`rw_addr, pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]):

device_write_side_effect′(a, bl1, cp)))

Hiding formulas: 2, Using lemma pm_dev_plain, Using lemma pm_dev_states, Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma side_effect_content_unchanged_mono[Device_memory], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

device_plain_write_side_effect_unchanged.2.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} ((pm′‘ro_addr∪ pm′‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} pm′`states = em_lift(pm_phy`states)
{-4} plain_memory?(pm_phy)

{-5} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{1} side_effect_content_unchanged(pm_phy`rw_addr, pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)))

{2} side_effect_content_unchanged(pm′`rw_addr, pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]] (memory_write_side_effect(pm_phy`mem)(a, bl, cp)))

Replacing using formula -3, Rewriting using em_side_effect_content_unchanged, matching in *, Expanding the definition of plain_memory?, which is trivially true.

This completes the proof of device_plain_write_side_effect_unchanged.2.1.
device_plain_write_side_effect_unchanged.2.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-2} ((pm′‘ro_addr∪ pm′‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} pm′`states = em_lift(pm_phy`states)
{-4} plain_memory?(pm_phy)

{-5} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{1} (pm′‘rw_addr⊆ pm_phy‘rw_addr)

{2} side_effect_content_unchanged(pm′`rw_addr, pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]] (memory_write_side_effect(pm_phy`mem)(a, bl, cp)))

Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_write_side_effect_unchanged.2.2.
device_plain_write_side_effect_unchanged.3:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{1} side_effect_content_unchanged(pm′`rw_addr, pm′`states, device_write_side_effect′)

{2} side_effect_content_unchanged(pm′`rw_addr, pm′`states,

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]):

device_write_side_effect′(a, bl1, cp)))

Hiding formulas: 2, Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_write_side_effect_unchanged.3.

Q.E.D.

C.22.15 Challenge_Device_Memory.device_plain_transformers_ok2

Terse proof for device_plain_transformers_ok2.

device_plain_transformers_ok2:

{1} ∀ (device_read_side_effect,

device_write_side_effect:

[[Address, list[Byte], bool] →

[Device_memory[Physical_memory, pm_phy, Device_state] →

ExprResult[Device_memory, list[Byte]]]],

pm: Plain_Memory[Device_memory]): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ transformers_ok?(pm`states,

(memory_read_side_effect_super_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr)))

Repeatedly Skolemizing and flattening, Rewriting using transformers_ok_all_transformers, matching in *, Repeatedly Skolemizing and flattening, Expanding the definition of union, Expanding the definition of member, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

device_plain_transformers_ok2.1:

{-1} memory_read_side_effect_super_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)
{-2} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{1} transformers_ok?(pm′`states, singleton(q′))

{2} transformers_ok?(pm′`states,

(memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))

Expanding the definition of memory_read_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 -4 1) and hiding *, Using lemma pm_dev_read_side_effect, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Simplifying, rewriting, and recording with decision procedures, Rewriting using fexpr_composition_transformers_ok, matching in * where states gets pm!1‘states, P

gets LAMBDA (bl: list[Byte]): bl = bl!1, we get 4 subgoals:

device_plain_transformers_ok2.1.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′))

##

(λ (bl1: list[Byte]): device_read_side_effect′(a′, bl1, cp′)))))

Rewriting using em_lift_expr_2_super, matching in *, Rewriting using em_lift_singleton, matching in *, Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma em_transformers_ok[Physical_memory, Device_state], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_transformers_ok_read_side_effects_ro_rw, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -3 -6 1) and hiding *, Rewriting using transformers_ok_mono_transformers[Physical_memory], matching in * where trans-

formers_1 gets singleton(expr_2_super(memory_read_side_effect(pm_phy‘mem) (a!1, bl!1, cp!1))), transformers_2 gets memory_read_side_effect_super_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr)),

Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -4 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Expanding the definition of member, Expanding the definition of singleton, Expanding the definition of memory_read_side_effect_super_transformers, Instantiating quantified variables, Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), c gets

union(pm_phy‘ro_addr, pm_phy‘rw_addr), b gets union(pm!1‘ro_addr, pm!1‘rw_addr),

This completes the proof of device_plain_transformers_ok2.1.1.

device_plain_transformers_ok2.1.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformer_invariant?(pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′))

##

(λ (bl1: list[Byte]): device_read_side_effect′(a′, bl1, cp′)))))

Hiding formulas: 2, Rewriting using em_lift_expr_2_super, matching in *, Rewriting using em_lift_singleton, matching in *, Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -3, Rewriting using em_transformer_invariant, matching in *, Using lemma plain_memory_invariant, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_dev_ro_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -7 1) and hiding *, Expanding the definition of subset?, Expanding the definition of singleton, Expanding the definition of union, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of memory_read_side_effect_super_transformers, Instantiating quantified variables, Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), c gets

union(pm_phy‘ro_addr, pm_phy‘rw_addr), b gets union(pm!1‘ro_addr, pm!1‘rw_addr),

This completes the proof of device_plain_transformers_ok2.1.2.

device_plain_transformers_ok2.1.3:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ∀ (s: (pm′`states)):

OK?(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′))(s))

⊃

data(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′))(s))

= bl′

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′))

##

(λ (bl1: list[Byte]): device_read_side_effect′(a′, bl1, cp′)))))

Repeatedly Skolemizing and flattening,

Expanding the definition of em_lift,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: (-3 -5 2),

Using lemma pm_dev_plain,

Using lemma pm_dev_ro_rw_addr,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of plain_memory?,

Applying disjunctive simplification to flatten sequent,

Using lemma side_effect_content_unchanged_content,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

device_plain_transformers_ok2.1.3.1:

{-1} side_effect_content_unchanged((pm_phy‘ro_addr∪ pm_phy‘rw_addr), pm_phy`states,

memory_read_side_effect(pm_phy`mem))

{-2} OK?(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} ((pm′‘ro_addr∪ pm′‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-7} unchanged_memory_write_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)
{-8} changed_memory_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)

{-9} transformers_ok?(pm_phy`states,

((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{-10} side_effect_content_unchanged(pm_phy`rw_addr, pm_phy`states,

memory_write_side_effect(pm_phy`mem))

{-11} pm′`states(s′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} (address_block(a′, length(bl′)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{2} data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state)) = bl′

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), c gets union(pm_phy‘ro_addr, pm_phy‘rw_addr), b gets union(pm!1‘ro_addr, pm!1‘rw_addr),

This completes the proof of device_plain_transformers_ok2.1.3.1.
device_plain_transformers_ok2.1.3.2:

{-1} side_effect_content_unchanged((pm_phy‘ro_addr∪ pm_phy‘rw_addr), pm_phy`states,

memory_read_side_effect(pm_phy`mem))

{-2} OK?(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{-4} ((pm′‘ro_addr∪ pm′‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-7} unchanged_memory_write_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)
{-8} changed_memory_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)

{-9} transformers_ok?(pm_phy`states,

((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{-10} side_effect_content_unchanged(pm_phy`rw_addr, pm_phy`states,

memory_write_side_effect(pm_phy`mem))

{-11} pm′`states(s′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} pm_phy`states(s′`state)
{2} data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state)) = bl′

Using lemma pm_dev_states, Expanding the definition of em_lift, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_transformers_ok2.1.3.2.
device_plain_transformers_ok2.1.4:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_read_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_read_side_effect′(a, bl1, cp)))

{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm′`states,

singleton(expr_2_super(device_read_side_effect′(a′, d, cp′))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′))

##

(λ (bl1: list[Byte]): device_read_side_effect′(a′, bl1, cp′)))))

Repeatedly Skolemizing and flattening, Expanding the definition of is_device_plain_memory?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-14 1) and hiding *, Expanding the definition of subset?, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Expanding the definition of drse_super_transformers, Expanding the definition of union, Expanding the definition of member, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_transformers_ok2.1.4.
device_plain_transformers_ok2.2:

{-1} memory_write_side_effect_super_transformers(pm′`mem, pm′`rw_addr)(q′)
{-2} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{1} transformers_ok?(pm′`states, singleton(q′))

{2} transformers_ok?(pm′`states, (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))

Hiding formulas: 2, Expanding the definition of memory_write_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 -4 1) and hiding *, Using lemma pm_dev_write_side_effect, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Simplifying, rewriting, and recording with decision procedures, Rewriting using fexpr_composition_transformers_ok, matching in * where states gets pm!1‘states, P

gets LAMBDA (bl: list[Byte]): bl = bl!1, we get 4 subgoals:

device_plain_transformers_ok2.2.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-3} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))

##

(λ (bl1: list[Byte]): device_write_side_effect′(a′, bl1, cp′)))))

Rewriting using em_lift_expr_2_super, matching in *, Rewriting using em_lift_singleton, matching in *, Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma em_transformers_ok[Physical_memory, Device_state], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_transformers_ok_write_side_effects_ro_rw, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -3 -6 1) and hiding *, Rewriting using transformers_ok_mono_transformers[Physical_memory], matching in * where trans-

formers_1 gets singleton(expr_2_super(memory_write_side_effect(pm_phy‘mem) (a!1, bl!1, cp!1))), transformers_2 gets memory_write_side_effect_super_transformers(pm_phy‘mem, pm_phy‘rw_addr),

Keeping (-2 -3 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Expanding the definition of member, Expanding the definition of singleton, Expanding the definition of memory_write_side_effect_super_transformers, Instantiating quantified variables, Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), c gets

pm_phy‘rw_addr, b gets pm!1‘rw_addr, Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_transformers_ok2.2.1.

device_plain_transformers_ok2.2.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-3} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformer_invariant?(pm′`states,

singleton(expr_2_super(em_lift

[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))

##

(λ (bl1: list[Byte]): device_write_side_effect′(a′, bl1, cp′)))))

Hiding formulas: 2, Rewriting using em_lift_expr_2_super, matching in *, Rewriting using em_lift_singleton, matching in *, Using lemma pm_dev_states, Using lemma pm_dev_plain, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -3, Rewriting using em_transformer_invariant, matching in *, Using lemma plain_memory_invariant, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 -6 1) and hiding *, Expanding the definition of subset?, Expanding the definition of singleton, Expanding the definition of union, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_side_effect_super_transformers, Instantiating quantified variables, Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), c gets

pm_phy‘rw_addr, b gets pm!1‘rw_addr, Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_transformers_ok2.2.2.

device_plain_transformers_ok2.2.3:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-3} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ∀ (s: (pm′`states)):

OK?(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′))(s))

⊃

data(em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′))(s))

= bl′

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))

##

(λ (bl1: list[Byte]): device_write_side_effect′(a′, bl1, cp′)))))

Repeatedly Skolemizing and flattening,

Expanding the definition of em_lift,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: (-3 -5 2),

Using lemma pm_dev_plain,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of plain_memory?,

Applying disjunctive simplification to flatten sequent,

Using lemma side_effect_content_unchanged_content,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

device_plain_transformers_ok2.2.3.1:

{-1} side_effect_content_unchanged(pm_phy`rw_addr, pm_phy`states,

memory_write_side_effect(pm_phy`mem))

{-2} OK?(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-6} unchanged_memory_write_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)
{-7} changed_memory_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)

{-8} transformers_ok?(pm_phy`states,

((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{-9} side_effect_content_unchanged((pm_phy‘ro_addr∪ pm_phy‘rw_addr), pm_phy`states,

memory_read_side_effect(pm_phy`mem))

{-10} pm′`states(s′)
{-11} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} (address_block(a′, length(bl′)) ⊆ pm_phy‘rw_addr)
{2} data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state)) = bl′

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), c gets pm_phy‘rw_addr, b gets pm!1‘rw_addr,

Expanding the definition of is_device_plain_memory?, which is trivially true.

This completes the proof of device_plain_transformers_ok2.2.3.1.
device_plain_transformers_ok2.2.3.2:

{-1} side_effect_content_unchanged(pm_phy`rw_addr, pm_phy`states,

memory_write_side_effect(pm_phy`mem))

{-2} OK?(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state))
{-3} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-6} unchanged_memory_write_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)
{-7} changed_memory_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)

{-8} transformers_ok?(pm_phy`states,

((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{-9} side_effect_content_unchanged((pm_phy‘ro_addr∪ pm_phy‘rw_addr), pm_phy`states,

memory_read_side_effect(pm_phy`mem))

{-10} pm′`states(s′)
{-11} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} pm_phy`states(s′`state)
{2} data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′`state)) = bl′

Using lemma pm_dev_states, Expanding the definition of em_lift, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_transformers_ok2.2.3.2.
device_plain_transformers_ok2.2.4:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{-2} memory_write_side_effect(pm′`mem) =

(λ (a: Address, bl: list[Byte], cp: bool):

em_lift[Physical_memory, Device_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)(a, bl, cp)) ## (λ (bl1: list[Byte]): device_write_side_effect′(a, bl1, cp)))

{-3} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm′`states,

singleton(expr_2_super(device_write_side_effect′(a′, d, cp′))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(em_lift[Physical_memory, De-

vice_state, list[Byte]]

(memory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′))

##

(λ (bl1: list[Byte]): device_write_side_effect′(a′, bl1, cp′)))))

Repeatedly Skolemizing and flattening, Expanding the definition of is_device_plain_memory?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-14 1) and hiding *, Expanding the definition of subset?, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Expanding the definition of dwse_super_transformers, Expanding the definition of union, Expanding the definition of member, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_plain_transformers_ok2.2.4.

Q.E.D.

C.22.16 Challenge_Device_Memory.device_memory_plain_memory

Terse proof for device_memory_plain_memory.

device_memory_plain_memory:

{1} ∀ (device_read_side_effect, device_write_side_effect: [[Address, list[Byte], bool] → [Device_memory[Physical_memory, pm_phy, Device_state] → ExprResult[Device_memory, list[Byte]]]], pm): is_device_plain_memory?(device_read_side_effect, device_write_side_effect)(pm) ⊃ plain_memory?(pm)

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 7 subgoals:

device_memory_plain_memory.1:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} side_effect_content_unchanged(pm′`rw_addr, pm′`states, memory_write_side_effect(pm′`mem))

Using lemma device_plain_write_side_effect_unchanged, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_memory_plain_memory.1.
device_memory_plain_memory.2:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} side_effect_content_unchanged((pm′‘ro_addr∪ pm′‘rw_addr), pm′`states, memory_read_side_effect(pm′`mem))

Using lemma device_plain_read_side_effect_unchanged, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_memory_plain_memory.2.
device_memory_plain_memory.3:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} transformers_ok?(pm′`states, ((memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

Using lemma device_plain_transformers_ok, Using lemma device_plain_transformers_ok2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using transformers_ok_union_transformers, matching in * where states gets

pm!1‘states, transformers_1 gets union(memory_read_transformers(pm!1‘mem, union(pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_transformers(pm!1‘mem, pm!1‘rw_addr)), transformers_2 gets union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr)),

This completes the proof of device_memory_plain_memory.3.
device_memory_plain_memory.4:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{1} changed_memory_invariant?(pm′`mem, pm′`states, pm′`rw_addr)

Using lemma device_plain_changed_memory_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_memory_plain_memory.4.

device_memory_plain_memory.5:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)
{1} unchanged_memory_write_invariant?(pm′`mem, pm′`states, pm′`rw_addr)

Using lemma device_plain_unchanged_memory_write_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_memory_plain_memory.5.
device_memory_plain_memory.6:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), pm′`ro_addr)

Using lemma device_plain_unchanged_memory_invariant_write, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_memory_plain_memory.6.
device_memory_plain_memory.7:

{-1} is_device_plain_memory?(device_read_side_effect′, device_write_side_effect′)(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Using lemma device_plain_unchanged_memory_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of device_memory_plain_memory.7.

Q.E.D.

C.23 Proofs for Challenge_Random_Device (random_device.pvs)

C.23.1 Challenge_Random_Device.IMP_Random_Device_TCC1

Terse proof for IMP_Random_Device_TCC1.
IMP_Random_Device_TCC1:

{1} 0 < size(uidt(dt_uint)) ∧ 3 × size(uidt(dt_uint)) ≤ max_linear_offset

Using lemma dt_uint_size, This completes the proof of IMP_Random_Device_TCC1. Q.E.D.

C.23.2 Challenge_Random_Device.in_blessed_memory_disjoint_device

Terse proof for in_blessed_memory_disjoint_device.
in_blessed_memory_disjoint_device:

{1} ∀ (a: Address, l: nat):

(address_block(a, l) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ disjoint?(address_block(a, l), address_block(base, size))

C.23 Proofs for Challenge_Random_Device (random_device.pvs)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of in_blessed_memory_disjoint_device.

Q.E.D.

C.23.3 Challenge_Random_Device.in_blessed_memory_not_device_address

Terse proof for in_blessed_memory_not_device_address.
in_blessed_memory_not_device_address:

{1} ∀ (a: Address, bl: list[Byte]):

(address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl) ⊃ a ≠ rnd_seed ∧ a ≠ mem_cnt ∧ a ≠ rnd_val

Repeatedly Skolemizing and flattening, Using lemma in_blessed_memory_disjoint_device, Replacing using formula -3, Keeping (-1 -4 1) and hiding *, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, Adding type constraints for base, Expanding the definition of disjoint?, Expanding the definition of empty?, Instantiating the top quantifier in -5 with the terms: (a!1), Case splitting on size(uidt(dt_uint)) > 0, we get 2 subgoals:

in_blessed_memory_not_device_address.1:

{-1} size(uidt(dt_uint)) > 0
{-2} Mem?(base`type_of)
{-3} 0 ≤ base`offset
{-4} base`offset < max_linear_offset
{-5} base + size[Physical_memory, pm_phy] ≤ max_linear
{-6} cons?(bl′)
{1} (a′ ∈ (address_block(a′, 1 + length(cdr(bl′))) ∩ address_block(base, size)))
{2} a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of in_blessed_memory_not_device_address.1.
in_blessed_memory_not_device_address.2:

{-1} Mem?(base`type_of)
{-2} 0 ≤ base`offset
{-3} base`offset < max_linear_offset
{-4} base + size[Physical_memory, pm_phy] ≤ max_linear
{-5} cons?(bl′)
{1} size(uidt(dt_uint)) > 0
{2} (a′ ∈ (address_block(a′, 1 + length(cdr(bl′))) ∩ address_block(base, size)))
{3} a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val

Using lemma dt_uchar_size, Using lemma dt_uint_size, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of in_blessed_memory_not_device_address.2.

Q.E.D.

C.23.4 Challenge_Random_Device.random_side_effects_unchanged_invariant

Terse proof for random_side_effects_unchanged_invariant.
random_side_effects_unchanged_invariant:

{1} unchanged_memory_invariant?(pm`mem, pm`states, (drse_super_transformers ((pm‘ro_addr∪ pm‘rw_addr), rnd_dev_read_side_effect ) ∪ dwse_super_transformers (pm‘rw_addr, rnd_dev_write_side_effect )), (pm‘ro_addr∪ pm‘rw_addr))

Installing automatic rewrites from: pm random_device_pm random_device_pm_mem Rewriting using unchanged_memory_invariant_all_transformers, matching in *, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using em_const_unchanged_memory_invariant, matching in * where em_pm gets de-

vice_pm(rnd_dev_read_side_effect, rnd_dev_write_side_effect), pm gets pm_phy‘mem, we get 2 subgoals:

random_side_effects_unchanged_invariant.1:

{-1} union(drse_super_transformers(((pm_phy‘ro_addr\ address_block(base, size)) ∪ (pm_phy‘rw_addr\ address_block(base, size))),

rnd_dev_read_side_effect),

dwse_super_transformers((pm_phy‘rw_addr\ address_block(base, size)),

rnd_dev_write_side_effect))

(q′)

{1} (device_pm(rnd_dev_read_side_effect, rnd_dev_write_side_effect)`memory_read =

(λ (a: Address):

em_lift[Physical_memory, Random_device_state[Physical_memory, pm_phy], Byte]

(pm_phy`mem`memory_read(a))))

{2} unchanged_memory_invariant?(device_pm(rnd_dev_read_side_effect, rnd_dev_write_side_effect), em_lift(pm_phy`states), singleton(q′), ((pm_phy‘ro_addr\ address_block(base, size)) ∪ (pm_phy‘rw_addr\ address_block(base, size))))

Expanding the definition of device_pm, which is trivially true.

This completes the proof of random_side_effects_unchanged_invariant.1.
random_side_effects_unchanged_invariant.2:

{-1} union(drse_super_transformers(((pm_phy‘ro_addr\ address_block(base, size)) ∪ (pm_phy‘rw_addr\ address_block(base, size))),

rnd_dev_read_side_effect),

dwse_super_transformers((pm_phy‘rw_addr\ address_block(base, size)),

rnd_dev_write_side_effect))

(q′)

{1} ∀ (s: Expand_state[Physical_memory, Random_device_state[Physical_memory, pm_phy]]):

has_next_state(q′(s)) ⊃ state(q′(s))`state = s`state {2} unchanged_memory_invariant?(device_pm(rnd_dev_read_side_effect, rnd_dev_write_side_effect),

em_lift(pm_phy`states), singleton(q′),

((pm_phy‘ro_addr\ address_block(base, size)) ∪ (pm_phy‘rw_addr\ address_block(base, size))))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of union,

C.23 Proofs for Challenge_Random_Device (random_device.pvs)

Expanding the definition of member, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

random_side_effects_unchanged_invariant.2.1:

{-1} has_next_state(q′(s′))

{-2} drse_super_transformers(((pm_phy‘ro_addr\ address_block(base, size)) ∪ (pm_phy‘rw_addr\ address_block(base, size))),

rnd_dev_read_side_effect) (q′)

{1} state(q′(s′))`state = s′`state

Expanding the definition of drse_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -4, Keeping (-2 1) and hiding *, Rewriting using has_next_state_expr_2_super, matching in *, Rewriting using state_expr_2_super, matching in *, Expanding the definition of rnd_dev_read_side_effect, Expanding the definition of unaligned_access, Case splitting on null?(bl!1) OR disjoint?(address_block(a!1, length(bl!1)), address_block(base,

size[Physical_memory, pm_phy])) OR (NOT cp!1 AND length(bl!1) = size(uidt(dt_uint)) AND (a!1 = rnd_seed OR a!1 = mem_cnt OR a!1 = rnd_val)),

we get 2 subgoals:

random_side_effects_unchanged_invariant.2.1.1:

{-1} null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size[Physical_memory, pm_phy]))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

{-2} has_next_state((if null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′) else fatal_result endif ## (λ (bl: list[Byte]):

access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]): read_seed(a′, bl, cp′))))))

(s′))

{1} state((if null?(bl′) ∨ disjoint?(address_block(a′, length(bl′)), address_block(base, size)) ∨ (¬ cp′ ∧

length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′) else fatal_result endif ## (λ (bl: list[Byte]):

access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]): read_seed(a′, bl, cp′))))))

(s′))`state

= s′`state

Replacing using formula -1, Expanding the definition of access_count, Expanding the definition of read_rnd_val, Expanding the definition of read_mem_cnt, Expanding the definition of read_seed, Expanding the definition of ##, Expanding the definition of ok_result, Expanding the definition of has_next_state, Lifting IF-conditions to the top level, Expanding the definition of increase_access_count, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_unchanged_invariant.2.1.1.
random_side_effects_unchanged_invariant.2.1.2:

{-1} has_next_state((if null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′) else fatal_result endif ## (λ (bl: list[Byte]):

access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]): read_seed(a′, bl, cp′))))))

(s′))

{1} null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size[Physical_memory, pm_phy]))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

{2} state((if null?(bl′) ∨ disjoint?(address_block(a′, length(bl′)), address_block(base, size)) ∨ (¬ cp′ ∧

length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′) else fatal_result endif ## (λ (bl: list[Byte]):

access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]): read_seed(a′, bl, cp′))))))

(s′))`state

= s′`state

Replacing using formula 1, Expanding the definition of fatal_result,

C Proof scripts

Expanding the definition of ##, Expanding the definition of has_next_state, which is trivially true.

This completes the proof of random_side_effects_unchanged_invariant.2.1.2.
random_side_effects_unchanged_invariant.2.2:

{-1} has_next_state(q′(s′))

{-2} dwse_super_transformers((pm_phy‘rw_addr\ address_block(base, size)),

rnd_dev_write_side_effect) (q′)

{1} state(q′(s′))`state = s′`state

Expanding the definition of dwse_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -4, Keeping (-2 1) and hiding *, Rewriting using has_next_state_expr_2_super, matching in *, Rewriting using state_expr_2_super, matching in *, Expanding the definition of rnd_dev_write_side_effect, Expanding the definition of unaligned_access, Case splitting on null?(bl!1) OR disjoint?(address_block(a!1, length(bl!1)), address_block(base,

size[Physical_memory, pm_phy])) OR (NOT cp!1 AND length(bl!1) = size(uidt(dt_uint)) AND (a!1 = rnd_seed OR a!1 = mem_cnt OR a!1 = rnd_val)),

we get 2 subgoals:

random_side_effects_unchanged_invariant.2.2.1:

{-1} null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size[Physical_memory, pm_phy]))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

{-2} has_next_state((if null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′) else fatal_result endif ## (λ (bl: list[Byte]):

access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count(a′, bl, cp′)))))

(s′))

{1} state((if null?(bl′) ∨ disjoint?(address_block(a′, length(bl′)), address_block(base, size)) ∨ (¬ cp′ ∧

length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′) else fatal_result endif ## (λ (bl: list[Byte]):

access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count(a′, bl, cp′)))))

(s′))`state

= s′`state

Replacing using formula -1, Expanding the definition of access_count, Expanding the definition of write_rnd_dev, Expanding the definition of increase_access_count, Expanding the definition of reset_count, Expanding the definition of ok_result, Expanding the definition of ##, Expanding the definition of clear_counter, Expanding the definition of fatal_result, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_unchanged_invariant.2.2.1.
random_side_effects_unchanged_invariant.2.2.2:

{-1} has_next_state((if null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′) else fatal_result endif ## (λ (bl: list[Byte]):

access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count(a′, bl, cp′)))))

(s′))

{1} null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size[Physical_memory, pm_phy]))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

{2} state((if null?(bl′) ∨ disjoint?(address_block(a′, length(bl′)), address_block(base, size)) ∨ (¬ cp′ ∧

length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′) else fatal_result endif ## (λ (bl: list[Byte]):

access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count(a′, bl, cp′)))))

(s′))`state

= s′`state

Replacing using formula 1,

Expanding the definition of fatal_result,

Expanding the definition of ##,

Expanding the definition of has_next_state,

which is trivially true.

This completes the proof of random_side_effects_unchanged_invariant.2.2.2.

Q.E.D.

C.23 Proofs for Challenge_Random_Device (random_device.pvs)

C.23.5 Challenge_Random_Device.random_side_effects_transformers_ok

Terse proof for random_side_effects_transformers_ok.
random_side_effects_transformers_ok:

{1} transformers_ok?(pm`states,

(drse_super_transformers ((pm‘ro_addr∪ pm‘rw_addr), rnd_dev_read_side_effect ) ∪ dwse_super_transformers (pm‘rw_addr, rnd_dev_write_side_effect )))

Installing automatic rewrites from: ok_expr_2_super has_next_state_expr_2_super fatal_result state_expr_2_super ok_result_state ok_result_ok expr_2_super_ok_result expr_2_super_fatal_result has_next_state_ok_result has_next_state_fatal_result ok_result_data in_blessed_memory_disjoint_device

Rewriting using transformers_ok_union_transformers, matching in *, we get 2 subgoals:

random_side_effects_transformers_ok.1:

{1} transformers_ok?(pm`states,

drse_super_transformers((pm‘ro_addr∪ pm‘rw_addr),

rnd_dev_read_side_effect))

{2} transformers_ok?(pm`states,

(drse_super_transformers ((pm‘ro_addr∪ pm‘rw_addr), rnd_dev_read_side_effect ) ∪ dwse_super_transformers (pm‘rw_addr, rnd_dev_write_side_effect )))

Rewriting using transformers_ok_all_transformers, matching in *, Expanding the definition of drse_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 1) and hiding *, Expanding the definition of rnd_dev_read_side_effect, Using lemma in_blessed_memory_disjoint_device, Using lemma in_blessed_memory_not_device_address, Replacing using formula -3, Case splitting on transformers_ok?(pm‘states, singleton(expr_2_super(ok_result [Random_device_memory,

list[Byte]] (bl!1)))), we get 2 subgoals:

random_side_effects_transformers_ok.1.1:

{-1} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-3} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ

(bl: list[Byte]):

read_seed

(a′, bl, cp′)))))))))

Case splitting on transformer_invariant?(pm‘states, singleton(expr_2_super (ok_result [Random_device_memory, list[Byte]] (bl!1)))),

we get 2 subgoals:

random_side_effects_transformers_ok.1.1.1:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-4} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ

(bl: list[Byte]):

read_seed

(a′, bl, cp′)))))))))

Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA (bl: list[Byte]): bl = bl!1,

we get 4 subgoals:

random_side_effects_transformers_ok.1.1.1.1:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-4} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{1} transformers_ok?(pm`states, singleton(expr_2_super(unaligned_access(a′, bl′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ

(bl: list[Byte]):

read_seed

(a′, bl, cp′)))))))))

Expanding the definition of unaligned_access, which is trivially true.

This completes the proof of random_side_effects_transformers_ok.1.1.1.1.
random_side_effects_transformers_ok.1.1.1.2:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-4} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} transformer_invariant?(pm`states,

singleton(expr_2_super(unaligned_access(a′, bl′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ

(bl: list[Byte]):

read_seed

(a′, bl, cp′)))))))))

Expanding the definition of unaligned_access,

which is trivially true.

This completes the proof of random_side_effects_transformers_ok.1.1.1.2.

random_side_effects_transformers_ok.1.1.1.3:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-4} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} ∀ (s: (pm`states)):

OK?(unaligned_access(a′, bl′, cp′)(s)) ⊃ data(unaligned_access(a′, bl′, cp′)(s)) = bl′

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ

(bl: list[Byte]):

read_seed

(a′, bl, cp′)))))))))

Expanding the definition of unaligned_access,

Repeatedly Skolemizing and flattening,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of random_side_effects_transformers_ok.1.1.1.3.

random_side_effects_transformers_ok.1.1.1.4:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-4} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d, cp′) ##

(λ (bl: list[Byte]): read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′)))))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ

(bl: list[Byte]):

read_seed

(a′, bl, cp′)))))))))

Repeatedly Skolemizing and flattening,

Hiding formulas: (-1 2),

Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA (bl: list[Byte]): bl = bl!1,

we get 4 subgoals:

random_side_effects_transformers_ok.1.1.1.4.1:

{-1} d′ = bl′

{-2} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-5} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-6} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{1} transformers_ok?(pm`states, singleton(expr_2_super(access_count(a′, d′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d′, cp′) ##

(λ (bl: list[Byte]): read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′)))))))

Expanding the definition of access_count,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.1.
random_side_effects_transformers_ok.1.1.1.4.2:

{-1} d′ = bl′

{-2} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-5} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-6} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{1} transformer_invariant?(pm`states, singleton(expr_2_super(access_count(a′, d′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d′, cp′) ##

(λ (bl: list[Byte]): read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′)))))))

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.2.

random_side_effects_transformers_ok.1.1.1.4.3:

{-1} d′ = bl′

{-2} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-5} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-6} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} ∀ (s: (pm`states)):

OK?(access_count(a′, d′, cp′)(s)) ⊃ data(access_count(a′, d′, cp′)(s)) = bl′

{2} transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d′, cp′) ##

(λ (bl: list[Byte]): read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′)))))))

Repeatedly Skolemizing and flattening, Expanding the definition of access_count, which is trivially true.

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.3.
random_side_effects_transformers_ok.1.1.1.4.4:

{-1} d′ = bl′

{-2} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-5} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-6} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm`states,

singleton(expr_2_super(read_rnd_val(a′, d, cp′) ##

(λ (bl: list[Byte]): read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′))))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d′, cp′) ##

(λ (bl: list[Byte]): read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′)))))))

Repeatedly Skolemizing and flattening, Hiding formulas: (-1 2), Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA (bl:

list[Byte]): bl = bl!1, we get 4 subgoals:

random_side_effects_transformers_ok.1.1.1.4.4.1:

{-1} d′′ = bl′
{-2} d′ = bl′

{-3} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-6} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-7} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{1} transformers_ok?(pm`states, singleton(expr_2_super(read_rnd_val(a′, d′′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(read_rnd_val(a′, d′′, cp′) ##

(λ (bl: list[Byte]): read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′))))))

Hiding formulas: 2, Expanding the definition of read_rnd_val, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.4.1.
random_side_effects_transformers_ok.1.1.1.4.4.2:

{-1} d′′ = bl′
{-2} d′ = bl′

{-3} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-6} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-7} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{1} transformer_invariant?(pm`states, singleton(expr_2_super(read_rnd_val(a′, d′′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(read_rnd_val(a′, d′′, cp′) ##

(λ (bl: list[Byte]): read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′))))))

Expanding the definition of read_rnd_val, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.4.2.

random_side_effects_transformers_ok.1.1.1.4.4.3:

{-1} d′′ = bl′
{-2} d′ = bl′

{-3} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-6} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-7} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} ∀ (s: (pm`states)):

OK?(read_rnd_val(a′, d′′, cp′)(s)) ⊃ data(read_rnd_val(a′, d′′, cp′)(s)) = bl′

{2} transformers_ok?(pm`states,

singleton(expr_2_super(read_rnd_val(a′, d′′, cp′) ##

(λ (bl: list[Byte]): read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′))))))

Repeatedly Skolemizing and flattening, Expanding the definition of read_rnd_val, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.4.3.
random_side_effects_transformers_ok.1.1.1.4.4.4:

{-1} d′′ = bl′
{-2} d′ = bl′

{-3} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-6} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-7} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm`states,

singleton(expr_2_super(read_mem_cnt(a′, d, cp′) ##

(λ (bl: list[Byte]):

read_seed(a′, bl, cp′)))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(read_rnd_val(a′, d′′, cp′) ##

(λ (bl: list[Byte]): read_mem_cnt(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_seed(a′, bl, cp′))))))

Repeatedly Skolemizing and flattening, Hiding formulas: (-1 2), Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA (bl: list[Byte]): bl = bl!1,

we get 4 subgoals:

random_side_effects_transformers_ok.1.1.1.4.4.4.1:

{-1} d′′′ = bl′
{-2} d′′ = bl′
{-3} d′ = bl′

{-4} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-6} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-7} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-8} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{1} transformers_ok?(pm`states, singleton(expr_2_super(read_mem_cnt(a′, d′′′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(read_mem_cnt(a′, d′′′, cp′) ##

(λ (bl: list[Byte]): read_seed(a′, bl, cp′)))))

Expanding the definition of read_mem_cnt,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.4.4.1.
random_side_effects_transformers_ok.1.1.1.4.4.4.2:

{-1} d′′′ = bl′
{-2} d′′ = bl′
{-3} d′ = bl′

{-4} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-6} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-7} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-8} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{1} transformer_invariant?(pm`states, singleton(expr_2_super(read_mem_cnt(a′, d′′′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(read_mem_cnt(a′, d′′′, cp′) ##

(λ (bl: list[Byte]): read_seed(a′, bl, cp′)))))

Expanding the definition of read_mem_cnt,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.4.4.2.

random_side_effects_transformers_ok.1.1.1.4.4.4.3:

{-1} d′′′ = bl′
{-2} d′′ = bl′
{-3} d′ = bl′

{-4} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-6} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-7} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-8} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} ∀ (s: (pm`states)):

OK?(read_mem_cnt(a′, d′′′, cp′)(s)) ⊃

data(read_mem_cnt(a′, d′′′, cp′)(s)) = bl′

{2} transformers_ok?(pm`states,

singleton(expr_2_super(read_mem_cnt(a′, d′′′, cp′) ##

(λ (bl: list[Byte]): read_seed(a′, bl, cp′)))))

Expanding the definition of read_mem_cnt,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.4.4.3.
random_side_effects_transformers_ok.1.1.1.4.4.4.4:

{-1} d′′′ = bl′
{-2} d′′ = bl′
{-3} d′ = bl′

{-4} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-6} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-7} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-8} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm`states, singleton(expr_2_super(read_seed(a′, d, cp′)))) {2} transformers_ok?(pm`states,

singleton(expr_2_super(read_mem_cnt(a′, d′′′, cp′) ##

(λ (bl: list[Byte]): read_seed(a′, bl, cp′)))))

Repeatedly Skolemizing and flattening,

Expanding the definition of read_seed,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.1.4.4.4.4.

random_side_effects_transformers_ok.1.1.2:

{-1} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-3} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ

(bl: list[Byte]):

read_seed

(a′, bl, cp′)))))))))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.1.2.
random_side_effects_transformers_ok.1.2:

{-1} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-2} disjoint?(address_block(a′, length(bl′)), address_block(base, size))
{-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{1} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_rnd_val(a′, bl, cp′) ## (λ (bl: list[Byte]):

read_mem_cnt(a′, bl, cp′) ## (λ

(bl: list[Byte]):

read_seed

(a′, bl, cp′)))))))))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.1.2.

random_side_effects_transformers_ok.2:

{1} transformers_ok?(pm`states, dwse_super_transformers(pm`rw_addr, rnd_dev_write_side_effect))

{2} transformers_ok?(pm`states, (drse_super_transformers ((pm‘ro_addr∪ pm‘rw_addr), rnd_dev_read_side_effect ) ∪ dwse_super_transformers (pm‘rw_addr, rnd_dev_write_side_effect )))

Rewriting using transformers_ok_all_transformers, matching in *,

Expanding the definition of dwse_super_transformers,

Repeatedly Skolemizing and flattening,

Replacing using formula -3,

Keeping (-2 1) and hiding *,

Expanding the definition of rnd_dev_write_side_effect,

Using lemma in_blessed_memory_disjoint_device,

Using lemma in_blessed_memory_not_device_address,

Case splitting on subset?(address_block(a!1, length(bl!1)), union(pm‘ro_addr, pm‘rw_addr)),

we get 2 subgoals:

random_side_effects_transformers_ok.2.1:

{-1} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{-2} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl′) ⊃

a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val {-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

disjoint?(address_block(a′, length(bl′)), address_block(base, size))

{-4} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Case splitting on transformers_ok?(pm‘states, singleton(expr_2_super(ok_result [Random_device_memory, list[Byte]] (bl!1)))),

we get 2 subgoals:

random_side_effects_transformers_ok.2.1.1:

{-1} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl′) ⊃

a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val {-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

disjoint?(address_block(a′, length(bl′)), address_block(base, size))

{-5} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Case splitting on transformer_invariant?(pm‘states, singleton(expr_2_super (ok_result [Random_device_memory, list[Byte]] (bl!1)))),

we get 2 subgoals:

random_side_effects_transformers_ok.2.1.1.1:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl′) ⊃

a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val {-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

disjoint?(address_block(a′, length(bl′)), address_block(base, size))

{-6} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA (bl: list[Byte]): bl = bl!1,

we get 4 subgoals:

random_side_effects_transformers_ok.2.1.1.1.1:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-4} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-5} true ⊃ true
{-6} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{1} transformers_ok?(pm`states, singleton(expr_2_super(unaligned_access(a′, bl′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Expanding the definition of unaligned_access, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.1.
random_side_effects_transformers_ok.2.1.1.1.2:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-4} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-5} true ⊃ true
{-6} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} transformer_invariant?(pm`states,

singleton(expr_2_super(unaligned_access(a′, bl′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Expanding the definition of unaligned_access, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.2.

random_side_effects_transformers_ok.2.1.1.1.3:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-4} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-5} true ⊃ true
{-6} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} ∀ (s: (pm`states)):

OK?(unaligned_access(a′, bl′, cp′)(s)) ⊃ data(unaligned_access(a′, bl′, cp′)(s)) = bl′

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Expanding the definition of unaligned_access,

Repeatedly Skolemizing and flattening,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.3.

random_side_effects_transformers_ok.2.1.1.1.4:

{-1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-4} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-5} true ⊃ true
{-6} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d, cp′) ##

(λ (bl: list[Byte]): write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]):

re-

set_count(a′, bl, cp′)))))) {2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Repeatedly Skolemizing and flattening,

Hiding formulas: (-1 2),

Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA (bl: list[Byte]): bl = bl!1,

we get 4 subgoals:

random_side_effects_transformers_ok.2.1.1.1.4.1:

{-1} d′ = bl′

{-2} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-5} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-6} true ⊃ true
{-7} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{1} transformers_ok?(pm`states, singleton(expr_2_super(access_count(a′, d′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d′, cp′) ##

(λ (bl: list[Byte]): write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]):

re-

set_count(a′, bl, cp′))))))

Expanding the definition of access_count,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.4.1.
random_side_effects_transformers_ok.2.1.1.1.4.2:

{-1} d′ = bl′

{-2} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-5} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-6} true ⊃ true
{-7} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{1} transformer_invariant?(pm`states, singleton(expr_2_super(access_count(a′, d′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d′, cp′) ##

(λ (bl: list[Byte]): write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]):

re-

set_count(a′, bl, cp′))))))

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.4.2.

random_side_effects_transformers_ok.2.1.1.1.4.3:

{-1} d′ = bl′

{-2} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-5} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-6} true ⊃ true
{-7} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} ∀ (s: (pm`states)):

OK?(access_count(a′, d′, cp′)(s)) ⊃ data(access_count(a′, d′, cp′)(s)) = bl′

{2} transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d′, cp′) ##

(λ (bl: list[Byte]): write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]):

re-

set_count(a′, bl, cp′))))))

Repeatedly Skolemizing and flattening, Expanding the definition of access_count, which is trivially true.

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.4.3.
random_side_effects_transformers_ok.2.1.1.1.4.4:

{-1} d′ = bl′

{-2} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-3} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-5} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-6} true ⊃ true
{-7} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm`states,

singleton(expr_2_super(write_rnd_dev(a′, d, cp′) ##

(λ (bl: list[Byte]):

reset_count(a′, bl, cp′)))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(access_count(a′, d′, cp′) ##

(λ (bl: list[Byte]): write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]):

re-

set_count(a′, bl, cp′))))))

Repeatedly Skolemizing and flattening, Hiding formulas: (-1 2), Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA (bl:

list[Byte]): bl = bl!1, we get 4 subgoals:

random_side_effects_transformers_ok.2.1.1.1.4.4.1:

{-1} d′′ = bl′
{-2} d′ = bl′

{-3} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-6} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-7} true ⊃ true
{-8} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{1} transformers_ok?(pm`states, singleton(expr_2_super(write_rnd_dev(a′, d′′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(write_rnd_dev(a′, d′′, cp′) ##

(λ (bl: list[Byte]): reset_count(a′, bl, cp′)))))

Hiding formulas: 2, Expanding the definition of write_rnd_dev, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.4.4.1.
random_side_effects_transformers_ok.2.1.1.1.4.4.2:

{-1} d′′ = bl′
{-2} d′ = bl′

{-3} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-6} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-7} true ⊃ true
{-8} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{1} transformer_invariant?(pm`states, singleton(expr_2_super(write_rnd_dev(a′, d′′, cp′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super(write_rnd_dev(a′, d′′, cp′) ##

(λ (bl: list[Byte]): reset_count(a′, bl, cp′)))))

Hiding formulas: 2, Expanding the definition of write_rnd_dev, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.4.4.2.

random_side_effects_transformers_ok.2.1.1.1.4.4.3:

{-1} d′′ = bl′
{-2} d′ = bl′

{-3} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-6} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-7} true ⊃ true
{-8} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} ∀ (s: (pm`states)):

OK?(write_rnd_dev(a′, d′′, cp′)(s)) ⊃

data(write_rnd_dev(a′, d′′, cp′)(s)) = bl′

{2} transformers_ok?(pm`states,

singleton(expr_2_super(write_rnd_dev(a′, d′′, cp′) ##

(λ (bl: list[Byte]): reset_count(a′, bl, cp′)))))

Repeatedly Skolemizing and flattening, Expanding the definition of write_rnd_dev, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.4.4.3.
random_side_effects_transformers_ok.2.1.1.1.4.4.4:

{-1} d′′ = bl′
{-2} d′ = bl′

{-3} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-4} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-5} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))
{-6} cons?(bl′) ⊃ a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val
{-7} true ⊃ true
{-8} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} ∀ (d: (λ (bl: list[Byte]): bl = bl′)):

transformers_ok?(pm`states, singleton(expr_2_super(reset_count(a′, d, cp′)))) {2} transformers_ok?(pm`states,

singleton(expr_2_super(write_rnd_dev(a′, d′′, cp′) ##

(λ (bl: list[Byte]): reset_count(a′, bl, cp′)))))

Repeatedly Skolemizing and flattening, Expanding the definition of reset_count, Hiding formulas: (-1 2 -9), Replacing using formula -1, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.1.4.4.4.

random_side_effects_transformers_ok.2.1.1.2:

{-1} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{-2} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl′) ⊃

a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val {-4} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

disjoint?(address_block(a′, length(bl′)), address_block(base, size))

{-5} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} transformer_invariant?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.1.2.
random_side_effects_transformers_ok.2.1.2:

{-1} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{-2} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl′) ⊃

a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val {-3} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

disjoint?(address_block(a′, length(bl′)), address_block(base, size))

{-4} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{1} transformers_ok?(pm`states,

singleton(expr_2_super(ok_result[Random_device_memory, list[Byte]] (bl′))))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_transformers_ok.2.1.2.

random_side_effects_transformers_ok.2.2:

{-1} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl′) ⊃

a′ ≠ rnd_seed ∧ a′ ≠ mem_cnt ∧ a′ ≠ rnd_val {-2} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃

disjoint?(address_block(a′, length(bl′)), address_block(base, size))

{-3} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{1} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{2} transformers_ok?(pm`states,

singleton(expr_2_super((unaligned_access(a′, bl′, cp′) ##

(λ (bl: list[Byte]): access_count(a′, bl, cp′) ## (λ (bl: list[Byte]):

write_rnd_dev(a′, bl, cp′) ## (λ (bl: list[Byte]): reset_count (a′, bl, cp′))))))))

Keeping (-3 1) and hiding *,

Rewriting using subset_bigger_union_right, matching in *,

This completes the proof of random_side_effects_transformers_ok.2.2.

Q.E.D.

C.23.6 Challenge_Random_Device.random_side_effects_side_effect_content_unchanged_read

Terse proof for random_side_effects_side_effect_content_unchanged_read.
random_side_effects_side_effect_content_unchanged_read:

{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, rnd_dev_read_side_effect)

Case splitting on size(uidt(dt_uint)) > 0,

we get 2 subgoals:

random_side_effects_side_effect_content_unchanged_read.1:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, rnd_dev_read_side_effect)

Installing automatic rewrites from: ok_expr_2_super has_next_state_expr_2_super fatal_result state_expr_2_super ok_result_state ok_result_ok expr_2_super_ok_result expr_2_super_fatal_result has_next_state_ok_result has_next_state_fatal_result ok_result_data ertimes_ax

Expanding the definition of rnd_dev_read_side_effect,

Rewriting using side_effect_content_unchanged_composition, matching in *,

we get 3 subgoals:

random_side_effects_side_effect_content_unchanged_read.1.1:

{-1} size(uidt(dt_uint)) > 0

{1} transformer_invariant?(pm`states,

se_super_transformers((pm‘ro_addr∪ pm‘rw_addr), un-

aligned_access)) {2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): (unaligned_access(a, bl, cp) ##

(λ (bl: list[Byte]): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]):

read_seed(a, bl, cp)))))))

Rewriting using transformer_invariant_all_transformers, matching in *, Expanding the definition of se_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 1) and hiding *, Expanding the definition of unaligned_access, Rewriting using in_blessed_memory_disjoint_device, matching in *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.1.
random_side_effects_side_effect_content_unchanged_read.1.2:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, unaligned_access)

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): (unaligned_access(a, bl, cp) ##

(λ (bl: list[Byte]): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]):

read_seed(a, bl, cp)))))))

Hiding formulas: 2, Expanding the definition of side_effect_content_unchanged, Repeatedly Skolemizing and flattening, Expanding the definition of unaligned_access, Rewriting using in_blessed_memory_disjoint_device, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.2.

random_side_effects_side_effect_content_unchanged_read.1.3:

{-1} size(uidt(dt_uint)) > 0

{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]):

read_seed(a, bl, cp)))))

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): (unaligned_access(a, bl, cp) ##

(λ (bl: list[Byte]): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]):

read_seed(a, bl, cp)))))))

Hiding formulas: 2,

Rewriting using side_effect_content_unchanged_composition, matching in *,

we get 3 subgoals:

random_side_effects_side_effect_content_unchanged_read.1.3.1:

{-1} size(uidt(dt_uint)) > 0

{1} transformer_invariant?(pm`states,

se_super_transformers((pm‘ro_addr∪ pm‘rw_addr), ac-

cess_count)) {2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]):

read_seed(a, bl, cp)))))

Rewriting using transformer_invariant_all_transformers, matching in *,

Expanding the definition of se_super_transformers,

Repeatedly Skolemizing and flattening,

Replacing using formula -3,

Keeping (-2 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.3.1.

random_side_effects_side_effect_content_unchanged_read.1.3.2:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, access_count)

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]):

read_seed(a, bl, cp)))))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.3.2.
random_side_effects_side_effect_content_unchanged_read.1.3.3:

{-1} size(uidt(dt_uint)) > 0

{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]): read_seed(a, bl, cp))))

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]):

read_seed(a, bl, cp)))))

Hiding formulas: 2, Rewriting using side_effect_content_unchanged_composition, matching in *, we get 3 subgoals:

random_side_effects_side_effect_content_unchanged_read.1.3.3.1:

{-1} size(uidt(dt_uint)) > 0

{1} transformer_invariant?(pm`states,

se_super_transformers((pm‘ro_addr∪ pm‘rw_addr), read_rnd_val))

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]): read_seed(a, bl, cp))))

Rewriting using transformer_invariant_all_transformers, matching in *, Expanding the definition of se_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.3.3.1.
random_side_effects_side_effect_content_unchanged_read.1.3.3.2:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, read_rnd_val)

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]): read_seed(a, bl, cp))))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.3.3.2.
random_side_effects_side_effect_content_unchanged_read.1.3.3.3:

{-1} size(uidt(dt_uint)) > 0

{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]): read_seed(a, bl, cp)))

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): read_rnd_val(a, bl, cp) ## (λ (bl: list[Byte]):

read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]): read_seed(a, bl, cp))))

Hiding formulas: 2, Rewriting using side_effect_content_unchanged_composition, matching in *, we get 3 subgoals:

random_side_effects_side_effect_content_unchanged_read.1.3.3.3.1:

{-1} size(uidt(dt_uint)) > 0

{1} transformer_invariant?(pm`states,

se_super_transformers((pm‘ro_addr∪ pm‘rw_addr), read_mem_cnt))

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]): read_seed(a, bl, cp)))

Rewriting using transformer_invariant_all_transformers, matching in *, Expanding the definition of se_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.3.3.3.1.

random_side_effects_side_effect_content_unchanged_read.1.3.3.3.2:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, read_mem_cnt)

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]): read_seed(a, bl, cp)))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.3.3.3.2.
random_side_effects_side_effect_content_unchanged_read.1.3.3.3.3:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, read_seed)

{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

λ (a: Address, bl: list[Byte], cp: bool): read_mem_cnt(a, bl, cp) ## (λ (bl: list[Byte]): read_seed(a, bl, cp)))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.1.3.3.3.3.
random_side_effects_side_effect_content_unchanged_read.2:

{1} size(uidt(dt_uint)) > 0
{2} side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states, rnd_dev_read_side_effect)

Using lemma dt_uint_size, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_read.2.

Q.E.D.

C.23.7 Challenge_Random_Device.random_side_effects_side_effect_content_unchanged_write

Terse proof for random_side_effects_side_effect_content_unchanged_write.
random_side_effects_side_effect_content_unchanged_write:

{1} side_effect_content_unchanged(pm`rw_addr, pm`states, rnd_dev_write_side_effect)

Case splitting on size(uidt(dt_uint)) > 0, we get 2 subgoals:

random_side_effects_side_effect_content_unchanged_write.1:

{-1} size(uidt(dt_uint)) > 0 ; {1} side_effect_content_unchanged(pm`rw_addr, pm`states, rnd_dev_write_side_effect)

Installing automatic rewrites from: ok_expr_2_super has_next_state_expr_2_super fatal_result state_expr_2_super ok_result_state ok_result_ok expr_2_super_ok_result expr_2_super_fatal_result has_next_state_ok_result has_next_state_fatal_result ok_result_data ertimes_ax

Expanding the definition of rnd_dev_write_side_effect, Rewriting using side_effect_content_unchanged_composition, matching in *, we get 3 subgoals:

random_side_effects_side_effect_content_unchanged_write.1.1:

{-1} size(uidt(dt_uint)) > 0

{1} transformer_invariant?(pm`states, se_super_transformers(pm`rw_addr, un-

aligned_access)) {2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): (unaligned_access(a, bl, cp) ##

(λ (bl: list[Byte]): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]):

reset_count(a, bl, cp))))))

Rewriting using transformer_invariant_all_transformers, matching in *,

Expanding the definition of se_super_transformers,

Repeatedly Skolemizing and flattening,

Replacing using formula -3,

Keeping (-2 1) and hiding *,

Expanding the definition of unaligned_access,

Rewriting using in_blessed_memory_disjoint_device, matching in *,

we get 2 subgoals:

random_side_effects_side_effect_content_unchanged_write.1.1.1:

{-1} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{1} transformer_invariant?(pm`states, singleton(expr_2_super(ok_result(bl′))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.1.1.
random_side_effects_side_effect_content_unchanged_write.1.1.2:

{-1} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{1} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{2} transformer_invariant?(pm`states,

if null?(bl′) ∨

disjoint?(address_block(a′, length(bl′)),

address_block(base, size))

∨

(¬ cp′ ∧ length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then singleton(expr_2_super(ok_result(bl′))) else singleton(expr_2_super(fatal_result)) endif)

Rewriting using subset_bigger_union_right, matching in *,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.1.2.

random_side_effects_side_effect_content_unchanged_write.1.2:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged(pm`rw_addr, pm`states, unaligned_access)

{2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): (unaligned_access(a, bl, cp) ##

(λ (bl: list[Byte]): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]):

reset_count(a, bl, cp))))))

Hiding formulas: 2,

Expanding the definition of side_effect_content_unchanged,

Repeatedly Skolemizing and flattening,

Expanding the definition of unaligned_access,

Rewriting using in_blessed_memory_disjoint_device, matching in *,

we get 2 subgoals:

random_side_effects_side_effect_content_unchanged_write.1.2.1:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-2} pm`states(s′)
{-3} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)
{-4} OK?(ok_result(bl′)(s′))
{-5} size(uidt(dt_uint)) > 0
{1} data(ok_result(bl′)(s′)) = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.2.1.

random_side_effects_side_effect_content_unchanged_write.1.2.2:

{-1} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-2} pm`states(s′)
{-3} (address_block(a′, length(bl′)) ⊆ pm‘rw_addr)

{-4} OK?(if null?(bl′) ∨ disjoint?(address_block(a′, length(bl′)), address_block(base, size)) ∨ (¬ cp′ ∧

length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then ok_result(bl′)(s′) else Fatal endif)

{-5} size(uidt(dt_uint)) > 0
{1} (address_block(a′, length(bl′)) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

{2} if null?(bl′) ∨ disjoint?(address_block(a′, length(bl′)), address_block(base, size)) ∨ (¬ cp′ ∧

length(bl′) = size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

then bl′ else data(Fatal) endif = bl′

Rewriting using subset_bigger_union_right, matching in *,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.2.2.
random_side_effects_side_effect_content_unchanged_write.1.3:

{-1} size(uidt(dt_uint)) > 0

{1} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]): re-

set_count(a, bl, cp)))) {2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): (unaligned_access(a, bl, cp) ##

(λ (bl: list[Byte]): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]):

reset_count(a, bl, cp))))))

Hiding formulas: 2, Rewriting using side_effect_content_unchanged_composition, matching in *, we get 3 subgoals:

random_side_effects_side_effect_content_unchanged_write.1.3.1:

{-1} size(uidt(dt_uint)) > 0
{1} transformer_invariant?(pm`states, se_super_transformers(pm`rw_addr, access_count))

{2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]): re-

set_count(a, bl, cp))))

Rewriting using transformer_invariant_all_transformers, matching in *, Expanding the definition of se_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.3.1.
random_side_effects_side_effect_content_unchanged_write.1.3.2:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged(pm`rw_addr, pm`states, access_count)

{2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]): re-

set_count(a, bl, cp))))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.3.2.
random_side_effects_side_effect_content_unchanged_write.1.3.3:

{-1} size(uidt(dt_uint)) > 0

{1} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]): reset_count(a, bl, cp)))

{2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): access_count(a, bl, cp) ## (λ (bl: list[Byte]):

write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]): re-

set_count(a, bl, cp))))

Hiding formulas: 2, Rewriting using side_effect_content_unchanged_composition, matching in *, we get 3 subgoals:

random_side_effects_side_effect_content_unchanged_write.1.3.3.1:

{-1} size(uidt(dt_uint)) > 0
{1} transformer_invariant?(pm`states, se_super_transformers(pm`rw_addr, write_rnd_dev))

{2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]): reset_count(a, bl, cp)))

Rewriting using transformer_invariant_all_transformers, matching in *, Expanding the definition of se_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.3.3.1.
random_side_effects_side_effect_content_unchanged_write.1.3.3.2:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged(pm`rw_addr, pm`states, write_rnd_dev)

{2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]): reset_count(a, bl, cp)))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.3.3.2.
random_side_effects_side_effect_content_unchanged_write.1.3.3.3:

{-1} size(uidt(dt_uint)) > 0
{1} side_effect_content_unchanged(pm`rw_addr, pm`states, reset_count)

{2} side_effect_content_unchanged(pm`rw_addr, pm`states,

λ (a: Address, bl: list[Byte], cp: bool): write_rnd_dev(a, bl, cp) ## (λ (bl: list[Byte]): reset_count(a, bl, cp)))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.1.3.3.3.
random_side_effects_side_effect_content_unchanged_write.2:

{1} size(uidt(dt_uint)) > 0
{2} side_effect_content_unchanged(pm`rw_addr, pm`states, rnd_dev_write_side_effect)

Using lemma dt_uint_size, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of random_side_effects_side_effect_content_unchanged_write.2.

Q.E.D.

C.23.8 Challenge_Random_Device.random_device_plain_memory

Terse proof for random_device_plain_memory.

random_device_plain_memory:

{1} plain_memory?(pm_phy) ⊃ plain_memory?(pm)

Using lemma device_memory_plain_memory, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of is_device_plain_memory?, Keeping (1) and hiding *, Rewriting using random_side_effects_transformers_ok, matching in *, Rewriting using random_side_effects_unchanged_invariant, matching in *, Rewriting using random_side_effects_side_effect_content_unchanged_read, matching in *, Rewriting using random_side_effects_side_effect_content_unchanged_write, matching in *, Expanding the definition of pm, Expanding the definition of random_device_pm, Installing automatic rewrites from: subset_reflexive difference_subset Expanding the definition of random_device_pm_mem, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of random_device_plain_memory.

Q.E.D.

C.23.9 Challenge_Random_Device.unaligned_fails_write

Terse proof for unaligned_fails_write.
unaligned_fails_write:

{1} ∀ (s: Random_device_memory, a: Address, bl: (cons?[Byte])): ¬ disjoint?(address_block(a, length(bl)), address_block(base, size)) ∧ ¬ (length(bl) = size(uidt(dt_uint)) ∧

(a = rnd_seed ∨ a = mem_cnt ∨ a = rnd_val)) ∧ OK?(memory_write_side_effect(pm_phy`mem)(a, bl, false)(s`state)) ∧ data(memory_write_side_effect(pm_phy`mem)(a, bl, false)(s`state)) = bl

⊃ Fatal?(memory_write_list(pm`mem)(a, bl)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_list, Expanding the definition of pm, Expanding the definition of random_device_pm, Expanding the definition of random_device_pm_mem, Expanding the definition of device_pm, Expanding the definition of ##, Expanding the definition of em_lift, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of rnd_dev_write_side_effect, Expanding the definition of unaligned_access, Expanding the definition of fatal_result, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of unaligned_fails_write. Q.E.D.

C.23.10 Challenge_Random_Device.unaligned_fails_read

Terse proof for unaligned_fails_read.
unaligned_fails_read:

{1} ∀ (s: Random_device_memory, a: Address, bl: (cons?[Byte])): ¬ disjoint?(address_block(a, length(bl)), address_block(base, size)) ∧ ¬ (length(bl) = size(uidt(dt_uint)) ∧

(a = rnd_seed ∨ a = mem_cnt ∨ a = rnd_val)) ∧ OK?(memory_read_list_nse(pm`mem)(a, length(bl))(s)) ∧ (let ures =

(memory_read_list_nse(pm`mem)(a, length(bl)) ##

(λ (bl1: list[Byte]): em_lift

[Physical_memory, Random_device_state[Physical_memory, pm_phy],

list[Byte]] (memory_read_side_effect(pm_phy`mem)(a, bl1, false))))

(s)

in OK?(ures) ∧ length(data(ures)) = length(bl)) ⊃ Fatal?(memory_read_list(pm`mem)(a, length(bl))(s))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of memory_read_list, Expanding the definition of pm, Expanding the definition of random_device_pm, Expanding the definition of random_device_pm_mem, Expanding the definition of device_pm, Expanding the definition of rnd_dev_read_side_effect, Expanding the definition of unaligned_access, Expanding the definition of ##, Applying disjunctive simplification to flatten sequent, Simplifying, rewriting, and recording with decision procedures, Case splitting on cons?(data(em_lift [Physical_memory, Random_device_state[Physical_memory,

pm_phy], list[Byte]] (memory_read_side_effect(pm_phy‘mem) (a!1, data(memory_read_list_nse(pm‘mem) (a!1, length(bl!1)) (s!1)), FALSE)) (state(memory_read_list_nse(pm‘mem) (a!1, length(bl!1)) (s!1))))),

we get 2 subgoals:

unaligned_fails_read.1:

{-1} cons?(data(em_lift [Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]] (memory_read_side_effect(pm_phy`mem)

(a′, data(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)),

false))

(state(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)))))

{-2} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-3} cons?[Byte](bl′)
{-4} OK?(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′))

{-5} OK?(em_lift[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, data(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)),

false))

(state(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′))))

{-6} length(data(em_lift [Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]] (memory_read_side_effect(pm_phy`mem)

(a′, data(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)), false))

(state(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)))))

= length(bl′)

{1} disjoint?(address_block(a′, length(bl′)), address_block(base, size))

{2} (length(bl′) = size(uidt(dt_uint)) ∧

(a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

{3} Fatal?(cases if null?(data(em_lift

[Physical_memory,

Random_device_state[Physical_memory, pm_phy], list[Byte]] (memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)))))

∨ length(data(em_lift

[Physical_memory,

Random_device_state[Physical_memory, pm_phy], list[Byte]] (memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem)

(a′, length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem)

(a′, length(bl′)) (s′)))))

= size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val)

then ok_result(data(em_lift

[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)))))

(state(em_lift

[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)))))

else fatal_result(state(em_lift

[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem)

(a′,

length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem)

(a′, length(bl′)) (s′)))))

endif of OK(state_4, data_4):

cases access_count(a′, data_4, false)(state_4) of

OK(state_3, data_3):

cases read_rnd_val(a′, data_3, false)(state_3) of

OK(state_2, data_2):

cases read_mem_cnt(a′, data_2, false)(state_2) of OK(state_1, data_1): read_seed(a′, data_1, false)(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases,

Exception(ex_type_1, state_2): Exception(ex_type_1, state_2), Fatal: Fatal, Hang: Hang endcases,

Exception(ex_type_1, state_2): Exception(ex_type_1, state_2), Fatal: Fatal, Hang: Hang endcases,

Exception(ex_type_1, state_2): Exception(ex_type_1, state_2), Fatal: Fatal, Hang: Hang endcases)

832

C.23 Proofs for Challenge_Random_Device (random_device.pvs)

Expanding the definition of fatal_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of unaligned_fails_read.1.

unaligned_fails_read.2:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-2} cons?[Byte](bl′)
{-3} OK?(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′))

{-4} OK?(em_lift[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′, data(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)),

false))

(state(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′))))

{-5} length(data(em_lift [Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]] (memory_read_side_effect(pm_phy`mem)

(a′, data(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)), false))

(state(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)))))

= length(bl′) {1} cons?(data(em_lift

[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]] (memory_read_side_effect(pm_phy`mem)

(a′, data(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)),

false))

(state(memory_read_list_nse(pm`mem)(a′, length(bl′))(s′)))))

{2} disjoint?(address_block(a′, length(bl′)), address_block(base, size))

{3} (length(bl′) = size(uidt(dt_uint)) ∧

(a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val))

{4} Fatal?(cases if null?(data(em_lift

[Physical_memory,

Random_device_state[Physical_memory, pm_phy], list[Byte]] (memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)))))

∨ length(data(em_lift

[Physical_memory,

Random_device_state[Physical_memory, pm_phy], list[Byte]] (memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem)

(a′, length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem)

(a′, length(bl′)) (s′)))))

= size(uidt(dt_uint)) ∧ (a′ = rnd_seed ∨ a′ = mem_cnt ∨ a′ = rnd_val)

then ok_result(data(em_lift

[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)))))

(state(em_lift

[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem) (a′, length(bl′)) (s′)))))

else fatal_result(state(em_lift

[Physical_memory, Random_device_state[Physical_memory, pm_phy], list[Byte]]

(memory_read_side_effect(pm_phy`mem)

(a′,

data(memory_read_list_nse(pm`mem)

(a′,

length(bl′)) (s′)),

false))

(state(memory_read_list_nse(pm`mem)

(a′, length(bl′)) (s′)))))

endif of OK(state_4, data_4):

cases access_count(a′, data_4, false)(state_4) of

OK(state_3, data_3):

cases read_rnd_val(a′, data_3, false)(state_3) of

OK(state_2, data_2):

cases read_mem_cnt(a′, data_2, false)(state_2) of OK(state_1, data_1): read_seed(a′, data_1, false)(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases,

Exception(ex_type_1, state_2): Exception(ex_type_1, state_2), Fatal: Fatal, Hang: Hang endcases,

Exception(ex_type_1, state_2): Exception(ex_type_1, state_2), Fatal: Fatal, Hang: Hang endcases,

Exception(ex_type_1, state_2): Exception(ex_type_1, state_2), Fatal: Fatal, Hang: Hang endcases)

834

C.24 Proofs for CommaExpressions (expressions.pvs)

Keeping (-2 -5 1) and hiding *, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of unaligned_fails_read.2. Q.E.D.

C.24 Proofs for CommaExpressions (expressions.pvs)

This theory contains no provable formal statements.

C.25 Proofs for Composition_Lifted_Statement_Lifted_Expression (state-transformer.pvs)

This theory contains no provable formal statements.

C.26 Proofs for Composition_Lifted_Statement_Lifted_Statement (state-transformer.pvs)

This theory contains no provable formal statements.

C.27 Proofs for Composition_Lifted_Statement_Simple_Expression (state-transformer.pvs)

This theory contains no provable formal statements.

C.28 Proofs for Composition_Lifted_Statement_Simple_Statement (state-transformer.pvs)

This theory contains no provable formal statements.

C.29 Proofs for Composition_Simple_Expression_Data_Expression (state-transformer.pvs)

C.29.1 Composition_Simple_Expression_Data_Expression.super_comp_expr_expr_TCC1

Terse proof for super_comp_expr_expr_TCC1.
super_comp_expr_expr_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data1]], s, state: State): expr_2_super(expr)(s) = OK(state) ⊃ OK?[State](expr_2_super[State, Data1](expr)(s)) ∨ abnormal?[State](expr_2_super[State, Data1](expr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of super_comp_expr_expr_TCC1.

Q.E.D.

C.29.2 Composition_Simple_Expression_Data_Expression.super_comp_expr_expr_TCC2

Terse proof for super_comp_expr_expr_TCC2.
super_comp_expr_expr_TCC2:

{1} ∀ (expr: [State → ExprResult[State, Data1]], s, state: State): expr_2_super(expr)(s) = OK(state) ⊃ OK?[State, Data1](expr(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of super_comp_expr_expr_TCC2.

Q.E.D.

C.29.3 Composition_Simple_Expression_Data_Expression.super_comp_expr_expr

Terse proof for super_comp_expr_expr.
super_comp_expr_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]],

fexpr: [Data1 → [State → ExprResult[State, Data2]]], s: State): expr_2_super(expr ## fexpr)(s) = cases expr_2_super(expr)(s) of

OK(state):

expr_2_super(fexpr(data(expr(s))))(state(expr_2_super(expr)(s))) else expr_2_super(expr)(s) endcases

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of super_comp_expr_expr.

C.30 Proofs for Composition_Simple_Expression_Data_Statement (state-transformer.pvs)

Q.E.D.

C.30 Proofs for Composition_Simple_Expression_Data_Statement (state-transformer.pvs)

This theory contains no provable formal statements.

C.31 Proofs for Composition_Simple_Expression_Simple_Expression (state-transformer.pvs)

C.31.1 Composition_Simple_Expression_Simple_Expression.comp_expr_forget_expr

Terse proof for comp_expr_forget_expr.
comp_expr_forget_expr:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): (expr1 ## expr2)(s) = cases expr1(s) of

OK(state, data): expr2(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of comp_expr_forget_expr. Q.E.D.

C.31.2 Composition_Simple_Expression_Simple_Expression.super_comp_expr_forget_expr

Terse proof for super_comp_expr_forget_expr.
super_comp_expr_forget_expr:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): expr_2_super(expr1 ## expr2)(s) = cases expr_2_super(expr1)(s) of OK(state): expr_2_super(expr2)(state)

else expr_2_super(expr1)(s) endcases

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of super_comp_expr_forget_expr.

Q.E.D.

C.31.3 Composition_Simple_Expression_Simple_Expression.comp_simple_expr_simple_expr_TCC1

Terse proof for comp_simple_expr_simple_expr_TCC1.
comp_simple_expr_simple_expr_TCC1:

{1} ∀ (expr1: [State → ExprResult[State, Data1]], s: State): OK?(expr1(s)) ⊃ OK?[State, Data1](expr1(s)) ∨ Exception?[State, Data1](expr1(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_expr_simple_expr_TCC1.

Q.E.D.

C.31.4 Composition_Simple_Expression_Simple_Expression.comp_simple_expr_simple_expr

Terse proof for comp_simple_expr_simple_expr.
comp_simple_expr_simple_expr:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): OK?(expr1(s)) ⊃ expr2(state(expr1(s))) = (expr1 ## expr2)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_expr_simple_expr.

Q.E.D.

C.31.5 Composition_Simple_Expression_Simple_Expression.comp_simple_expr_simple_expr_ok_TCC1

Terse proof for comp_simple_expr_simple_expr_ok_TCC1.
comp_simple_expr_simple_expr_ok_TCC1:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): OK?((expr1 ## expr2)(s)) ⊃ OK?[State, Data1](expr1(s)) ∨ Exception?[State, Data1](expr1(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_expr_simple_expr_ok_TCC1.

Q.E.D.

C.31 Proofs for Composition_Simple_Expression_Simple_Expression (state-transformer.pvs)

C.31.6 Composition_Simple_Expression_Simple_Expression.comp_simple_expr_simple_expr_ok

Terse proof for comp_simple_expr_simple_expr_ok.
comp_simple_expr_simple_expr_ok:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): OK?((expr1 ## expr2)(s)) ⊃ OK?(expr2(state(expr1(s))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_expr_simple_expr_ok.

Q.E.D.

C.31.7 Composition_Simple_Expression_Simple_Expression.comp_simple_expr_simple_expr_data_TCC1

Terse proof for comp_simple_expr_simple_expr_data_TCC1.
comp_simple_expr_simple_expr_data_TCC1:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): OK?((expr1 ## expr2)(s)) ⊃ OK?[State, Data2](expr2(state[State, Data1](expr1(s))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_expr_simple_expr_data_TCC1.

Q.E.D.

C.31.8 Composition_Simple_Expression_Simple_Expression.comp_simple_expr_simple_expr_data

Terse proof for comp_simple_expr_simple_expr_data.
comp_simple_expr_simple_expr_data:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): OK?((expr1 ## expr2)(s)) ⊃ data(expr2(state(expr1(s)))) = data((expr1 ## expr2)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_expr_simple_expr_data.

Q.E.D.

C.31.9 Composition_Simple_Expression_Simple_Expression.comp_simple_expr_simple_expr_state_TCC1

Terse proof for comp_simple_expr_simple_expr_state_TCC1.

comp_simple_expr_simple_expr_state_TCC1:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): OK?((expr1 ## expr2)(s)) ⊃ OK?[State, Data2]((expr1 ## expr2)(s)) ∨ Exception?[State, Data2]((expr1 ## expr2)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_expr_simple_expr_state_TCC1.

Q.E.D.

C.31.10 Composition_Simple_Expression_Simple_Expression.comp_simple_expr_simple_expr_state

Terse proof for comp_simple_expr_simple_expr_state.
comp_simple_expr_simple_expr_state:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], s: State): OK?((expr1 ## expr2)(s)) ⊃ state(expr2(state(expr1(s)))) = state((expr1 ## expr2)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_expr_simple_expr_state.

Q.E.D.

C.32 Proofs for Composition_Simple_Statement_Lifted_Expression (state-transformer.pvs)

This theory contains no provable formal statements.

C.33 Proofs for Composition_Simple_Statement_Lifted_Statement (state-transformer.pvs)

This theory contains no provable formal statements.

C.34 Proofs for Composition_Simple_Statement_Simple_Expression (state-transformer.pvs)

C.34 Proofs for Composition_Simple_Statement_Simple_Expression (state-transformer.pvs)

C.34.1 Composition_Simple_Statement_Simple_Expression.comp_simple_stmt_simple_expr_TCC1

Terse proof for comp_simple_stmt_simple_expr_TCC1.
comp_simple_stmt_simple_expr_TCC1:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ OK?[State](stmt(s)) ∨ Break?[State](stmt(s)) ∨ Continue?[State](stmt(s)) ∨ Return?[State](stmt(s)) ∨ Switch?[State](stmt(s)) ∨ Default?[State](stmt(s)) ∨ Exception?[State](stmt(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_stmt_simple_expr_TCC1.

Q.E.D.

C.34.2 Composition_Simple_Statement_Simple_Expression.comp_simple_stmt_simple_expr

Terse proof for comp_simple_stmt_simple_expr.
comp_simple_stmt_simple_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ expr(state(stmt(s))) = (stmt ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_stmt_simple_expr.

Q.E.D.

C.34.3 Composition_Simple_Statement_Simple_Expression.comp_simple_stmt_simple_expr_ok_TCC1

Terse proof for comp_simple_stmt_simple_expr_ok_TCC1.

comp_simple_stmt_simple_expr_ok_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ OK?[State](stmt(s)) ∨ Break?[State](stmt(s)) ∨ Continue?[State](stmt(s)) ∨ Return?[State](stmt(s)) ∨ Switch?[State](stmt(s)) ∨ Default?[State](stmt(s)) ∨ Exception?[State](stmt(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_stmt_simple_expr_ok_TCC1.

Q.E.D.

C.34.4 Composition_Simple_Statement_Simple_Expression.comp_simple_stmt_simple_expr_ok

Terse proof for comp_simple_stmt_simple_expr_ok.
comp_simple_stmt_simple_expr_ok:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ OK?(expr(state(stmt(s))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_stmt_simple_expr_ok.

Q.E.D.

C.34.5 Composition_Simple_Statement_Simple_Expression.comp_simple_stmt_simple_expr_data_TCC1

Terse proof for comp_simple_stmt_simple_expr_data_TCC1.
comp_simple_stmt_simple_expr_data_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ OK?[State, Data](expr(state[State](stmt(s))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_stmt_simple_expr_data_TCC1.

Q.E.D.

C.34.6 Composition_Simple_Statement_Simple_Expression.comp_simple_stmt_simple_expr_data

Terse proof for comp_simple_stmt_simple_expr_data.

C.35 Proofs for Composition_Simple_Statement_Simple_Statement (state-transformer.pvs)

comp_simple_stmt_simple_expr_data:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ data(expr(state(stmt(s)))) = data((stmt ## expr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_stmt_simple_expr_data.

Q.E.D.

C.34.7 Composition_Simple_Statement_Simple_Expression.comp_simple_stmt_simple_expr_state_TCC1

Terse proof for comp_simple_stmt_simple_expr_state_TCC1.
comp_simple_stmt_simple_expr_state_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ OK?[State, Data]((stmt ## expr)(s)) ∨ Exception?[State, Data]((stmt ## expr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_stmt_simple_expr_state_TCC1.

Q.E.D.

C.34.8 Composition_Simple_Statement_Simple_Expression.comp_simple_stmt_simple_expr_state

Terse proof for comp_simple_stmt_simple_expr_state.
comp_simple_stmt_simple_expr_state:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ state(expr(state(stmt(s)))) = state((stmt ## expr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_simple_stmt_simple_expr_state.

Q.E.D.

C.35 Proofs for Composition_Simple_Statement_Simple_Statement (state-transformer.pvs)

This theory contains no provable formal statements.

C.36 Proofs for ConditionalExpression (expressions.pvs)

This theory contains no provable formal statements.

C.37 Proofs for Control_Register_Datatype (paging-data.pvs)

C.37.1 Control_Register_Datatype.cr0_data_type_TCC1

Terse proof for cr0_data_type_TCC1.
cr0_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[CR0_type])): true

Rewriting using cr0_data_type_exists, matching in *, This completes the proof of cr0_data_type_TCC1. Q.E.D.

C.37.2 Control_Register_Datatype.cr2_data_type_TCC1

Terse proof for cr2_data_type_TCC1.
cr2_data_type_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[CR2_type])): true

Rewriting using cr2_data_type_exists, matching in *, This completes the proof of cr2_data_type_TCC1. Q.E.D.

C.37.3 Control_Register_Datatype.cr4_data_type_TCC1

Terse proof for cr4_data_type_TCC1.
cr4_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[CR4_type])): true

Rewriting using cr4_data_type_exists, matching in *, This completes the proof of cr4_data_type_TCC1. Q.E.D.

C.38 Proofs for Control_Register_Types (paging-data.pvs)

This theory contains no provable formal statements.

C.39 Proofs for Conversions (conversions.pvs)

C.39 Proofs for Conversions (conversions.pvs)

This theory contains no provable formal statements.

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

C.40.1 Cpp_Deep_Type_Wellformedness.no_pointers_to_bitfield?_TCC1

Terse proof for no_pointers_to_bitfield?_TCC1.
no_pointers_to_bitfield?_TCC1:

{1} ∀ (t: Cpp_Type_):

pointer?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_pointers_to_bitfield?_TCC1.

Q.E.D.

C.40.2 Cpp_Deep_Type_Wellformedness.no_cv_references?_TCC1

Terse proof for no_cv_references?_TCC1.
no_cv_references?_TCC1:

{1} ∀ (t: Cpp_Type_):

(const?(t) ∨ volatile?(t)) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of no_cv_references?_TCC1. Q.E.D.

C.40.3 Cpp_Deep_Type_Wellformedness.no_reference_to_reference?_TCC1

Terse proof for no_reference_to_reference?_TCC1.

no_reference_to_reference?_TCC1:

{1} ∀ (t: Cpp_Type_):

reference?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_reference_to_reference?_TCC1.

Q.E.D.

C.40.4 Cpp_Deep_Type_Wellformedness.no_array_of_references?_TCC1

Terse proof for no_array_of_references?_TCC1.
no_array_of_references?_TCC1:

{1} ∀ (t: Cpp_Type_):

array?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_array_of_references?_TCC1.

Q.E.D.

C.40.5 Cpp_Deep_Type_Wellformedness.no_pointer_or_ref_to_incomplete_array_parameter?_TCC1

Terse proof for no_pointer_or_ref_to_incomplete_array_parameter?_TCC1.
no_pointer_or_ref_to_incomplete_array_parameter?_TCC1:

{1} ∀ (t: Cpp_Type_):

function?(t) ⊃ (∀ (p: Cpp_Type_):

(pointer?(p) ∨ reference?(p)) ⊃ array?(p) ∨ pointer?(p) ∨ reference?(p) ∨ bitfield?(p) ∨ enum?(p) ∨ pointer_to_member?(p) ∨ const?(p) ∨ volatile?(p))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_pointer_or_ref_to_incomplete_array_parameter?_TCC1.

Q.E.D.

C.40 Proofs for Cpp_Deep_Type_Wellformedness (types.pvs)

C.40.6 Cpp_Deep_Type_Wellformedness.no_pointer_or_ref_to_incomplete_array_parameter?_TCC2

Terse proof for no_pointer_or_ref_to_incomplete_array_parameter?_TCC2.
no_pointer_or_ref_to_incomplete_array_parameter?_TCC2:

{1} ∀ (t: Cpp_Type_):

function?(t) ⊃ (∀ (p: Cpp_Type_):

(const?(p) ∨ volatile?(p)) ∧ ¬ ((pointer?(p) ∨ reference?(p)) ∧

(array?(typ(p)) ∧ size(typ(p)) > 0)) ⊃ array?(p) ∨ pointer?(p) ∨ reference?(p) ∨ bitfield?(p) ∨ enum?(p) ∨ pointer_to_member?(p) ∨ const?(p) ∨ volatile?(p))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_pointer_or_ref_to_incomplete_array_parameter?_TCC2.

Q.E.D.

C.40.7 Cpp_Deep_Type_Wellformedness.no_pointer_or_ref_to_incomplete_array_parameter?_TCC3

Terse proof for no_pointer_or_ref_to_incomplete_array_parameter?_TCC3.
no_pointer_or_ref_to_incomplete_array_parameter?_TCC3:

{1} ∀ (t: Cpp_Type_):

function?(t) ⊃ (∀ (p: Cpp_Type_):

pointer?(typ(p)) ∧

(const?(p) ∨ volatile?(p)) ∧

¬ ((pointer?(p) ∨ reference?(p)) ∧

(array?(typ(p)) ∧ size(typ(p)) > 0)) ⊃ array?(typ(p)) ∨ pointer?(typ(p)) ∨ reference?(typ(p)) ∨ bitfield?(typ(p)) ∨ enum?(typ(p)) ∨ pointer_to_member?(typ(p)) ∨ const?(typ(p)) ∨ volatile?(typ(p)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_pointer_or_ref_to_incomplete_array_parameter?_TCC3.

Q.E.D.

C.40.8 Cpp_Deep_Type_Wellformedness.no_pointer_or_ref_to_incomplete_array_parameter?_TCC4

Terse proof for no_pointer_or_ref_to_incomplete_array_parameter?_TCC4.
no_pointer_or_ref_to_incomplete_array_parameter?_TCC4:

{1} ∀ (t: Cpp_Type_): function?(t) ⊃ (∀ (p: Cpp_Type_):

const?(p) ∧ ¬ ((const?(p) ∨ volatile?(p)) ∧

pointer?(typ(p)) ∧ (array?(typ(typ(p))) ∧ size(typ(typ(p))) > 0))

∧ ¬ ((pointer?(p) ∨ reference?(p)) ∧

(array?(typ(p)) ∧ size(typ(p)) > 0)) ⊃ array?(p) ∨ pointer?(p) ∨ reference?(p) ∨ bitfield?(p) ∨ enum?(p) ∨ pointer_to_member?(p) ∨ const?(p) ∨ volatile?(p))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_pointer_or_ref_to_incomplete_array_parameter?_TCC4.

Q.E.D.

C.40.9 Cpp_Deep_Type_Wellformedness.no_pointer_or_ref_to_incomplete_array_parameter?_TCC5

Terse proof for no_pointer_or_ref_to_incomplete_array_parameter?_TCC5.
no_pointer_or_ref_to_incomplete_array_parameter?_TCC5:

{1} ∀ (t: Cpp_Type_): function?(t) ⊃ (∀ (p: Cpp_Type_):

volatile?(typ(p)) ∧ const?(p) ∧ ¬ ((const?(p) ∨ volatile?(p)) ∧

pointer?(typ(p)) ∧

(array?(typ(typ(p))) ∧ size(typ(typ(p))) > 0)) ∧ ¬ ((pointer?(p) ∨ reference?(p)) ∧

(array?(typ(p)) ∧ size(typ(p)) > 0))

⊃ array?(typ(p)) ∨ pointer?(typ(p)) ∨ reference?(typ(p)) ∨ bitfield?(typ(p)) ∨ enum?(typ(p)) ∨ pointer_to_member?(typ(p)) ∨ const?(typ(p)) ∨ volatile?(typ(p)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_pointer_or_ref_to_incomplete_array_parameter?_TCC5.

Q.E.D.

C.40.10 Cpp_Deep_Type_Wellformedness.no_pointer_or_ref_to_incomplete_array_parameter?_TCC6

Terse proof for no_pointer_or_ref_to_incomplete_array_parameter?_TCC6.
no_pointer_or_ref_to_incomplete_array_parameter?_TCC6:

{1} ∀ (t: Cpp_Type_):

function?(t) ⊃ (∀ (p: Cpp_Type_):

pointer?(typ(typ(p))) ∧ volatile?(typ(p)) ∧ const?(p) ∧ ¬ ((const?(p) ∨ volatile?(p)) ∧ pointer?(typ(p)) ∧ (array?(typ(typ(p))) ∧ size(typ(typ(p))) > 0))

∧

¬ ((pointer?(p) ∨ reference?(p)) ∧

(array?(typ(p)) ∧ size(typ(p)) > 0))

⊃

array?(typ(typ(p))) ∨ pointer?(typ(typ(p))) ∨ reference?(typ(typ(p))) ∨ bitfield?(typ(typ(p))) ∨ enum?(typ(typ(p))) ∨ pointer_to_member?(typ(typ(p))) ∨ const?(typ(typ(p))) ∨ volatile?(typ(typ(p))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of no_pointer_or_ref_to_incomplete_array_parameter?_TCC6.

Q.E.D.

C.40.11 Cpp_Deep_Type_Wellformedness.bitfield_underlying_integral_or_enum_type?_TCC1

Terse proof for bitfield_underlying_integral_or_enum_type?_TCC1.
bitfield_underlying_integral_or_enum_type?_TCC1:

{1} ∀ (t: Cpp_Type_):

bitfield?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of bitfield_underlying_integral_or_enum_type?_TCC1.

Q.E.D.

C.40.12 Cpp_Deep_Type_Wellformedness.enum_underlying_integral?_TCC1

Terse proof for enum_underlying_integral?_TCC1.
enum_underlying_integral?_TCC1:

{1} ∀ (t: Cpp_Type_):

enum?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of enum_underlying_integral?_TCC1.

Q.E.D.

C.40.13 Cpp_Deep_Type_Wellformedness.enum_constants?_TCC1

Terse proof for enum_constants?_TCC1.
enum_constants?_TCC1:

{1} ∀ (e: (enum_underlying_integral?)): enum?(e) ⊃ (∀ (m: below[members(e)]):

array?(e) ∨ pointer?(e) ∨ reference?(e) ∨ bitfield?(e) ∨ enum?(e) ∨ pointer_to_member?(e) ∨ const?(e) ∨ volatile?(e))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of enum_constants?_TCC1. Q.E.D.

C.40.14 Cpp_Deep_Type_Wellformedness.enum_constants?_TCC2

Terse proof for enum_constants?_TCC2.
enum_constants?_TCC2:

{1} ∀ (e: (enum_underlying_integral?)): enum?(e) ⊃ (∀ (m: below[members(e)]): non_bool_integral?(typ(e)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of enum_constants?_TCC2. Q.E.D.

C.40.15 Cpp_Deep_Type_Wellformedness.const_volatile?_TCC1

Terse proof for const_volatile?_TCC1.

const_volatile?_TCC1:

{1} ∀ (t: Cpp_Type_):

volatile?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of const_volatile?_TCC1. Q.E.D.

C.40.16 Cpp_Deep_Type_Wellformedness.const_stutter?_TCC1

Terse proof for const_stutter?_TCC1.
const_stutter?_TCC1:

{1} ∀ (t: Cpp_Type_):

const?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of const_stutter?_TCC1. Q.E.D.

C.40.17 Cpp_Deep_Type_Wellformedness.cv_array?_TCC1

Terse proof for cv_array?_TCC1.
cv_array?_TCC1:

{1} ∀ (t: Cpp_Type_):

(volatile?(t) ∨ const?(t)) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cv_array?_TCC1. Q.E.D.

C.40.18 Cpp_Deep_Type_Wellformedness.cv_base_TCC1

Terse proof for cv_base_TCC1.

cv_base_TCC1:

{1} well_founded?(λ (x: Cpp_Type, y: Cpp_Type):

restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean] (≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Type], Expanding the definition of restrict, which is trivially true. This completes the proof of cv_base_TCC1. Q.E.D.

C.40.19 Cpp_Deep_Type_Wellformedness.cv_base_TCC2

Terse proof for cv_base_TCC2.

cv_base_TCC2:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_TCC2. Q.E.D.

C.40.20 Cpp_Deep_Type_Wellformedness.cv_base_TCC3

Terse proof for cv_base_TCC3.

cv_base_TCC3:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = const(t) ⊃ restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean](≪)(t, typ)

Expanding the definition of restrict, Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of «, which is trivially true. This completes the proof of cv_base_TCC3. Q.E.D.

C.40.21 Cpp_Deep_Type_Wellformedness.cv_base_TCC4

Terse proof for cv_base_TCC4.

cv_base_TCC4:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_TCC4. Q.E.D.

C.40.22 Cpp_Deep_Type_Wellformedness.cv_base_TCC5

Terse proof for cv_base_TCC5.

cv_base_TCC5:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = volatile(t) ⊃ restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean](≪)(t, typ)

Repeatedly Skolemizing and flattening, Expanding the definition of restrict, Replacing using formula -2, Expanding the definition of «, which is trivially true. This completes the proof of cv_base_TCC5. Q.E.D.

C.40.23 Cpp_Deep_Type_Wellformedness.subterm_cv_base

Terse proof for subterm_cv_base.
subterm_cv_base:

{1} ∀ (typ: Cpp_Type): subterm(cv_base(typ), typ)

Repeatedly Skolemizing and flattening, Expanding the definition of cv_base, Expanding the definition of cv_base, Lifting IF-conditions to the top level, Expanding the definition of subterm, Expanding the definition of subterm, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of Cpp_Type?, Expanding the definition of const_volatile?, Expanding the definition of const_stutter?, Expanding the definition of volatile_stutter?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 5 subgoals:

subterm_cv_base.1:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ (volatile?(t) ⊃ ¬ const?(typ(t))) ∧ (const?(t) ⊃ ¬ const?(typ(t))) ∧ (volatile?(t) ⊃ ¬ volatile?(typ(t))) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} const?(typ(typ′))
{1} subterm(cv_base(typ(typ(typ′))), typ′)

Instantiating the top quantifier in -1 with the terms: (typ!1),

Expanding the definition of subterm,

which is trivially true.

This completes the proof of subterm_cv_base.1.

subterm_cv_base.2:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ (volatile?(t) ⊃ ¬ const?(typ(t))) ∧ (const?(t) ⊃ ¬ const?(typ(t))) ∧ (volatile?(t) ⊃ ¬ volatile?(typ(t))) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{1} subterm(cv_base(typ(typ(typ′))), typ′)

Expanding the definition of cv_base,

Instantiating the top quantifier in -1 with the terms: (typ(typ!1)),

Expanding the definition of subterm,

Expanding the definition of subterm,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of subterm,

which is trivially true.

This completes the proof of subterm_cv_base.2.

subterm_cv_base.3:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ (volatile?(t) ⊃ ¬ const?(typ(t))) ∧ (const?(t) ⊃ ¬ const?(typ(t))) ∧ (volatile?(t) ⊃ ¬ volatile?(typ(t))) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{1} const?(typ′)
{2} volatile?(typ′)
{3} subterm(typ′, typ′)

Expanding the definition of subterm,

which is trivially true.

This completes the proof of subterm_cv_base.3.

subterm_cv_base.4:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ (volatile?(t) ⊃ ¬ const?(typ(t))) ∧ (const?(t) ⊃ ¬ const?(typ(t))) ∧ (volatile?(t) ⊃ ¬ volatile?(typ(t))) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ(typ′))
{-3} volatile?(typ′)
{1} subterm(cv_base(typ(typ(typ′))), typ′)

Instantiating the top quantifier in -1 with the terms: (typ!1),

Expanding the definition of subterm,

which is trivially true.

This completes the proof of subterm_cv_base.4.

subterm_cv_base.5:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ (volatile?(t) ⊃ ¬ const?(typ(t))) ∧ (const?(t) ⊃ ¬ const?(typ(t))) ∧ (volatile?(t) ⊃ ¬ volatile?(typ(t))) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} volatile?(typ(typ′))
{-3} volatile?(typ′)
{1} subterm(cv_base(typ(typ(typ′))), typ′)

Instantiating the top quantifier in -1 with the terms: (typ!1), Expanding the definition of subterm, which is trivially true. This completes the proof of subterm_cv_base.5. Q.E.D.

C.40.24 Cpp_Deep_Type_Wellformedness.cv_base_result

Terse proof for cv_base_result.
cv_base_result:

{1} ∀ (P: {Q: PRED[Cpp_Type_] | (Q ⊆ interpreted?)}, typ: Cpp_Subtype(cv(P))): P (cv_base(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Installing automatic rewrites from: cv_base Case splitting on FORALL (typ: (P!1)): NOT const?(typ) AND NOT volatile?(typ), we get 2 subgoals:

cv_base_result.1:

{-1} ∀ (typ: (P′)): ¬ const?(typ) ∧ ¬ volatile?(typ)
{-2} (P′ ⊆ interpreted?)
{-3} Cpp_Type?(typ′)
{-4} (P′(typ′) ∨ (const?(typ′) ∧ P′(typ(typ′)))) ∨

(P′(typ′) ∨ (volatile?(typ′) ∧ P′(typ(typ′)))) ∨ (const?(typ′) ∧ volatile?(typ(typ′)) ∧ P′(typ(typ(typ′))))

{1} P′(cv_base(typ′))

Hiding formulas: (-2 -3), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

cv_base_result.1.1:

{-1} ∀ (typ: (P′)): ¬ const?(typ) ∧ ¬ volatile?(typ)
{-2} P′(typ′)
{1} P′(cv_base(typ′))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_result.1.1.

cv_base_result.1.2:

{-1} ∀ (typ: (P′)): ¬ const?(typ) ∧ ¬ volatile?(typ)
{-2} const?(typ′)
{-3} P′(typ(typ′))
{1} P′(cv_base(typ(typ′)))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_result.1.2.

cv_base_result.1.3:

{-1} ∀ (typ: (P′)): ¬ const?(typ) ∧ ¬ volatile?(typ)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} P′(typ(typ(typ′)))
{1} P′(cv_base(typ(typ(typ′))))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_result.1.3.

cv_base_result.1.4:

{-1} ∀ (typ: (P′)): ¬ const?(typ) ∧ ¬ volatile?(typ)
{-2} P′(typ(typ′))
{-3} volatile?(typ′)
{1} P′(cv_base(typ(typ′)))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_result.1.4.

cv_base_result.2:

{-1} (P′ ⊆ interpreted?)
{-2} Cpp_Type?(typ′)
{-3} (P′(typ′) ∨ (const?(typ′) ∧ P′(typ(typ′)))) ∨

(P′(typ′) ∨ (volatile?(typ′) ∧ P′(typ(typ′)))) ∨ (const?(typ′) ∧ volatile?(typ(typ′)) ∧ P′(typ(typ(typ′))))

{1} ∀ (typ: (P′)): ¬ const?(typ) ∧ ¬ volatile?(typ)
{2} P′(cv_base(typ′))

Keeping (-1 1) and hiding *, Repeatedly Skolemizing and flattening, Expanding the definition of subset?, Expanding the definition of member, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cv_base_result.2. Q.E.D.

C.40.25 Cpp_Deep_Type_Wellformedness.cv_base_result2

Terse proof for cv_base_result2.
cv_base_result2:

{1} ∀ (typ: Cpp_Type): ¬ const?(typ) ∧ ¬ volatile?(typ) ⊃ cv_base(typ) = typ

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cv_base_result2. Q.E.D.

C.40.26 Cpp_Deep_Type_Wellformedness.cv_base_not_const

Terse proof for cv_base_not_const.
cv_base_not_const:

{1} ∀ (typ: Cpp_Type): ¬ const?(cv_base(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of cv_base, Expanding the definition of cv_base, Expanding the definition of Cpp_Type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

cv_base_not_const.1:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} const?(typ(typ′))
{-4} const?(cv_base(typ(typ(typ′))))

Instantiating quantified variables,

Expanding the definition of subterm,

Expanding the definition of const_stutter?,

which is trivially true.

This completes the proof of cv_base_not_const.1.

cv_base_not_const.2:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} const?(cv_base(typ(typ(typ′))))
{-4} volatile?(typ(typ′))

Expanding the definition of cv_base,

Instantiating quantified variables,

Expanding the definition of subterm,

Expanding the definition of subterm,

Expanding the definition of volatile_stutter?,

Expanding the definition of const_volatile?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_not_const.2.

cv_base_not_const.3:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ(typ′))
{-3} const?(cv_base(typ(typ(typ′))))
{-4} volatile?(typ′)

Instantiating quantified variables,

Expanding the definition of const_volatile?,

Expanding the definition of subterm,

which is trivially true.

This completes the proof of cv_base_not_const.3.

cv_base_not_const.4:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(cv_base(typ(typ(typ′))))
{-3} volatile?(typ(typ′))
{-4} volatile?(typ′)

Instantiating quantified variables, Expanding the definition of volatile_stutter?, Expanding the definition of subterm, which is trivially true. This completes the proof of cv_base_not_const.4. Q.E.D.

C.40.27 Cpp_Deep_Type_Wellformedness.cv_base_not_volatile

Terse proof for cv_base_not_volatile.
cv_base_not_volatile:

{1} ∀ (typ: Cpp_Type): ¬ volatile?(cv_base(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of cv_base, Expanding the definition of cv_base, Expanding the definition of Cpp_Type?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

cv_base_not_volatile.1:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} const?(typ(typ′))
{-4} volatile?(cv_base(typ(typ(typ′))))

Instantiating quantified variables,

Expanding the definition of subterm,

Expanding the definition of const_stutter?,

which is trivially true.

This completes the proof of cv_base_not_volatile.1.

cv_base_not_volatile.2:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ′)
{-3} volatile?(cv_base(typ(typ(typ′))))
{-4} volatile?(typ(typ′))

Expanding the definition of cv_base,

Instantiating quantified variables,

Expanding the definition of subterm,

Expanding the definition of subterm,

Expanding the definition of volatile_stutter?,

Expanding the definition of const_volatile?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of cv_base_not_volatile.2.

cv_base_not_volatile.3:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} const?(typ(typ′))
{-3} volatile?(cv_base(typ(typ(typ′))))
{-4} volatile?(typ′)

Instantiating quantified variables,

Expanding the definition of const_volatile?,

Expanding the definition of subterm,

which is trivially true.

This completes the proof of cv_base_not_volatile.3.

cv_base_not_volatile.4:

{-1} ∀ (t: Cpp_Type_):

subterm(t, typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-2} volatile?(cv_base(typ(typ(typ′))))
{-3} volatile?(typ(typ′))
{-4} volatile?(typ′)

Instantiating quantified variables, Expanding the definition of volatile_stutter?, Expanding the definition of subterm, which is trivially true. This completes the proof of cv_base_not_volatile.4. Q.E.D.

C.40.28 Cpp_Deep_Type_Wellformedness.cv_base_cv

Terse proof for cv_base_cv.

cv_base_cv:

{1} ∀ (P: PRED[Cpp_Type_], typ: Cpp_Type): (P ⊆ interpreted?) ⊃ (P (cv_base(typ)) ≡ cv(P)(typ))

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

cv_base_cv.1:

{-1} P′(cv_base(typ′))
{-2} Cpp_Type?(typ′)
{-3} (P′ ⊆ interpreted?)
{1} cv(P′)(typ′)

Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Applying disjunctive simplification to flatten sequent, Expanding the definition of cv_base, Installing automatic rewrites from: subterm const_stutter? volatile_stutter? const_volatile? Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 5 subgoals:

cv_base_cv.1.1:

{-1} const?(typ′)
{-2} P′(cv_base(typ(typ′)))
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))
{3} P′(typ(typ(typ′)))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cv_base_cv.1.1.1:

{-1} const?(typ′)
{-2} const?(typ(typ′))
{-3} P′(cv_base(typ(typ(typ′))))
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)
{3} P′(typ(typ(typ′)))

Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.1.1.

cv_base_cv.1.1.2:

{-1} const?(typ′)
{-2} P′(cv_base(typ(typ(typ′))))
{-3} volatile?(typ(typ′))
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)
{3} P′(typ(typ(typ′)))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cv_base_cv.1.1.2.1:

{-1} const?(typ′)
{-2} const?(typ(typ(typ′)))
{-3} P′(cv_base(typ(typ(typ(typ′)))))
{-4} volatile?(typ(typ′))
{-5} Cpp_Type?(typ′)
{-6} (P′ ⊆ interpreted?)
{1} P′(typ(typ(typ′)))
{2} P′(typ(typ′))
{3} P′(typ′)

Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.1.2.1.

cv_base_cv.1.1.2.2:

{-1} const?(typ′)
{-2} P′(cv_base(typ(typ(typ(typ′)))))
{-3} volatile?(typ(typ(typ′)))
{-4} volatile?(typ(typ′))
{-5} Cpp_Type?(typ′)
{-6} (P′ ⊆ interpreted?)
{1} P′(typ(typ(typ′)))
{2} P′(typ(typ′))
{3} P′(typ′)

Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.1.2.2.

cv_base_cv.1.2:

{-1} P′(cv_base(typ(typ′)))
{-2} volatile?(typ′)
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))
{3} P′(typ(typ(typ′)))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cv_base_cv.1.2.1:

{-1} const?(typ(typ′))
{-2} P′(cv_base(typ(typ(typ′))))
{-3} volatile?(typ′)
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)
{3} P′(typ(typ(typ′)))

Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.2.1.

cv_base_cv.1.2.2:

{-1} P′(cv_base(typ(typ(typ′))))
{-2} volatile?(typ(typ′))
{-3} volatile?(typ′)
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)
{3} P′(typ(typ(typ′)))

Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.2.2.

cv_base_cv.1.3:

{-1} const?(typ′)
{-2} P′(cv_base(typ(typ′)))
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))
{3} volatile?(typ(typ′))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.3.

cv_base_cv.1.4:

{-1} P′(cv_base(typ(typ′)))
{-2} volatile?(typ′)
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))
{3} volatile?(typ(typ′))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.4.

cv_base_cv.1.5:

{-1} P′(cv_base(typ(typ′)))
{-2} volatile?(typ′)
{-3} Cpp_Type?(typ′)
{-4} (P′ ⊆ interpreted?)
{1} P′(typ′)
{2} P′(typ(typ′))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cv_base_cv.1.5.1:

{-1} const?(typ(typ′))
{-2} P′(cv_base(typ(typ(typ′))))
{-3} volatile?(typ′)
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)

Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.5.1.

cv_base_cv.1.5.2:

{-1} P′(cv_base(typ(typ(typ′))))
{-2} volatile?(typ(typ′))
{-3} volatile?(typ′)
{-4} Cpp_Type?(typ′)
{-5} (P′ ⊆ interpreted?)
{1} P′(typ(typ′))
{2} P′(typ′)

Expanding the definition of Cpp_Type?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_base_cv.1.5.2.

cv_base_cv.2:

{-1} cv(P′)(typ′)
{-2} Cpp_Type?(typ′)
{-3} (P′ ⊆ interpreted?)
{1} P′(cv_base(typ′))

Rewriting using cv_base_result, matching in * where P gets P!1, This completes the proof of cv_base_cv.2. Q.E.D.

C.40.29 Cpp_Deep_Type_Wellformedness.layout_compatible?_TCC1

Terse proof for layout_compatible?_TCC1.
layout_compatible?_TCC1:

{1} ∃ (x: equivalence[Cpp_Type]): true

Instantiating the top quantifier in 1 with the terms: (=), we get 2 subgoals:

layout_compatible?_TCC1.1:

{1} true

which is trivially true.

This completes the proof of layout_compatible?_TCC1.1.
layout_compatible?_TCC1.2:

{1} equivalence?[Cpp_Type] (restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean](=))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of layout_compatible?_TCC1.2.

Q.E.D.

C.40.30 Cpp_Deep_Type_Wellformedness.layout_compatible_enums_TCC1

Terse proof for layout_compatible_enums_TCC1.
layout_compatible_enums_TCC1:

{1} ∀ (e_{1}, e_{2}: Cpp_Subtype(enum?)): array?(e_{1}) ∨ pointer?(e_{1}) ∨ reference?(e_{1}) ∨ bitfield?(e_{1}) ∨ enum?(e_{1}) ∨ pointer_to_member?(e_{1}) ∨ const?(e_{1}) ∨ volatile?(e_{1})

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of layout_compatible_enums_TCC1.

Q.E.D.

C.40.31 Cpp_Deep_Type_Wellformedness.layout_compatible_enums_TCC2

Terse proof for layout_compatible_enums_TCC2.
layout_compatible_enums_TCC2:

{1} ∀ (e_{1}, e_{2}: Cpp_Subtype(enum?)): array?(e_{2}) ∨ pointer?(e_{2}) ∨ reference?(e_{2}) ∨ bitfield?(e_{2}) ∨ enum?(e_{2}) ∨ pointer_to_member?(e_{2}) ∨ const?(e_{2}) ∨ volatile?(e_{2})

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of layout_compatible_enums_TCC2.

Q.E.D.

C.41 Proofs for Cpp_Deep_Types (types.pvs)

C.41.1 Cpp_Deep_Types.Cpp_Type__pointer_to_member_eta_TCC1

Terse proof for Cpp_Type__pointer_to_member_eta_TCC1.
Cpp_Type__pointer_to_member_eta_TCC1:

{1} ∀ (pointer_to_member?_var: (pointer_to_member?)):

array?(pointer_to_member?_var) ∨ pointer?(pointer_to_member?_var) ∨ reference?(pointer_to_member?_var) ∨ bitfield?(pointer_to_member?_var) ∨ enum?(pointer_to_member?_var) ∨ pointer_to_member?(pointer_to_member?_var) ∨ const?(pointer_to_member?_var) ∨ volatile?(pointer_to_member?_var)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of Cpp_Type__pointer_to_member_eta_TCC1.

Q.E.D.

C.41.2 Cpp_Deep_Types.Cpp_Type__pointer_to_member_eta_TCC2

Terse proof for Cpp_Type__pointer_to_member_eta_TCC2.
Cpp_Type__pointer_to_member_eta_TCC2:

{1} ∀ (pointer_to_member?_var: (pointer_to_member?)): class?(typ(pointer_to_member?_var))

Repeatedly Skolemizing and flattening, Adding type constraints for typ(pointer_to_member?_var!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of Cpp_Type__pointer_to_member_eta_TCC2.

Q.E.D.

C.41.3 Cpp_Deep_Types.Cpp_Type__typ_pointer_to_member_TCC1

Terse proof for Cpp_Type__typ_pointer_to_member_TCC1.
Cpp_Type__typ_pointer_to_member_TCC1:

{1} ∀ (pointer_to_member1_var: (class?), pointer_to_member2_var: Cpp_Type_): array?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ pointer?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ reference?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ bitfield?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ enum?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ pointer_to_member?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ const?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∨ volatile?(pointer_to_member(pointer_to_member1_var, pointer_to_member2_var))

C.41 Proofs for Cpp_Deep_Types (types.pvs)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of Cpp_Type__typ_pointer_to_member_TCC1.

Q.E.D.

C.41.4 Cpp_Deep_Types.subterm_less

Terse proof for subterm_less.

subterm_less:

{1} ∀ (t_{1}, t_{2}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ t_{1} ≠ t_{2} ⊃ t_{1} ≪ t_{2}

Inducting on t_{2} on formula 1, we get 28 subgoals:

subterm_less.1:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, uchar) ∧ t_{1} ≠ uchar ⊃ t_{1} ≪ uchar

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.1.

subterm_less.2:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, schar) ∧ t_{1} ≠ schar ⊃ t_{1} ≪ schar

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.2.

subterm_less.3:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, char) ∧ t_{1} ≠ char ⊃ t_{1} ≪ char

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.3.

subterm_less.4:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, short) ∧ t_{1} ≠ short ⊃ t_{1} ≪ short

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.4.

subterm_less.5:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, int) ∧ t_{1} ≠ int ⊃ t_{1} ≪ int

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.5.

subterm_less.6:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, long) ∧ t_{1} ≠ long ⊃ t_{1} ≪ long

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.6.

subterm_less.7:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, longlong) ∧ t_{1} ≠ longlong ⊃ t_{1} ≪ longlong

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.7.

subterm_less.8:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, ushort) ∧ t_{1} ≠ ushort ⊃ t_{1} ≪ ushort

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.8.

subterm_less.9:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, uint) ∧ t_{1} ≠ uint ⊃ t_{1} ≪ uint

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.9.

subterm_less.10:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, ulong) ∧ t_{1} ≠ ulong ⊃ t_{1} ≪ ulong

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.10.

subterm_less.11:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, ulonglong) ∧ t_{1} ≠ ulonglong ⊃ t_{1} ≪ ulonglong

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.11.

subterm_less.12:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, wchar_t) ∧ t_{1} ≠ wchar_t ⊃ t_{1} ≪ wchar_t

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.12.

subterm_less.13:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, bool) ∧ t_{1} ≠ bool ⊃ t_{1} ≪ bool

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.13.

subterm_less.14:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, float) ∧ t_{1} ≠ float ⊃ t_{1} ≪ float

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.14.

subterm_less.15:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, double) ∧ t_{1} ≠ double ⊃ t_{1} ≪ double

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.15.

subterm_less.16:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, longdouble) ∧ t_{1} ≠ longdouble ⊃ t_{1} ≪ longdouble

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.16.

subterm_less.17:

{1} ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, void) ∧ t_{1} ≠ void ⊃ t_{1} ≪ void

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.17.

subterm_less.18:

{1} ∀ (array_type1_var: Cpp_Type_, array_type2_var: nat):

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, array_type1_var) ∧ t_{1} ≠ array_type1_var ⊃ t_{1} ≪ array_type1_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, array_type(array_type1_var, array_type2_var)) ∧ t_{1} ≠ array_type(array_type1_var, array_type2_var) ⊃ t_{1} ≪ array_type(array_type1_var, array_type2_var))

Repeatedly Skolemizing and flattening, Expanding the definition of «, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.18.

subterm_less.19:

{1} ∀ (function_type1_var: Cpp_Type_, function_type2_var: list[Cpp_Type_],

function_type3_var: bool): (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, function_type1_var) ∧ t_{1} ≠ function_type1_var ⊃ t_{1} ≪ function_type1_var)

∧

every(λ (t_{2}: Cpp_Type_): ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ t_{1} ≠ t_{2} ⊃ t_{1} ≪ t_{2})

(function_type2_var) ⊃

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, function_type(function_type1_var, function_type2_var, function_type3_var))

∧ t_{1} ≠ function_type(function_type1_var, function_type2_var, func-

tion_type3_var)

⊃ t_{1} ≪ function_type(function_type1_var, function_type2_var, func-

tion_type3_var))

Repeatedly Skolemizing and flattening, Expanding the definition of «, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

subterm_less.19.1:

{-1} ∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, function_type1_var′) ∧ t_{1} ≠ function_type1_var′ ⊃ t_{1} ≪ function_type1_var′

{-2} every(λ (t_{2}: Cpp_Type_): ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ t_{1} ≠ t_{2} ⊃ t_{1} ≪ t_{2})

(function_type2_var′)

{-3} subterm(t′_{1}, function_type1_var′)
{1} t′_{1} = function_type(function_type1_var′, function_type2_var′, function_type3_var′)
{2} t′_{1} = function_type1_var′
{3} t′_{1} ≪ function_type1_var′
{4} some[Cpp_Type_](λ (z: Cpp_Type_): t′_{1} = z ∨ t′_{1} ≪ z)(function_type2_var′)

Instantiating the top quantifier in -1 with the terms: (t1!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.19.1.

subterm_less.19.2:

{-1} ∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, function_type1_var′) ∧ t_{1} ≠ function_type1_var′ ⊃ t_{1} ≪ function_type1_var′

{-2} every(λ (t_{2}: Cpp_Type_): ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ t_{1} ≠ t_{2} ⊃ t_{1} ≪ t_{2})

(function_type2_var′)

{-3} some[Cpp_Type_](λ (z: Cpp_Type_): subterm(t′_{1}, z))(function_type2_var′)
{1} t′_{1} = function_type(function_type1_var′, function_type2_var′, function_type3_var′)
{2} t′_{1} = function_type1_var′
{3} t′_{1} ≪ function_type1_var′
{4} some[Cpp_Type_](λ (z: Cpp_Type_): t′_{1} = z ∨ t′_{1} ≪ z)(function_type2_var′)

Rewriting using some_iff_exists, matching in *, Rewriting using some_iff_exists, matching in *, Rewriting using every_iff_forall, matching in *, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 4 with the terms: (t!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -2 with the terms: (t!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.19.2.

subterm_less.20:

{1} ∀ (pointer1_var: Cpp_Type_):

(∀ (t_{1}: Cpp_Type_): subterm(t_{1}, pointer1_var) ∧ t_{1} ≠ pointer1_var ⊃ t_{1} ≪ pointer1_var)

⊃
(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, pointer(pointer1_var)) ∧ t_{1} ≠ pointer(pointer1_var) ⊃ t_{1} ≪ pointer(pointer1_var))

Repeatedly Skolemizing and flattening, Expanding the definition of «, Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.20.

subterm_less.21:

{1} ∀ (reference1_var: Cpp_Type_): (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, reference1_var) ∧ t_{1} ≠ reference1_var ⊃ t_{1} ≪ reference1_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, reference(reference1_var)) ∧ t_{1} ≠ reference(reference1_var) ⊃ t_{1} ≪ reference(reference1_var))

Repeatedly Skolemizing and flattening, Expanding the definition of «, Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.21.

subterm_less.22:

{1} ∀ (class1_var: string, class2_var: bool): ∀ (t_{1}: Cpp_Type_): subterm(t_{1}, class(class1_var, class2_var)) ∧ t_{1} ≠ class(class1_var, class2_var) ⊃ t_{1} ≪ class(class1_var, class2_var)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.22.

subterm_less.23:

{1} ∀ (union1_var: string):

∀ (t_{1}: Cpp_Type_): subterm(t_{1}, union(union1_var)) ∧ t_{1} ≠ union(union1_var) ⊃ t_{1} ≪ union(union1_var)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_less.23.

subterm_less.24:

{1} ∀ (bitfield1_var: Cpp_Type_, bitfield2_var: nat, bitfield3_var: posnat):

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, bitfield1_var) ∧ t_{1} ≠ bitfield1_var ⊃ t_{1} ≪ bitfield1_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, bitfield(bitfield1_var, bitfield2_var, bitfield3_var)) ∧ t_{1} ≠ bitfield(bitfield1_var, bitfield2_var, bitfield3_var) ⊃ t_{1} ≪ bitfield(bitfield1_var, bitfield2_var, bitfield3_var))

Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Expanding the definition of «, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.24.

subterm_less.25:

{1} ∀ (enum1_var: string, enum2_var: Cpp_Type_, enum3_var: posnat,

enum4_var: [below[enum3_var] → int]): (∀ (t_{1}: Cpp_Type_): subterm(t_{1}, enum2_var) ∧ t_{1} ≠ enum2_var ⊃ t_{1} ≪ enum2_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, enum(enum1_var, enum2_var, enum3_var, enum4_var)) ∧

t_{1} ≠ enum(enum1_var, enum2_var, enum3_var, enum4_var) ⊃ t_{1} ≪ enum(enum1_var, enum2_var, enum3_var, enum4_var))

Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Expanding the definition of «, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.25.

subterm_less.26:

{1} ∀ (pointer_to_member1_var: (class?), pointer_to_member2_var: Cpp_Type_):

((∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, pointer_to_member1_var) ∧ t_{1} ≠ pointer_to_member1_var ⊃ t_{1} ≪ pointer_to_member1_var)

∧

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, pointer_to_member2_var) ∧ t_{1} ≠ pointer_to_member2_var ⊃ t_{1} ≪ pointer_to_member2_var))

⊃

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, pointer_to_member(pointer_to_member1_var, pointer_to_member2_var)) ∧ t_{1} ≠ pointer_to_member(pointer_to_member1_var, pointer_to_member2_var) ⊃ t_{1} ≪ pointer_to_member(pointer_to_member1_var, pointer_to_member2_var))

Repeatedly Skolemizing and flattening, Expanding the definition of «, Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -2 with the terms: (t1!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.26.

subterm_less.27:

{1} ∀ (const1_var: Cpp_Type_):

(∀ (t_{1}: Cpp_Type_): subterm(t_{1}, const1_var) ∧ t_{1} ≠ const1_var ⊃ t_{1} ≪ const1_var) ⊃

(∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, const(const1_var)) ∧ t_{1} ≠ const(const1_var) ⊃

t_{1} ≪ const(const1_var))

Repeatedly Skolemizing and flattening, Expanding the definition of «, Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.27.

subterm_less.28:

{1} ∀ (volatile1_var: Cpp_Type_): (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, volatile1_var) ∧ t_{1} ≠ volatile1_var ⊃ t_{1} ≪ volatile1_var) ⊃ (∀ (t_{1}: Cpp_Type_):

subterm(t_{1}, volatile(volatile1_var)) ∧ t_{1} ≠ volatile(volatile1_var) ⊃ t_{1} ≪ volatile(volatile1_var))

Repeatedly Skolemizing and flattening, Expanding the definition of «, Expanding the definition of subterm, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_less.28. Q.E.D.

C.41.5 Cpp_Deep_Types.subterm_transitive

Terse proof for subterm_transitive.
subterm_transitive:

{1} ∀ (t_{1}, t_{2}, t_{3}: Cpp_Type_): subterm(t_{1}, t_{2}) ∧ subterm(t_{2}, t_{3}) ⊃ subterm(t_{1}, t_{3})

Using lemma wf_induction[Cpp_Type_, ≪], For the top quantifier in 1, we introduce Skolem constants: (t1!1 t2!1 _), Instantiating the top quantifier in -1 with the terms: (LAMBDA (t3: Cpp_Type_): subterm(t1!1,

t2!1) AND subterm(t2!1, t3) IMPLIES subterm(t1!1, t3)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Splitting conjunctions, we get 3 subgoals:

subterm_transitive.1:

{-1} t′_{2} = x′
{-2} ∀ (y: Cpp_Type_):

y ≪ x′ ⊃ subterm(t′_{1}, t′_{2}) ∧ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)

{-3} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of subterm_transitive.1.

subterm_transitive.2:

{-1} ∀ (y: Cpp_Type_):
y ≪ x′ ⊃ subterm(t′_{1}, t′_{2}) ∧ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-2} subterm(t′_{1}, t′_{2})
{1} true
{2} subterm(t′_{1}, x′)

which is trivially true. This completes the proof of subterm_transitive.2.

subterm_transitive.3:

{-1} ¬ uchar?(x′) ∧ if schar?(x′) then false elsif char?(x′) then false elsif short?(x′) then false elsif int?(x′) then false elsif long?(x′) then false elsif longlong?(x′) then false elsif ushort?(x′) then false elsif uint?(x′) then false elsif ulong?(x′) then false elsif ulonglong?(x′) then false elsif wchar_t?(x′) then false elsif bool?(x′) then false elsif float?(x′) then false elsif double?(x′) then false elsif longdouble?(x′) then false elsif void?(x′) then false elsif array?(x′) then subterm(t′_{2}, typ(x′)) elsif function?(x′)

then subterm(t′_{2}, ret_typ(x′)) ∨

some[Cpp_Type_](λ (z: Cpp_Type_): subterm(t′_{2}, z))(args_typ(x′))

elsif pointer?(x′) then subterm(t′_{2}, typ(x′)) elsif reference?(x′) then subterm(t′_{2}, typ(x′)) elsif class?(x′) then false elsif union?(x′) then false elsif bitfield?(x′) then subterm(t′_{2}, typ(x′)) elsif enum?(x′) then subterm(t′_{2}, typ(x′)) elsif pointer_to_member?(x′)

then subterm(t′_{2}, typ(x′)) ∨ subterm(t′_{2}, member_typ(x′)) elsif const?(x′) then subterm(t′_{2}, typ(x′)) else subterm(t′_{2}, typ(x′))

{-2} ∀ (y: Cpp_Type_):

y ≪ x′ ⊃ subterm(t′_{1}, t′_{2}) ∧ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)

{-3} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 7 subgoals:

subterm_transitive.3.1:

{-1} array?(x′)
{-2} subterm(t′_{2}, typ(x′))
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (typ(x!1)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

subterm_transitive.3.1.1:

{-1} array?(x′)
{-2} subterm(t′_{2}, typ(x′))
{-3} subterm(t′_{1}, typ(x′))
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Expanding the definition of subterm, which is trivially true.

This completes the proof of subterm_transitive.3.1.1.
subterm_transitive.3.1.2:

{-1} array?(x′)
{-2} subterm(t′_{2}, typ(x′))
{-3} subterm(t′_{1}, t′_{2})
{1} typ(x′) ≪ x′
{2} subterm(t′_{1}, x′)

Expanding the definition of «, which is trivially true.

This completes the proof of subterm_transitive.3.1.2.
subterm_transitive.3.2:

{-1} function?(x′)
{-2} subterm(t′_{2}, ret_typ(x′))
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (ret_typ(x!1)), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_transitive.3.2.

subterm_transitive.3.3:

{-1} function?(x′)
{-2} some[Cpp_Type_](λ (z: Cpp_Type_): subterm(t′_{2}, z))(args_typ(x′))
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Expanding the definition of subterm, Applying disjunctive simplification to flatten sequent, Rewriting using some_iff_exists, matching in *, Rewriting using some_iff_exists, matching in *, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of «, Applying disjunctive simplification to flatten sequent, Rewriting using some_iff_exists, matching in *, Using lemma forall_not[Cpp_Type_], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -1 with the terms: (x!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

subterm_transitive.3.3.1:

{-1} function?(x′)
{-2} member(t′, args_typ(x′))
{-3} subterm(t′_{2}, t′)
{-4} subterm(t′_{1}, t′_{2})
{1} t′ = x′
{2} t′ ≪ x′
{3} ∃ (t: Cpp_Type_): member(t, args_typ(x′)) ∧ (t′ = t ∨ t′ ≪ t)
{4} t′ = ret_typ(x′)
{5} t′ ≪ ret_typ(x′)
{6} subterm(t′_{1}, t′)
{7} t′_{1} = x′
{8} subterm(t′_{1}, ret_typ(x′))

Using lemma subterm_less, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables,

This completes the proof of subterm_transitive.3.3.1.
subterm_transitive.3.3.2:

{-1} function?(x′)
{-2} member(t′, args_typ(x′))
{-3} subterm(t′_{2}, t′)
{-4} subterm(t′_{1}, t′_{2})
{1} member(x′, args_typ(x′))
{2} ∃ (t: Cpp_Type_): member(t, args_typ(x′)) ∧ (t′ = t ∨ t′ ≪ t)
{3} t′ = ret_typ(x′)
{4} t′ ≪ ret_typ(x′)
{5} subterm(t′_{1}, t′)
{6} t′_{1} = x′
{7} subterm(t′_{1}, ret_typ(x′))

Instantiating the top quantifier in 2 with the terms: (t!1), which is trivially true.

This completes the proof of subterm_transitive.3.3.2.
subterm_transitive.3.4:

{-1} subterm(t′_{2}, typ(x′))
{-2} pointer?(x′)
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (typ(x!1)), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_transitive.3.4.

subterm_transitive.3.5:

{-1} subterm(t′_{2}, typ(x′))
{-2} reference?(x′)
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (typ(x!1)), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_transitive.3.5.

subterm_transitive.3.6:

{-1} subterm(t′_{2}, typ(x′))
{-2} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-3} subterm(t′_{1}, t′_{2})
{1} uchar?(x′)
{2} schar?(x′)
{3} char?(x′)
{4} short?(x′)
{5} int?(x′)
{6} long?(x′)
{7} longlong?(x′)
{8} ushort?(x′)
{9} uint?(x′)
{10} ulong?(x′)
{11} ulonglong?(x′)
{12} wchar_t?(x′)
{13} bool?(x′)
{14} float?(x′)
{15} double?(x′)
{16} longdouble?(x′)
{17} void?(x′)
{18} function?(x′)
{19} class?(x′)
{20} union?(x′)
{21} subterm(t′_{1}, x′)

Instantiating the top quantifier in -2 with the terms: (typ(x!1)), Expanding the definition of «, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of subterm_transitive.3.6.

subterm_transitive.3.7:

{-1} pointer_to_member?(x′)
{-2} subterm(t′_{2}, member_typ(x′))
{-3} ∀ (y: Cpp_Type_): y ≪ x′ ⊃ subterm(t′_{2}, y) ⊃ subterm(t′_{1}, y)
{-4} subterm(t′_{1}, t′_{2})
{1} subterm(t′_{1}, x′)

Instantiating the top quantifier in -3 with the terms: (member_typ(x!1)), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subterm_transitive.3.7. Q.E.D.

C.41.6 Cpp_Deep_Types.c_TCC1

Terse proof for c_TCC1.

c_TCC1:

{1} ∀ (p: PRED[Cpp_Type_], typ: Cpp_Type_): const?(typ) ∧ ¬ p(typ) ⊃ array?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of c_TCC1. Q.E.D.

C.41.7 Cpp_Deep_Types.v_TCC1

Terse proof for v_TCC1.

v_TCC1:

{1} ∀ (p: PRED[Cpp_Type_], typ: Cpp_Type_): volatile?(typ) ∧ ¬ p(typ) ⊃ array?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of v_TCC1. Q.E.D.

C.41.8 Cpp_Deep_Types.cv_TCC1

Terse proof for cv_TCC1.

cv_TCC1:

{1} ∀ (p: PRED[Cpp_Type_], typ: Cpp_Type_): const?(typ) ∧ ¬ v(p)(typ) ∧ ¬ c(p)(typ) ⊃ array?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cv_TCC1. Q.E.D.

C.41.9 Cpp_Deep_Types.cv_TCC2

Terse proof for cv_TCC2.

cv_TCC2:

{1} ∀ (p: PRED[Cpp_Type_], typ: Cpp_Type_): volatile?(typ(typ)) ∧ const?(typ) ∧ ¬ v(p)(typ) ∧ ¬ c(p)(typ) ⊃ array?(typ(typ)) ∨ pointer?(typ(typ)) ∨ reference?(typ(typ)) ∨ bitfield?(typ(typ)) ∨ enum?(typ(typ)) ∨ pointer_to_member?(typ(typ)) ∨ const?(typ(typ)) ∨ volatile?(typ(typ))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cv_TCC2. Q.E.D.

C.41.10 Cpp_Deep_Types.cv_implied

Terse proof for cv_implied.

cv_implied:

{1} ∀ (p_{1}, p_{2}: PRED[Cpp_Type_], typ: Cpp_Type_):

(p_{1} ⊆ p_{2}) ∧ cv(p_{1})(typ) ⊃ cv(p_{2})(typ)

Repeatedly Skolemizing and flattening, Expanding the definition of subset?, Expanding the definition of member, Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Applying disjunctive simplification to flatten sequent, Splitting conjunctions, we get 5 subgoals:

cv_implied.1:

{-1} p′_{1}(typ′)
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_implied.1.

cv_implied.2:

{-1} (const?(typ′) ∧ p′_{1}(typ(typ′)))
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_implied.2.

cv_implied.3:

{-1} p′_{1}(typ′)
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_implied.3.

cv_implied.4:

{-1} (volatile?(typ′) ∧ p′_{1}(typ(typ′)))
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_implied.4.

cv_implied.5:

{-1} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{1}(typ(typ(typ′))))
{-2} ∀ (x: Cpp_Type_): p′_{1}(x) ⇒ p′_{2}(x)
{1} p′_{2}(typ′)
{2} (const?(typ′) ∧ p′_{2}(typ(typ′)))
{3} p′_{2}(typ′)
{4} (volatile?(typ′) ∧ p′_{2}(typ(typ′)))
{5} (const?(typ′) ∧ volatile?(typ(typ′)) ∧ p′_{2}(typ(typ(typ′))))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of cv_implied.5. Q.E.D.

C.41.11 Cpp_Deep_Types.pod?_TCC1

Terse proof for pod?_TCC1.

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

pod?_TCC1:

{1} ∀ (t: Cpp_Type_):

array?(t) ∧ ¬ (class?(t) ∧ (pod_struct?(t) ∨ pod_union?(t))) ∧ ¬ scalar?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Repeatedly Skolemizing and flattening, This completes the proof of pod?_TCC1. Q.E.D.

C.41.12 Cpp_Deep_Types.uidt_void_TCC1

Terse proof for uidt_void_TCC1.
uidt_void_TCC1:

{1} uninterpreted_data_type?((#size := 0, valid? := λ (l: list[Byte], a: Address): false#))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_void_TCC1. Q.E.D.

C.42 Proofs for Cpp_Examples (cpp-examples.pvs)

C.42.1 Cpp_Examples.spec01

Terse proof for spec01.

spec01:

{1} Valid(STATES, skip[State], STATES)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: literal id list_props.member postinc postdec not_exp

preint predec IntExpressions.* IntExpressions.div IntExpressions.rem IntExpressions.- IntExpressions.« IntExpressions.» IntExpressions.< IntExpressions.> IntExpressions.<= IntExpressions.>= EqualityExpressions.== not_equal and_exp or_exp assign assign_times IntExpressions.+ assign_plus assign_minus assign_div assign_rem comma assign_bsr assign_bsl deref IntExpressions2.+ IntExpressions2.- Cpp_pointer.+ Cpp_pointer.- ptr_addr_ptr_of pointer_add_n_pointer_minus pointer_add_difference Aligned_Ptr plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read_single_data plain_memory_read_write_single_data pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s if_else switch member break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_as_while do_while_unroll for_as_while for_unroll composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt allocate_stack deallocate_stack with_new_stackvar ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state l2r n2b a2b comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec01. Q.E.D.

C.42.2 Cpp_Examples.PRECONDITION_TCC1

Terse proof for PRECONDITION_TCC1.
  PRECONDITION_TCC1:

{1} ∀ (s: State): pm`states(s) ⊃ Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

PRECONDITION_TCC1.1:

{-1} pm`states(s′)
{1} Cpp_Type?(int)

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of PRECONDITION_TCC1.1.

PRECONDITION_TCC1.2:

{-1} pm`states(s′)
{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of PRECONDITION_TCC1.2. Q.E.D.

C.42.3 Cpp_Examples.PRECONDITION_TCC2

Terse proof for PRECONDITION_TCC2.
PRECONDITION_TCC2:

{1} ∀ (s: State):

in_blessed_memory?(dt_bool, c, pm`rw_addr) ∧ in_blessed_memory?(dt(int), m, pm`rw_addr) ∧ in_blessed_memory?(dt(int), n, pm`rw_addr) ∧ pm`states(s) ⊃ Cpp_Type?(char) ∧ cv(non_bool_integral_enum?)(char)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

PRECONDITION_TCC2.1:

{-1} in_blessed_memory?(dt_bool, c, pm`rw_addr)
{-2} in_blessed_memory?(dt(int), m, pm`rw_addr)
{-3} in_blessed_memory?(dt(int), n, pm`rw_addr)
{-4} pm`states(s′)
{1} Cpp_Type?(char)

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of PRECONDITION_TCC2.1.

PRECONDITION_TCC2.2:

{-1} in_blessed_memory?(dt_bool, c, pm`rw_addr)
{-2} in_blessed_memory?(dt(int), m, pm`rw_addr)
{-3} in_blessed_memory?(dt(int), n, pm`rw_addr)
{-4} pm`states(s′)
{1} cv(non_bool_integral_enum?)(char)

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of PRECONDITION_TCC2.2. Q.E.D.

C.42.4 Cpp_Examples.PRECONDITION_TCC3

Terse proof for PRECONDITION_TCC3.
PRECONDITION_TCC3:

{1} ∀ (s: State):

in_blessed_memory?(dt(char), b, pm`rw_addr) ∧ in_blessed_memory?(dt(char), a, pm`rw_addr) ∧ in_blessed_memory?(dt_bool, c, pm`rw_addr) ∧ in_blessed_memory?(dt(int), m, pm`rw_addr) ∧ in_blessed_memory?(dt(int), n, pm`rw_addr) ∧ pm`states(s)

⊃ Cpp_Type?(char)

Repeatedly Skolemizing and flattening, Using lemma PRECONDITION_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of PRECONDITION_TCC3. Q.E.D.

C.42.5 Cpp_Examples.PRECONDITION_TCC4

Terse proof for PRECONDITION_TCC4.

PRECONDITION_TCC4:

{1} ∀ (s: State):

blocks_disjoint?(b, size_of(char), a, size_of(char)) ∧ blocks_disjoint?(a, size_of(char), b, size_of(char)) ∧ in_blessed_memory?(dt(char), b, pm`rw_addr) ∧ in_blessed_memory?(dt(char), a, pm`rw_addr) ∧ in_blessed_memory?(dt_bool, c, pm`rw_addr) ∧ in_blessed_memory?(dt(int), m, pm`rw_addr) ∧ in_blessed_memory?(dt(int), n, pm`rw_addr) ∧ pm`states(s)

⊃ Cpp_Type?(int)

Repeatedly Skolemizing and flattening, Using lemma PRECONDITION_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of PRECONDITION_TCC4. Q.E.D.

C.42.6 Cpp_Examples.POSTCONDITION_TCC1

Terse proof for POSTCONDITION_TCC1.
POSTCONDITION_TCC1:

{1} ∀ (s: State): Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

POSTCONDITION_TCC1.1:

{1} Cpp_Type?(int)

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of POSTCONDITION_TCC1.1.

POSTCONDITION_TCC1.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of POSTCONDITION_TCC1.2. Q.E.D.

C.42.7 Cpp_Examples.spec02_TCC1

Terse proof for spec02_TCC1.

  spec02_TCC1:

{1} plain_memory?(pm) ⊃ range(int)(42)

Applying disjunctive simplification to flatten sequent,

Expanding the definition of range,

Expanding the definition of range_integral,

Rewriting using int_binary, matching in *,

Using lemma min_int,

Using lemma max_int,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec02_TCC1.

Q.E.D.

C.42.8 Cpp_Examples.spec02

Terse proof for spec02.

  spec02:

{1} plain_memory?(pm) ⊃ valid(PRECONDITION, e2s(assign(pm, dt(int))(id(n), literal(42))), POSTCONDI-TION)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: literal id list_props.member postinc postdec not_exp preint predec IntExpressions.* IntExpressions.div IntExpressions.rem IntExpressions.- IntExpressions.« IntExpressions.» IntExpressions.< IntExpressions.> IntExpressions.<= IntExpressions.>= EqualityExpressions.== not_equal and_exp or_exp assign assign_times IntExpressions.+ assign_plus assign_minus assign_div assign_rem comma assign_bsr assign_bsl deref IntExpressions2.+ IntExpressions2.- Cpp_pointer.+ Cpp_pointer.- ptr_addr_ptr_of pointer_add_n_pointer_minus pointer_add_difference Aligned_Ptr

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_as_while do_while_unroll for_as_while for_unroll

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r n2b a2b

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec02.

Q.E.D.

C.42.9 Cpp_Examples.spec03

Terse proof for spec03.

  spec03:

{1} plain_memory?(pm) ⊃ Valid(PRECONDITION, e2s(assign(pm, dt(int))(id(n), literal(42))), POSTCONDI- TION)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: literal id list_props.member postinc postdec not_exp preint predec

IntExpressions.* IntExpressions.div IntExpressions.rem IntExpressions.- IntExpressions.« IntExpressions.» IntExpressions.< IntExpressions.> IntExpressions.<= IntExpressions.>= EqualityExpressions.== not_equal and_exp or_exp assign assign_times IntExpressions.+ assign_plus assign_minus assign_div assign_rem comma assign_bsr assign_bsl deref IntExpressions2.+ IntExpressions2.- Cpp_pointer.+ Cpp_pointer.- ptr_addr_ptr_of pointer_add_n_pointer_minus pointer_add_difference Aligned_Ptr

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_as_while do_while_unroll for_as_while for_unroll

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r n2b a2b Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data

comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec03. Q.E.D.

C.42.10 Cpp_Examples.spec04_TCC1

Terse proof for spec04_TCC1.

spec04_TCC1:

{1} plain_memory?(pm) ⊃ range(char)(42)

Applying disjunctive simplification to flatten sequent, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using char_binary, matching in *, Using lemma min_char, Using lemma max_char, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec04_TCC1. Q.E.D.

C.42.11 Cpp_Examples.spec04_TCC2

Terse proof for spec04_TCC2.

spec04_TCC2:

{1} plain_memory?(pm) ⊃ Cpp_Type?(char) ∧ cv(non_bool_integral_enum?)(char)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Applying propositional simplification, we get 2 subgoals:

spec04_TCC2.1:

{1} Cpp_Type?(char)

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1,

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec04_TCC2.1.

  spec04_TCC2.2:

{1} cv(non_bool_integral_enum?)(char)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of spec04_TCC2.2.

Q.E.D.

C.42.12 Cpp_Examples.spec04

Terse proof for spec04.

  spec04:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt(char))(id(a), literal(42))) ## e2s(assign(pm, dt(char))(id(b), literal(42))), λ (s: State):

OK?(read_data(pm, dt(char))(a)(s)) ∧ data(read_data(pm, dt(char))(a)(s)) = 42)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr

plain_memory_read_read_q_data_stmt  pm_q_prop_ok_result_single  pm_q_prop_ok_result_q_expr

pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec04.

Q.E.D.

C.42.13 Cpp_Examples.spec05

Terse proof for spec05.

  spec05:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt_bool)(id(c), literal(true))) ## if_else(l2r(pm, dt_bool)(id(c)),

e2s(assign(pm, dt(int))(id(n), literal(42))), skip),

POSTCONDITION)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec05.

Q.E.D.

C.42.14 Cpp_Examples.spec06_TCC1

Terse proof for spec06_TCC1.

  spec06_TCC1:

{1} plain_memory?(pm) ⊃ range(char)(0)

Applying disjunctive simplification to flatten sequent,

Expanding the definition of range,

Expanding the definition of range_integral, Rewriting using char_binary, matching in *, Using lemma min_char, Using lemma max_char, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec06_TCC1. Q.E.D.

C.42.15 Cpp_Examples.spec06_TCC2

Terse proof for spec06_TCC2.

spec06_TCC2:

{1} plain_memory?(pm) ⊃ range(char)(1)

Applying disjunctive simplification to flatten sequent, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using char_binary, matching in *, Using lemma min_char, Using lemma max_char, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec06_TCC2. Q.E.D.

C.42.16 Cpp_Examples.spec06_TCC3

Terse proof for spec06_TCC3.

spec06_TCC3:

{1} plain_memory?(pm) ⊃ every[real](λ (x: real): rational_pred(x) ∧ integer_pred(x))((:1:))

Repeatedly Skolemizing and flattening, Using lemma spec04_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of spec06_TCC3. Q.E.D.

C.42.17 Cpp_Examples.spec06_TCC4

Terse proof for spec06_TCC4.

spec06_TCC4:

{1} plain_memory?(pm) ⊃ range(int)(0)

Applying disjunctive simplification to flatten sequent, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using int_binary, matching in *, Using lemma min_int, Using lemma max_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec06_TCC4. Q.E.D.

C.42.18 Cpp_Examples.spec06

Terse proof for spec06.

  spec06:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt(char))(id(a), literal(0))) ## e2s(assign(pm, dt(char))(id(b), literal(1))) ## switch(l2r(pm, dt(char))(id(a)), (:0, 1:),

case(0) ## skip ## case(1) ## e2s(assign(pm, dt(int))(id(n), literal(42))) ## break ## default ## e2s(assign(pm, dt(int))(id(n), literal(0)))),

POSTCONDITION)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec06.

Q.E.D.

C.42.19 Cpp_Examples.spec07

Terse proof for spec07.

  spec07:

{1} valid(PRECONDITION, while(literal(true), skip), λ (s: State): false)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: literal id list_props.member postinc postdec not_exp preint predec IntExpressions.* IntExpressions.div IntExpressions.rem IntExpressions.- IntExpressions.« IntExpressions.» IntExpressions.< IntExpressions.> IntExpressions.<= IntExpressions.>= EqualityExpressions.== not_equal and_exp or_exp assign assign_times IntExpressions.+ assign_plus assign_minus assign_div assign_rem comma assign_bsr assign_bsl deref IntExpressions2.+ IntExpressions2.- Cpp_pointer.+ Cpp_pointer.- ptr_addr_ptr_of pointer_add_n_pointer_minus pointer_add_difference Aligned_Ptr

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_as_while do_while_unroll for_as_while for_unroll

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r n2b a2b Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data

comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of hang_result, which is trivially true. This completes the proof of spec07. Q.E.D.

C.42.20 Cpp_Examples.N_TCC1

Terse proof for N_TCC1.

N_TCC1:

{1} 2 ≥ 0 ∧ range(int)(2)

Installing automatic rewrites from: int_binary Trying repeated skolemization, instantiation, and if-lifting, we get 2 subgoals:

N_TCC1.1:

{1} 2 ≤ max(range_int)

Using lemma max_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of N_TCC1.1.

N_TCC1.2:

{1} min(range_int) ≤ 2

Using lemma min_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of N_TCC1.2. Q.E.D.

C.42.21 Cpp_Examples.range_int_values_TCC1

Terse proof for range_int_values_TCC1.

range_int_values_TCC1:

{1} ∀ (i: int): −32767 ≤ i ∧ i ≤ 32767 ⊃ Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Applying propositional simplification, we get 2 subgoals:

range_int_values_TCC1.1:

{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_int_values_TCC1.1.

range_int_values_TCC1.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_int_values_TCC1.2. Q.E.D.

C.42.22 Cpp_Examples.range_int_values

Terse proof for range_int_values.
range_int_values:

{1} ∀ (i: int): −32767 ≤ i ∧ i ≤ 32767 ⊃ range(int)(i)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using int_binary, matching in *, Using lemma max_int, Using lemma min_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_int_values. Q.E.D.

C.42.23 Cpp_Examples.spec08_TCC1

Terse proof for spec08_TCC1.

spec08_TCC1:

{1} plain_memory?(pm) ⊃ Cpp_Type?(int) ∧ v(non_bool_integral?)(int)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

spec08_TCC1.1:

{-1} plain_memory?(pm)
{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec08_TCC1.1.

spec08_TCC1.2:

{-1} plain_memory?(pm)
{1} v(non_bool_integral?)(int)

Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of spec08_TCC1.2. Q.E.D.

C.42.24 Cpp_Examples.spec08

Terse proof for spec08.

spec08:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt(int))(id(n), literal(0))) ## e2s(assign(pm, dt(int))(id(m), literal(0))) ## while(N + 1, lt(int)(l2r(pm, dt(int))(id(n)), literal(N)),

e2s(postinc(pm, int)(id(n))) ## e2s(postinc(pm, int)(id(m)))),

λ (s: State):

OK?(read_data(pm, dt(int))(m)(s)) ⊃ data(read_data(pm, dt(int))(m)(s)) = N)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok!

stmt_while_inv_rewrite_data_break!  stmt_while_inv_rewrite_data_return!  pm_q_prop_while!

pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: N

Installing automatic rewrites from: range_int_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of spec08.

Q.E.D.

C.42.25 Cpp_Examples.spec09

Terse proof for spec09.

  spec09:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION, e2s(assign(pm, dt(int))(id(m), literal(0))) ## for(N + 1, e2s(assign(pm, dt(int))(id(n), literal(0))), lt(int)(l2r(pm, dt(int))(id(n)), literal(N)), postinc(pm, int)(id(n)), e2s(postinc(pm, int)(id(m)))),

λ (s: State):

OK?(read_data(pm, dt(int))(m)(s)) ⊃ data(read_data(pm, dt(int))(m)(s)) = N)

Installing automatic rewrites from: valid Valid PRECONDITION POSTCONDITION

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: address_of_spec address_of_spec2 add_simplification add_spec add_spec2 same_array_spec same_array_spec2 mod_range size_of uidt check_bounds_spec er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state

ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data

comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point? Installing automatic rewrites from: N Installing automatic rewrites from: range_int_values Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of spec09. Q.E.D.

C.42.26 Cpp_Examples.spec10_TCC1

Terse proof for spec10_TCC1.

spec10_TCC1:

{1} plain_memory?(pm) ⊃

(∀ (s_{0}: State, res: StmtResult[State]): OK?(res) ⊃ OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res))

Repeatedly Skolemizing and flattening, This completes the proof of spec10_TCC1. Q.E.D.

C.42.27 Cpp_Examples.spec10

Terse proof for spec10.

C.43 Proofs for Cpp_Integral_Types (types.pvs)

spec10:

{1} plain_memory?(pm) ⊃

valid(PRECONDITION,

for(e2s(assign(pm, dt(int))(id(n), literal(0))), lt(int)(l2r(pm, dt(int))(id(n)), literal(N)), postinc(pm, int)(id(n)), skip)

((λ (s_{0}: State):

λ (res: StmtResult[State]): OK?(res) ∧ OK?(read_data(pm, dt(int))(n)(state(res))) ∧ 0 ≤ data(read_data(pm, dt(int))(n)(state(res))) ∧ data(read_data(pm, dt(int))(n)(state(res))) < N),

(λ (s_{0}: State):

λ (res: StmtResult[State]): OK?(res) ∧ OK?(read_data(pm, dt(int))(n)(state(res))) ∧ data(read_data(pm, dt(int))(n)(state(res))) = N),

(λ (s_{0}: State):

λ (res: StmtResult[State]): OK?(res) ∧ OK?(read_data(pm, dt(int))(n)(state(res))) ∧ data(read_data(pm, dt(int))(n)(state(res))) ≤ N),

(λ (s_{0}: State):

λ (s: State):

if OK?(read_data(pm, dt(int))(n)(s)) ∧

data(read_data(pm, dt(int))(n)(s)) ≤ N then N − data(read_data(pm, dt(int))(n)(s))

else N endif),

extend[[numfield, numfield], [int, int], bool, false]

(λ (i, j: int): i < j)),

λ (s: State):

OK?(read_data(pm, dt(int))(n)(s)) ⊃ data(read_data(pm, dt(int))(n)(s)) = N)

This completes the proof of spec10.

C.43 Proofs for Cpp_Integral_Types (types.pvs)

C.43.1 Cpp_Integral_Types.range_integral_TCC1

Terse proof for range_integral_TCC1.
range_integral_TCC1:

{1} ∀ (typ: (non_bool_integral?)): typ = uchar ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_uchar))

Repeatedly Skolemizing and flattening, Adding type constraints for range_uchar, Keeping (-4 1) and hiding *, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC1. Q.E.D.

C.43.2 Cpp_Integral_Types.range_integral_TCC2

Terse proof for range_integral_TCC2.
range_integral_TCC2:

{1} ∀ (typ: (non_bool_integral?)): typ = ushort ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_ushort))

Repeatedly Skolemizing and flattening, Adding type constraints for range_ushort, Keeping (-4 1) and hiding *, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC2. Q.E.D.

C.43.3 Cpp_Integral_Types.range_integral_TCC3

Terse proof for range_integral_TCC3.
range_integral_TCC3:

{1} ∀ (typ: (non_bool_integral?)): typ = uint ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_uint))

Repeatedly Skolemizing and flattening, Adding type constraints for range_uint, Keeping (-4 1) and hiding *, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC3. Q.E.D.

C.43.4 Cpp_Integral_Types.range_integral_TCC4

Terse proof for range_integral_TCC4.
range_integral_TCC4:

{1} ∀ (typ: (non_bool_integral?)): typ = ulong ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_ulong))

Repeatedly Skolemizing and flattening, Adding type constraints for range_ulong, Keeping (-4 1) and hiding *, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC4. Q.E.D.

C.43.5 Cpp_Integral_Types.range_integral_TCC5

Terse proof for range_integral_TCC5.
range_integral_TCC5:

{1} ∀ (typ: (non_bool_integral?)): typ = ulonglong ⊃ ¬ empty?[int](extend[int, nat, bool, false](range_ulonglong))

Repeatedly Skolemizing and flattening, Adding type constraints for range_ulonglong, Keeping (-4 1) and hiding *, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_integral_TCC5. Q.E.D.

C.43.6 Cpp_Integral_Types.range_integral_TCC6

Terse proof for range_integral_TCC6.
range_integral_TCC6:

{1} ∀ (typ: (non_bool_integral?)): ¬ (bool?(typ) ∨

float?(typ) ∨ double?(typ) ∨ longdouble?(typ) ∨ void?(typ) ∨ array?(typ) ∨ function?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ class?(typ) ∨ union?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of non_bool_integral?, Expanding the definition of signed_integer?, Expanding the definition of unsigned_integer?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_integral_TCC6. Q.E.D.

C.43.7 Cpp_Integral_Types.range_floating_point_TCC1

Terse proof for range_floating_point_TCC1.
range_floating_point_TCC1:

{1} ∀ (typ: (floating_point?)): ¬ (uchar?(typ) ∨

schar?(typ) ∨ char?(typ) ∨ short?(typ) ∨ int?(typ) ∨ long?(typ) ∨ longlong?(typ) ∨ ushort?(typ) ∨ uint?(typ) ∨ ulong?(typ) ∨ ulonglong?(typ) ∨ wchar_t?(typ) ∨ bool?(typ) ∨ void?(typ) ∨ array?(typ) ∨ function?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ class?(typ) ∨ union?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ) ∨ const?(typ) ∨ volatile?(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of floating_point?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of range_floating_point_TCC1.

Q.E.D.

C.43.8 Cpp_Integral_Types.dt_integral_TCC1

Terse proof for dt_integral_TCC1.
dt_integral_TCC1:

{1} ∀ (typ: (non_bool_integral?)): typ = uchar ⊃ (∀ (x: int): x ≥ 0 ∧ (range_uchar)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_uchar)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_uchar)]((range_integral(typ)))(dt_uchar`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_uchar)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_integral_TCC1.1:

{-1} non_bool_integral?(uchar)
{-2} uchar?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_uchar)

Adding type constraints for dt_uchar, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC1.1.1:

{-1} uninterpreted_data_type?(dt_uchar`uidt)

{-2} ∀ (d: ((range_uchar)), a: Address):

valid?(uidt(dt_uchar))(to_byte(dt_uchar)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_uchar))(l, a) ≡ up?(from_byte(dt_uchar)(l, a))

{-4} ∀ (d: ((range_uchar)), a: Address):

down(from_byte(dt_uchar)(to_byte(dt_uchar)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_uchar))(l, a_{1}) ≡ valid?(uidt(dt_uchar))(l, a_{2})

{-6} size(uidt(dt_uchar)) > 0
{-7} non_bool_integral?(uchar)
{-8} uchar?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_uchar))(to_byte(dt_uchar)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC1.1.1.

dt_integral_TCC1.1.2:

{-1} uninterpreted_data_type?(dt_uchar`uidt)

{-2} ∀ (d: ((range_uchar)), a: Address):

valid?(uidt(dt_uchar))(to_byte(dt_uchar)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_uchar))(l, a) ≡ up?(from_byte(dt_uchar)(l, a))

{-4} ∀ (d: ((range_uchar)), a: Address):

down(from_byte(dt_uchar)(to_byte(dt_uchar)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_uchar))(l, a_{1}) ≡ valid?(uidt(dt_uchar))(l, a_{2})

{-6} size(uidt(dt_uchar)) > 0
{-7} non_bool_integral?(uchar)
{-8} uchar?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_uchar)(to_byte(dt_uchar)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC1.1.2.

dt_integral_TCC1.2:

{-1} non_bool_integral?(uchar)
{-2} uchar?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_uchar)]((range_integral(uchar)))(dt_uchar`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC1.2.

dt_integral_TCC1.3:

{-1} non_bool_integral?(uchar)
{-2} uchar?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_uchar)(x) ≡ if x ≥ 0 then range_uchar(x) else false endif

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC1.3. Q.E.D.

C.43.9 Cpp_Integral_Types.dt_integral_TCC2

Terse proof for dt_integral_TCC2.

dt_integral_TCC2:

{1} ∀ (typ: (non_bool_integral?)):

typ = schar ⊃ (∀ (x: int): (range_schar)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_schar)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_schar)]((range_integral(typ)))(dt_schar`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_schar)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_integral_TCC2.1:

{-1} non_bool_integral?(schar)
{-2} schar?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_schar)

Adding type constraints for dt_schar, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC2.1.1:

{-1} uninterpreted_data_type?(dt_schar`uidt)

{-2} ∀ (d: ((range_schar)), a: Address):

valid?(uidt(dt_schar))(to_byte(dt_schar)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_schar))(l, a) ≡ up?(from_byte(dt_schar)(l, a))

{-4} ∀ (d: ((range_schar)), a: Address):

down(from_byte(dt_schar)(to_byte(dt_schar)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_schar))(l, a_{1}) ≡ valid?(uidt(dt_schar))(l, a_{2})

{-6} size(uidt(dt_schar)) > 0
{-7} non_bool_integral?(schar)
{-8} schar?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_schar))(to_byte(dt_schar)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC2.1.1.

dt_integral_TCC2.1.2:

{-1} uninterpreted_data_type?(dt_schar`uidt)

{-2} ∀ (d: ((range_schar)), a: Address):

valid?(uidt(dt_schar))(to_byte(dt_schar)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_schar))(l, a) ≡ up?(from_byte(dt_schar)(l, a))

{-4} ∀ (d: ((range_schar)), a: Address):

down(from_byte(dt_schar)(to_byte(dt_schar)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_schar))(l, a_{1}) ≡ valid?(uidt(dt_schar))(l, a_{2})

{-6} size(uidt(dt_schar)) > 0
{-7} non_bool_integral?(schar)
{-8} schar?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_schar)(to_byte(dt_schar)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC2.1.2.

dt_integral_TCC2.2:

{-1} non_bool_integral?(schar)
{-2} schar?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_schar)]((range_integral(schar)))(dt_schar`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC2.2. Q.E.D.

C.43.10 Cpp_Integral_Types.dt_integral_TCC3

Terse proof for dt_integral_TCC3.
dt_integral_TCC3:

{1} ∀ (typ: (non_bool_integral?)):

typ = char ⊃ (∀ (x: int): (range_char)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_char)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_char)]((range_integral(typ)))(dt_char`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_char)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_integral_TCC3.1:

{-1} non_bool_integral?(char)
{-2} char?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_char)

Adding type constraints for dt_char, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC3.1.1:

{-1} uninterpreted_data_type?(dt_char`uidt)

{-2} ∀ (d: ((range_char)), a: Address):

valid?(uidt(dt_char))(to_byte(dt_char)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_char))(l, a) ≡ up?(from_byte(dt_char)(l, a))

{-4} ∀ (d: ((range_char)), a: Address):

down(from_byte(dt_char)(to_byte(dt_char)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_char))(l, a_{1}) ≡ valid?(uidt(dt_char))(l, a_{2})

{-6} size(uidt(dt_char)) > 0
{-7} non_bool_integral?(char)
{-8} char?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_char))(to_byte(dt_char)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC3.1.1.

dt_integral_TCC3.1.2:

{-1} uninterpreted_data_type?(dt_char`uidt)

{-2} ∀ (d: ((range_char)), a: Address):

valid?(uidt(dt_char))(to_byte(dt_char)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_char))(l, a) ≡ up?(from_byte(dt_char)(l, a))

{-4} ∀ (d: ((range_char)), a: Address):

down(from_byte(dt_char)(to_byte(dt_char)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_char))(l, a_{1}) ≡ valid?(uidt(dt_char))(l, a_{2})

{-6} size(uidt(dt_char)) > 0
{-7} non_bool_integral?(char)
{-8} char?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_char)(to_byte(dt_char)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC3.1.2.

dt_integral_TCC3.2:

{-1} non_bool_integral?(char)
{-2} char?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_char)]((range_integral(char)))(dt_char`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC3.2. Q.E.D.

C.43.11 Cpp_Integral_Types.dt_integral_TCC4

Terse proof for dt_integral_TCC4.
dt_integral_TCC4:

{1} ∀ (typ: (non_bool_integral?)): typ = short ⊃ (∀ (x: int): (range_short)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_short)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_short)]((range_integral(typ)))(dt_short`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_short)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_integral_TCC4.1:

{-1} non_bool_integral?(short)
{-2} short?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_short)

Adding type constraints for dt_short, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC4.1.1:

{-1} uninterpreted_data_type?(dt_short`uidt)

{-2} ∀ (d: ((range_short)), a: Address):

valid?(uidt(dt_short))(to_byte(dt_short)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_short))(l, a) ≡ up?(from_byte(dt_short)(l, a))

{-4} ∀ (d: ((range_short)), a: Address):

down(from_byte(dt_short)(to_byte(dt_short)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_short))(l, a_{1}) ≡ valid?(uidt(dt_short))(l, a_{2})

{-6} size(uidt(dt_short)) > 0
{-7} non_bool_integral?(short)
{-8} short?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_short))(to_byte(dt_short)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC4.1.1.

dt_integral_TCC4.1.2:

{-1} uninterpreted_data_type?(dt_short`uidt)

{-2} ∀ (d: ((range_short)), a: Address):

valid?(uidt(dt_short))(to_byte(dt_short)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_short))(l, a) ≡ up?(from_byte(dt_short)(l, a))

{-4} ∀ (d: ((range_short)), a: Address):

down(from_byte(dt_short)(to_byte(dt_short)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_short))(l, a_{1}) ≡ valid?(uidt(dt_short))(l, a_{2})

{-6} size(uidt(dt_short)) > 0
{-7} non_bool_integral?(short)
{-8} short?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_short)(to_byte(dt_short)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC4.1.2.

dt_integral_TCC4.2:

{-1} non_bool_integral?(short)
{-2} short?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_short)]((range_integral(short)))(dt_short`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC4.2. Q.E.D.

C.43.12 Cpp_Integral_Types.dt_integral_TCC5

Terse proof for dt_integral_TCC5.
dt_integral_TCC5:

{1} ∀ (typ: (non_bool_integral?)):

typ = int ⊃ (∀ (x: int): (range_int)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_int)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_int)]((range_integral(typ)))(dt_int`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_int)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_integral_TCC5.1:

{-1} non_bool_integral?(int)
{-2} int?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_int)

Adding type constraints for dt_int, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC5.1.1:

{-1} uninterpreted_data_type?(dt_int`uidt)

{-2} ∀ (d: ((range_int)), a: Address):

valid?(uidt(dt_int))(to_byte(dt_int)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_int))(l, a) ≡ up?(from_byte(dt_int)(l, a))

{-4} ∀ (d: ((range_int)), a: Address):

down(from_byte(dt_int)(to_byte(dt_int)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_int))(l, a_{1}) ≡ valid?(uidt(dt_int))(l, a_{2})

{-6} size(uidt(dt_int)) > 0
{-7} non_bool_integral?(int)
{-8} int?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_int))(to_byte(dt_int)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true.

This completes the proof of dt_integral_TCC5.1.1.

dt_integral_TCC5.1.2:

{-1} uninterpreted_data_type?(dt_int`uidt)

{-2} ∀ (d: ((range_int)), a: Address):

valid?(uidt(dt_int))(to_byte(dt_int)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_int))(l, a) ≡ up?(from_byte(dt_int)(l, a))

{-4} ∀ (d: ((range_int)), a: Address):

down(from_byte(dt_int)(to_byte(dt_int)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_int))(l, a_{1}) ≡ valid?(uidt(dt_int))(l, a_{2})

{-6} size(uidt(dt_int)) > 0
{-7} non_bool_integral?(int)
{-8} int?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_int)(to_byte(dt_int)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC5.1.2.

dt_integral_TCC5.2:

{-1} non_bool_integral?(int)
{-2} int?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_int)]((range_integral(int)))(dt_int`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC5.2. Q.E.D.

C.43.13 Cpp_Integral_Types.dt_integral_TCC6

Terse proof for dt_integral_TCC6.
dt_integral_TCC6:

{1} ∀ (typ: (non_bool_integral?)):

typ = long ⊃ (∀ (x: int): (range_long)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_long)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_long)]((range_integral(typ)))(dt_long`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_long)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_integral_TCC6.1:

{-1} non_bool_integral?(long)
{-2} long?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_long)

Adding type constraints for dt_long, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC6.1.1:

{-1} uninterpreted_data_type?(dt_long`uidt)

{-2} ∀ (d: ((range_long)), a: Address):

valid?(uidt(dt_long))(to_byte(dt_long)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_long))(l, a) ≡ up?(from_byte(dt_long)(l, a))

{-4} ∀ (d: ((range_long)), a: Address):

down(from_byte(dt_long)(to_byte(dt_long)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_long))(l, a_{1}) ≡ valid?(uidt(dt_long))(l, a_{2})

{-6} size(uidt(dt_long)) > 0
{-7} non_bool_integral?(long)
{-8} long?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_long))(to_byte(dt_long)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC6.1.1.

dt_integral_TCC6.1.2:

{-1} uninterpreted_data_type?(dt_long`uidt)

{-2} ∀ (d: ((range_long)), a: Address):

valid?(uidt(dt_long))(to_byte(dt_long)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_long))(l, a) ≡ up?(from_byte(dt_long)(l, a))

{-4} ∀ (d: ((range_long)), a: Address):

down(from_byte(dt_long)(to_byte(dt_long)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_long))(l, a_{1}) ≡ valid?(uidt(dt_long))(l, a_{2})

{-6} size(uidt(dt_long)) > 0
{-7} non_bool_integral?(long)
{-8} long?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_long)(to_byte(dt_long)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC6.1.2.

dt_integral_TCC6.2:

{-1} non_bool_integral?(long)
{-2} long?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_long)]((range_integral(long)))(dt_long`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC6.2. Q.E.D.

C.43.14 Cpp_Integral_Types.dt_integral_TCC7

Terse proof for dt_integral_TCC7.
dt_integral_TCC7:

{1} ∀ (typ: (non_bool_integral?)): typ = longlong ⊃ (∀ (x: int): (range_longlong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_longlong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_longlong)]((range_integral(typ)))(dt_longlong`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_longlong)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_integral_TCC7.1:

{-1} non_bool_integral?(longlong)
{-2} longlong?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_longlong)

Adding type constraints for dt_longlong, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC7.1.1:

{-1} uninterpreted_data_type?(dt_longlong`uidt)

{-2} ∀ (d: ((range_longlong)), a: Address):

valid?(uidt(dt_longlong))(to_byte(dt_longlong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_longlong))(l, a) ≡ up?(from_byte(dt_longlong)(l, a))

{-4} ∀ (d: ((range_longlong)), a: Address):

down(from_byte(dt_longlong)(to_byte(dt_longlong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_longlong))(l, a_{1}) ≡ valid?(uidt(dt_longlong))(l, a_{2})

{-6} size(uidt(dt_longlong)) > 0
{-7} non_bool_integral?(longlong)
{-8} longlong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_longlong))(to_byte(dt_longlong)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC7.1.1.

dt_integral_TCC7.1.2:

{-1} uninterpreted_data_type?(dt_longlong`uidt)

{-2} ∀ (d: ((range_longlong)), a: Address):

valid?(uidt(dt_longlong))(to_byte(dt_longlong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_longlong))(l, a) ≡ up?(from_byte(dt_longlong)(l, a))

{-4} ∀ (d: ((range_longlong)), a: Address):

down(from_byte(dt_longlong)(to_byte(dt_longlong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_longlong))(l, a_{1}) ≡ valid?(uidt(dt_longlong))(l, a_{2})

{-6} size(uidt(dt_longlong)) > 0
{-7} non_bool_integral?(longlong)
{-8} longlong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_longlong)(to_byte(dt_longlong)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC7.1.2.

dt_integral_TCC7.2:

{-1} non_bool_integral?(longlong)
{-2} longlong?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_longlong)]((range_integral(longlong)))(dt_longlong`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC7.2. Q.E.D.

C.43.15 Cpp_Integral_Types.dt_integral_TCC8

Terse proof for dt_integral_TCC8.
dt_integral_TCC8:

{1} ∀ (typ: (non_bool_integral?)): typ = ushort ⊃ (∀ (x: int): x ≥ 0 ∧ (range_ushort)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_ushort)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_ushort)]((range_integral(typ)))(dt_ushort`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_ushort)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_integral_TCC8.1:

{-1} non_bool_integral?(ushort)
{-2} ushort?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_ushort)

Adding type constraints for dt_ushort, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC8.1.1:

{-1} uninterpreted_data_type?(dt_ushort`uidt)

{-2} ∀ (d: ((range_ushort)), a: Address):

valid?(uidt(dt_ushort))(to_byte(dt_ushort)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ushort))(l, a) ≡ up?(from_byte(dt_ushort)(l, a))

{-4} ∀ (d: ((range_ushort)), a: Address):

down(from_byte(dt_ushort)(to_byte(dt_ushort)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ushort))(l, a_{1}) ≡ valid?(uidt(dt_ushort))(l, a_{2})

{-6} size(uidt(dt_ushort)) > 0
{-7} non_bool_integral?(ushort)
{-8} ushort?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_ushort))(to_byte(dt_ushort)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC8.1.1.

dt_integral_TCC8.1.2:

{-1} uninterpreted_data_type?(dt_ushort`uidt)

{-2} ∀ (d: ((range_ushort)), a: Address):

valid?(uidt(dt_ushort))(to_byte(dt_ushort)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ushort))(l, a) ≡ up?(from_byte(dt_ushort)(l, a))

{-4} ∀ (d: ((range_ushort)), a: Address):

down(from_byte(dt_ushort)(to_byte(dt_ushort)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ushort))(l, a_{1}) ≡ valid?(uidt(dt_ushort))(l, a_{2})

{-6} size(uidt(dt_ushort)) > 0
{-7} non_bool_integral?(ushort)
{-8} ushort?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_ushort)(to_byte(dt_ushort)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC8.1.2.

dt_integral_TCC8.2:

{-1} non_bool_integral?(ushort)
{-2} ushort?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_ushort)]((range_integral(ushort)))(dt_ushort`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC8.2.

dt_integral_TCC8.3:

{-1} non_bool_integral?(ushort)
{-2} ushort?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_ushort)(x) ≡ if x ≥ 0 then range_ushort(x) else false endif

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC8.3. Q.E.D.

C.43.16 Cpp_Integral_Types.dt_integral_TCC9

Terse proof for dt_integral_TCC9.

dt_integral_TCC9:

{1} ∀ (typ: (non_bool_integral?)):

typ = uint ⊃ (∀ (x: int): x ≥ 0 ∧ (range_uint)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_uint)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_uint)]((range_integral(typ)))(dt_uint`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_uint)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_integral_TCC9.1:

{-1} non_bool_integral?(uint)
{-2} uint?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_uint)

Adding type constraints for dt_uint, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC9.1.1:

{-1} uninterpreted_data_type?(dt_uint`uidt)

{-2} ∀ (d: ((range_uint)), a: Address):

valid?(uidt(dt_uint))(to_byte(dt_uint)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_uint))(l, a) ≡ up?(from_byte(dt_uint)(l, a))

{-4} ∀ (d: ((range_uint)), a: Address):

down(from_byte(dt_uint)(to_byte(dt_uint)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_uint))(l, a_{1}) ≡ valid?(uidt(dt_uint))(l, a_{2})

{-6} size(uidt(dt_uint)) > 0
{-7} non_bool_integral?(uint)
{-8} uint?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_uint))(to_byte(dt_uint)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC9.1.1.

dt_integral_TCC9.1.2:

{-1} uninterpreted_data_type?(dt_uint`uidt)

{-2} ∀ (d: ((range_uint)), a: Address):

valid?(uidt(dt_uint))(to_byte(dt_uint)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_uint))(l, a) ≡ up?(from_byte(dt_uint)(l, a))

{-4} ∀ (d: ((range_uint)), a: Address):

down(from_byte(dt_uint)(to_byte(dt_uint)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_uint))(l, a_{1}) ≡ valid?(uidt(dt_uint))(l, a_{2})

{-6} size(uidt(dt_uint)) > 0
{-7} non_bool_integral?(uint)
{-8} uint?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_uint)(to_byte(dt_uint)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC9.1.2.

dt_integral_TCC9.2:

{-1} non_bool_integral?(uint)
{-2} uint?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_uint)]((range_integral(uint)))(dt_uint`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC9.2.

dt_integral_TCC9.3:

{-1} non_bool_integral?(uint)
{-2} uint?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_uint)(x) ≡ if x ≥ 0 then range_uint(x) else false endif

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC9.3. Q.E.D.

C.43.17 Cpp_Integral_Types.dt_integral_TCC10

Terse proof for dt_integral_TCC10.

dt_integral_TCC10:

{1} ∀ (typ: (non_bool_integral?)):

typ = ulong ⊃ (∀ (x: int): x ≥ 0 ∧ (range_ulong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_ulong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_ulong)]((range_integral(typ)))(dt_ulong`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_ulong)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_integral_TCC10.1:

{-1} non_bool_integral?(ulong)
{-2} ulong?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_ulong)

Adding type constraints for dt_ulong, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC10.1.1:

{-1} uninterpreted_data_type?(dt_ulong`uidt)

{-2} ∀ (d: ((range_ulong)), a: Address):

valid?(uidt(dt_ulong))(to_byte(dt_ulong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ulong))(l, a) ≡ up?(from_byte(dt_ulong)(l, a))

{-4} ∀ (d: ((range_ulong)), a: Address):

down(from_byte(dt_ulong)(to_byte(dt_ulong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ulong))(l, a_{1}) ≡ valid?(uidt(dt_ulong))(l, a_{2})

{-6} size(uidt(dt_ulong)) > 0
{-7} non_bool_integral?(ulong)
{-8} ulong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): valid?(uidt(dt_ulong))(to_byte(dt_ulong)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC10.1.1.

dt_integral_TCC10.1.2:

{-1} uninterpreted_data_type?(dt_ulong`uidt)

{-2} ∀ (d: ((range_ulong)), a: Address):

valid?(uidt(dt_ulong))(to_byte(dt_ulong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ulong))(l, a) ≡ up?(from_byte(dt_ulong)(l, a))

{-4} ∀ (d: ((range_ulong)), a: Address):

down(from_byte(dt_ulong)(to_byte(dt_ulong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ulong))(l, a_{1}) ≡ valid?(uidt(dt_ulong))(l, a_{2})

{-6} size(uidt(dt_ulong)) > 0
{-7} non_bool_integral?(ulong)
{-8} ulong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_ulong)(to_byte(dt_ulong)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC10.1.2.

dt_integral_TCC10.2:

{-1} non_bool_integral?(ulong)
{-2} ulong?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_ulong)]((range_integral(ulong)))(dt_ulong`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC10.2.

dt_integral_TCC10.3:

{-1} non_bool_integral?(ulong)
{-2} ulong?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_ulong)(x) ≡ if x ≥ 0 then range_ulong(x) else false endif

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC10.3. Q.E.D.

C.43.18 Cpp_Integral_Types.dt_integral_TCC11

Terse proof for dt_integral_TCC11.

dt_integral_TCC11:

{1} ∀ (typ: (non_bool_integral?)): typ = ulonglong ⊃ (∀ (x: int): x ≥ 0 ∧ (range_ulonglong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): x ≥ 0 ∧ (range_ulonglong)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_ulonglong)]

((range_integral(typ)))(dt_ulonglong`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_ulonglong)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_integral_TCC11.1:

{-1} non_bool_integral?(ulonglong)
{-2} ulonglong?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_ulonglong)

Adding type constraints for dt_ulonglong, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC11.1.1:

{-1} uninterpreted_data_type?(dt_ulonglong`uidt)

{-2} ∀ (d: ((range_ulonglong)), a: Address):

valid?(uidt(dt_ulonglong))(to_byte(dt_ulonglong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ulonglong))(l, a) ≡ up?(from_byte(dt_ulonglong)(l, a))

{-4} ∀ (d: ((range_ulonglong)), a: Address):

down(from_byte(dt_ulonglong)(to_byte(dt_ulonglong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ulonglong))(l, a_{1}) ≡ valid?(uidt(dt_ulonglong))(l, a_{2})

{-6} size(uidt(dt_ulonglong)) > 0
{-7} non_bool_integral?(ulonglong)
{-8} ulonglong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_ulonglong))(to_byte(dt_ulonglong)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC11.1.1.

dt_integral_TCC11.1.2:

{-1} uninterpreted_data_type?(dt_ulonglong`uidt)

{-2} ∀ (d: ((range_ulonglong)), a: Address):

valid?(uidt(dt_ulonglong))(to_byte(dt_ulonglong)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_ulonglong))(l, a) ≡ up?(from_byte(dt_ulonglong)(l, a))

{-4} ∀ (d: ((range_ulonglong)), a: Address):

down(from_byte(dt_ulonglong)(to_byte(dt_ulonglong)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_ulonglong))(l, a_{1}) ≡ valid?(uidt(dt_ulonglong))(l, a_{2})

{-6} size(uidt(dt_ulonglong)) > 0
{-7} non_bool_integral?(ulonglong)
{-8} ulonglong?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_ulonglong)(to_byte(dt_ulonglong)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC11.1.2.

dt_integral_TCC11.2:

{-1} non_bool_integral?(ulonglong)
{-2} ulonglong?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_ulonglong)]((range_integral(ulonglong)))(dt_ulonglong`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of extend, which is trivially true. This completes the proof of dt_integral_TCC11.2.

dt_integral_TCC11.3:

{-1} non_bool_integral?(ulonglong)
{-2} ulonglong?(typ′)
{1} ∀ (x: int):

x ≥ 0 ∧ (range_ulonglong)(x) ≡ if x ≥ 0 then range_ulonglong(x) else false endif

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC11.3. Q.E.D.

C.43.19 Cpp_Integral_Types.dt_integral_TCC12

Terse proof for dt_integral_TCC12.

dt_integral_TCC12:

{1} ∀ (typ: (non_bool_integral?)): typ = wchar_t ⊃ (∀ (x: int): (range_wchar_t)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x: int): (range_wchar_t)(x) ≡ range_integral(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_wchar_t)]((range_integral(typ)))(dt_wchar_t`from_byte(x_{1}))) ∧ pod_data_type?[(range_integral(typ))](dt_wchar_t)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_integral_TCC12.1:

{-1} non_bool_integral?(wchar_t)
{-2} wchar_t?(typ′)
{1} pod_data_type?[((range_integral(typ′)))](dt_wchar_t)

Adding type constraints for dt_wchar_t, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_integral_TCC12.1.1:

{-1} uninterpreted_data_type?(dt_wchar_t`uidt)

{-2} ∀ (d: ((range_wchar_t)), a: Address):

valid?(uidt(dt_wchar_t))(to_byte(dt_wchar_t)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_wchar_t))(l, a) ≡ up?(from_byte(dt_wchar_t)(l, a))

{-4} ∀ (d: ((range_wchar_t)), a: Address):

down(from_byte(dt_wchar_t)(to_byte(dt_wchar_t)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_wchar_t))(l, a_{1}) ≡ valid?(uidt(dt_wchar_t))(l, a_{2})

{-6} size(uidt(dt_wchar_t)) > 0
{-7} non_bool_integral?(wchar_t)
{-8} wchar_t?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_wchar_t))(to_byte(dt_wchar_t)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC12.1.1.

dt_integral_TCC12.1.2:

{-1} uninterpreted_data_type?(dt_wchar_t`uidt)

{-2} ∀ (d: ((range_wchar_t)), a: Address):

valid?(uidt(dt_wchar_t))(to_byte(dt_wchar_t)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_wchar_t))(l, a) ≡ up?(from_byte(dt_wchar_t)(l, a))

{-4} ∀ (d: ((range_wchar_t)), a: Address):

down(from_byte(dt_wchar_t)(to_byte(dt_wchar_t)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_wchar_t))(l, a_{1}) ≡ valid?(uidt(dt_wchar_t))(l, a_{2})

{-6} size(uidt(dt_wchar_t)) > 0
{-7} non_bool_integral?(wchar_t)
{-8} wchar_t?(typ′)

{1} ∀ (d: ((range_integral(typ′))), a: Address): down(from_byte(dt_wchar_t)(to_byte(dt_wchar_t)(d, a), a)) = d

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_integral, which is trivially true. This completes the proof of dt_integral_TCC12.1.2.

dt_integral_TCC12.2:

{-1} non_bool_integral?(wchar_t)
{-2} wchar_t?(typ′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_wchar_t)]((range_integral(wchar_t)))(dt_wchar_t`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of range_integral, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_integral_TCC12.2. Q.E.D.

C.43.20 Cpp_Integral_Types.dt_floating_point_TCC1

Terse proof for dt_floating_point_TCC1.
dt_floating_point_TCC1:

{1} ∀ (typ: (floating_point?)): typ = float ⊃ (∀ (x: extended_real): (range_float)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x: extended_real): (range_float)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[(range_float)]((range_floating_point(typ)))(dt_float`from_byte(x_{1}))) ∧ pod_data_type?[(range_floating_point(typ))](dt_float)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_floating_point, Applying propositional simplification, we get 2 subgoals:

dt_floating_point_TCC1.1:

{-1} floating_point?(float)
{-2} typ′ = float
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_float)]((range_floating_point(float)))(dt_float`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range_floating_point, which is trivially true.

This completes the proof of dt_floating_point_TCC1.1.
dt_floating_point_TCC1.2:

{-1} floating_point?(float)
{-2} typ′ = float
{1} pod_data_type?[((range_floating_point(typ′)))](dt_float)

Adding type constraints for dt_float, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_floating_point_TCC1.2.1:

{-1} uninterpreted_data_type?(dt_float`uidt)

{-2} ∀ (d: ((range_float)), a: Address):

valid?(uidt(dt_float))(to_byte(dt_float)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_float))(l, a) ≡ up?(from_byte(dt_float)(l, a))

{-4} ∀ (d: ((range_float)), a: Address):

down(from_byte(dt_float)(to_byte(dt_float)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_float))(l, a_{1}) ≡ valid?(uidt(dt_float))(l, a_{2})

{-6} size(uidt(dt_float)) > 0
{-7} floating_point?(float)
{-8} typ′ = float

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): valid?(uidt(dt_float))(to_byte(dt_float)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_floating_point, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_floating_point_TCC1.2.1.

dt_floating_point_TCC1.2.2:

{-1} uninterpreted_data_type?(dt_float`uidt)

{-2} ∀ (d: ((range_float)), a: Address):

valid?(uidt(dt_float))(to_byte(dt_float)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_float))(l, a) ≡ up?(from_byte(dt_float)(l, a))

{-4} ∀ (d: ((range_float)), a: Address):

down(from_byte(dt_float)(to_byte(dt_float)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_float))(l, a_{1}) ≡ valid?(uidt(dt_float))(l, a_{2})

{-6} size(uidt(dt_float)) > 0
{-7} floating_point?(float)
{-8} typ′ = float

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): down(from_byte(dt_float)(to_byte(dt_float)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_floating_point, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_floating_point_TCC1.2.2.

Q.E.D.

C.43.21 Cpp_Integral_Types.dt_floating_point_TCC2

Terse proof for dt_floating_point_TCC2.
dt_floating_point_TCC2:

{1} ∀ (typ: (floating_point?)): typ = double ⊃ (∀ (x: extended_real): (range_double)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x: extended_real): (range_double)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_double)]

((range_floating_point(typ)))(dt_double`from_byte(x_{1}))) ∧ pod_data_type?[(range_floating_point(typ))](dt_double)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_floating_point, Applying propositional simplification, we get 2 subgoals:

dt_floating_point_TCC2.1:

{-1} floating_point?(double)
{-2} typ′ = double
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_double)]((range_floating_point(double)))(dt_double`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range_floating_point, which is trivially true.

This completes the proof of dt_floating_point_TCC2.1.
dt_floating_point_TCC2.2:

{-1} floating_point?(double)
{-2} typ′ = double
{1} pod_data_type?[((range_floating_point(typ′)))](dt_double)

Adding type constraints for dt_double, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_floating_point_TCC2.2.1:

{-1} uninterpreted_data_type?(dt_double`uidt)

{-2} ∀ (d: ((range_double)), a: Address):

valid?(uidt(dt_double))(to_byte(dt_double)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_double))(l, a) ≡ up?(from_byte(dt_double)(l, a))

{-4} ∀ (d: ((range_double)), a: Address):

down(from_byte(dt_double)(to_byte(dt_double)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_double))(l, a_{1}) ≡ valid?(uidt(dt_double))(l, a_{2})

{-6} size(uidt(dt_double)) > 0
{-7} floating_point?(double)
{-8} typ′ = double

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): valid?(uidt(dt_double))(to_byte(dt_double)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_floating_point, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_floating_point_TCC2.2.1.
dt_floating_point_TCC2.2.2:

{-1} uninterpreted_data_type?(dt_double`uidt)

{-2} ∀ (d: ((range_double)), a: Address):

valid?(uidt(dt_double))(to_byte(dt_double)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_double))(l, a) ≡ up?(from_byte(dt_double)(l, a))

{-4} ∀ (d: ((range_double)), a: Address):

down(from_byte(dt_double)(to_byte(dt_double)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_double))(l, a_{1}) ≡ valid?(uidt(dt_double))(l, a_{2})

{-6} size(uidt(dt_double)) > 0
{-7} floating_point?(double)
{-8} typ′ = double

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): down(from_byte(dt_double)(to_byte(dt_double)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_floating_point, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_floating_point_TCC2.2.2.

Q.E.D.

C.43.22 Cpp_Integral_Types.dt_floating_point_TCC3

Terse proof for dt_floating_point_TCC3.
dt_floating_point_TCC3:

{1} ∀ (typ: (floating_point?)): typ = longdouble ⊃ (∀ (x: extended_real): (range_longdouble)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x: extended_real): (range_longdouble)(x) ≡ range_floating_point(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[(range_longdouble)] ((range_floating_point(typ)))(dt_longdouble`from_byte(x_{1}))) ∧ pod_data_type?[(range_floating_point(typ))](dt_longdouble)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of range_floating_point, Applying propositional simplification, we get 2 subgoals:

dt_floating_point_TCC3.1:

{-1} floating_point?(longdouble)
{-2} typ′ = longdouble
{1} ∀ (x_{1}: [list[Byte], Address]):

every[(range_longdouble)] ((range_floating_point(longdouble)))(dt_longdouble`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range_floating_point, which is trivially true.

This completes the proof of dt_floating_point_TCC3.1.
dt_floating_point_TCC3.2:

{-1} floating_point?(longdouble)
{-2} typ′ = longdouble
{1} pod_data_type?[((range_floating_point(typ′)))](dt_longdouble)

Adding type constraints for dt_longdouble, Expanding the definition of pod_data_type?, Applying propositional simplification, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_floating_point_TCC3.2.1:

{-1} uninterpreted_data_type?(dt_longdouble`uidt)

{-2} ∀ (d: ((range_longdouble)), a: Address):

valid?(uidt(dt_longdouble))(to_byte(dt_longdouble)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_longdouble))(l, a) ≡ up?(from_byte(dt_longdouble)(l, a))

{-4} ∀ (d: ((range_longdouble)), a: Address):

down(from_byte(dt_longdouble)(to_byte(dt_longdouble)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_longdouble))(l, a_{1}) ≡ valid?(uidt(dt_longdouble))(l, a_{2})

{-6} size(uidt(dt_longdouble)) > 0
{-7} floating_point?(longdouble)
{-8} typ′ = longdouble

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): valid?(uidt(dt_longdouble))(to_byte(dt_longdouble)(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_floating_point, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_floating_point_TCC3.2.1.
dt_floating_point_TCC3.2.2:

{-1} uninterpreted_data_type?(dt_longdouble`uidt)

{-2} ∀ (d: ((range_longdouble)), a: Address):

valid?(uidt(dt_longdouble))(to_byte(dt_longdouble)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_longdouble))(l, a) ≡ up?(from_byte(dt_longdouble)(l, a))

{-4} ∀ (d: ((range_longdouble)), a: Address):

down(from_byte(dt_longdouble)(to_byte(dt_longdouble)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_longdouble))(l, a_{1}) ≡ valid?(uidt(dt_longdouble))(l, a_{2})

{-6} size(uidt(dt_longdouble)) > 0
{-7} floating_point?(longdouble)
{-8} typ′ = longdouble

{1} ∀ (d: ((range_floating_point(typ′))), a: Address): down(from_byte(dt_longdouble)(to_byte(dt_longdouble)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range_floating_point, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_floating_point_TCC3.2.2.

Q.E.D.

C.43.23 Cpp_Integral_Types.range_integral_unsigned_TCC1

Terse proof for range_integral_unsigned_TCC1.
range_integral_unsigned_TCC1:

{1} ∀ (typ: (unsigned_integer?)): non_bool_integral?(typ)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of range_integral_unsigned_TCC1.

Q.E.D.

C.43.24 Cpp_Integral_Types.range_integral_unsigned

Terse proof for range_integral_unsigned.
range_integral_unsigned:

{1} ∀ (typ: (unsigned_integer?)):

(∀ (x: int): range_integral(typ)(x) ⊃ x ≥ 0) ∧ is_finite[nat](range_integral(typ)) ∧ ¬ empty?[nat](range_integral(typ))

Repeatedly Skolemizing and flattening, Case splitting on FORALL (x: int): range_integral(typ!1)(x) IMPLIES x >= 0, we get 3 subgoals:

range_integral_unsigned.1:

{-1} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-2} unsigned_integer?(typ′)
{1} (∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0) ∧

is_finite[nat](range_integral(typ′)) ∧ ¬ empty?[nat](range_integral(typ′))

Adding type constraints for range_integral(typ!1), Applying propositional simplification, we get 2 subgoals:

range_integral_unsigned.1.1:

{-1} is_finite[int](range_integral(typ′))
{-2} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-3} unsigned_integer?(typ′)
{1} is_finite[nat](range_integral(typ′))
{2} empty?[int](range_integral(typ′))

Expanding the definition of is_finite, which is trivially true.

This completes the proof of range_integral_unsigned.1.1.
range_integral_unsigned.1.2:

{-1} empty?[nat](range_integral(typ′))
{-2} is_finite[int](range_integral(typ′))
{-3} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-4} unsigned_integer?(typ′)
{1} empty?[int](range_integral(typ′))

Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 2 subgoals:

range_integral_unsigned.1.2.1:

{-1} integer_pred(x′)
{-2} is_finite[int](range_integral(typ′))
{-3} (x′ ∈ range_integral(typ′))
{-4} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-5} unsigned_integer?(typ′)
{1} (x′ ∈ range_integral(typ′))

Expanding the definition of member, which is trivially true.

This completes the proof of range_integral_unsigned.1.2.1.
range_integral_unsigned.1.2.2:

{-1} integer_pred(x′)
{-2} is_finite[int](range_integral(typ′))
{-3} (x′ ∈ range_integral(typ′))
{-4} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{-5} unsigned_integer?(typ′)
{1} x′ ≥ 0

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of member, which is trivially true.

This completes the proof of range_integral_unsigned.1.2.2.
range_integral_unsigned.2:

{-1} unsigned_integer?(typ′)
{1} ∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0
{2} (∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0) ∧

is_finite[nat](range_integral(typ′)) ∧ ¬ empty?[nat](range_integral(typ′))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of unsigned_integer?, Expanding the definition of range_integral, Adding type constraints for range_uchar, Adding type constraints for range_ulonglong, Adding type constraints for range_ulong, Adding type constraints for range_ushort, Adding type constraints for range_uint, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of range_integral_unsigned.2.
range_integral_unsigned.3:

{-1} unsigned_integer?(typ′)
{1} non_bool_integral?(typ′)
{2} (∀ (x: int): range_integral(typ′)(x) ⊃ x ≥ 0) ∧

is_finite[nat](range_integral(typ′)) ∧ ¬ empty?[nat](range_integral(typ′))

Expanding the definition of non_bool_integral?, which is trivially true.

This completes the proof of range_integral_unsigned.3.

Q.E.D.

C.43.25 Cpp_Integral_Types.max_value_TCC1

Terse proof for max_value_TCC1.
max_value_TCC1:

{1} ∀ (typ: (non_bool_integral?)):

¬ empty?[real](extend[real, int, bool, false](range_integral(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for range_integral(typ!1), Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of max_value_TCC1. Q.E.D.

C.43.26 Cpp_Integral_Types.max_value_TCC2

Terse proof for max_value_TCC2.
max_value_TCC2:

{1} ∀ (typ: (non_bool_integral?)): rational_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ)))) ∧ integer_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ))))

Repeatedly Skolemizing and flattening, Adding type constraints for max[real, <=](extend[real, int, bool, FALSE](range_integral(typ!1))), we get 2 subgoals:

max_value_TCC2.1:

{-1} extend[real, int, bool, false] (range_integral(typ′)) (max[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

{-2} ∀ (x: real):

extend[real, int, bool, false](range_integral(typ′))(x) ⊃ x ≤ max[real, ≤](extend[real, int, bool, false](range_integral(typ′)))

{-3} non_bool_integral?(typ′)

{1} rational_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of max_value_TCC2.1.

max_value_TCC2.2:

{-1} empty?[real](extend[real, int, bool, false](range_integral(typ′)))
{-2} non_bool_integral?(typ′)

{1} rational_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

Using lemma max_value_TCC1, This completes the proof of max_value_TCC2.2. Q.E.D.

C.43.27 Cpp_Integral_Types.min_value_TCC1

Terse proof for min_value_TCC1.

min_value_TCC1:

{1} ∀ (typ: (non_bool_integral?)): rational_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ)))) ∧ integer_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ))))

Repeatedly Skolemizing and flattening, Adding type constraints for min[real, <=](extend[real, int, bool, FALSE](range_integral(typ!1))), we get 2 subgoals:

min_value_TCC1.1:

{-1} extend[real, int, bool, false] (range_integral(typ′)) (min[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

{-2} ∀ (x: real):

extend[real, int, bool, false](range_integral(typ′))(x) ⊃ min[real, ≤](extend[real, int, bool, false](range_integral(typ′))) ≤ x

{-3} non_bool_integral?(typ′)

{1} rational_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of min_value_TCC1.1.

min_value_TCC1.2:

{-1} empty?[real](extend[real, int, bool, false](range_integral(typ′)))
{-2} non_bool_integral?(typ′)

{1} rational_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

Using lemma max_value_TCC1, This completes the proof of min_value_TCC1.2. Q.E.D.

C.43.28 Cpp_Integral_Types.max_value_unsigned

Terse proof for max_value_unsigned.
max_value_unsigned:

{1} ∀ (typ: (unsigned_integer?)): max_value(typ) ≥ 0

Repeatedly Skolemizing and flattening, Expanding the definition of max_value, Using lemma range_integral_unsigned, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, we get 2 subgoals:

max_value_unsigned.1:

{-1} range_integral(typ′)(max(extend[real, int, bool, false](range_integral(typ′)))) ⊃

max(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

{-2} unsigned_integer?(typ′)
{1} empty?[nat](range_integral(typ′))
{2} max(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

Adding type constraints for max(extend[real, int, bool, FALSE](range_integral(typ!1))), Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of max_value_unsigned.1.

max_value_unsigned.2:

{-1} unsigned_integer?(typ′)

{1} rational_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(max[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

{2} empty?[nat](range_integral(typ′))
{3} max(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

Using lemma max_value_TCC2, This completes the proof of max_value_unsigned.2. Q.E.D.

C.43.29 Cpp_Integral_Types.min_value_unsigned

Terse proof for min_value_unsigned.
min_value_unsigned:

{1} ∀ (typ: (unsigned_integer?)): min_value(typ) ≥ 0

Expanding the definition of min_value, Repeatedly Skolemizing and flattening, Using lemma range_integral_unsigned, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, we get 2 subgoals:

min_value_unsigned.1:

{-1} range_integral(typ′)(min(extend[real, int, bool, false](range_integral(typ′)))) ⊃

min(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

{-2} unsigned_integer?(typ′)
{1} empty?[nat](range_integral(typ′))
{2} min(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

Adding type constraints for min(extend[real, int, bool, FALSE](range_integral(typ!1))), Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of min_value_unsigned.1.

min_value_unsigned.2:

{-1} unsigned_integer?(typ′)

{1} rational_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′)))) ∧ integer_pred(min[real, ≤](extend[real, int, bool, false](range_integral(typ′))))

{2} empty?[nat](range_integral(typ′))
{3} min(extend[real, int, bool, false](range_integral(typ′))) ≥ 0

Using lemma min_value_TCC1, This completes the proof of min_value_unsigned.2. Q.E.D.

C.43.30 Cpp_Integral_Types.max_value_bits_TCC1

Terse proof for max_value_bits_TCC1.
max_value_bits_TCC1:

{1} well_founded?(λ (x: (cv(unsigned_integer?)), y: (cv(unsigned_integer?))): restrict [[Cpp_Type_, Cpp_Type_], [(cv(unsigned_integer?)), (cv(unsigned_integer?))], boolean] (≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, (cv(unsigned_integer?))], Expanding the definition of restrict, which is trivially true. This completes the proof of max_value_bits_TCC1. Q.E.D.

C.43.31 Cpp_Integral_Types.max_value_bits_TCC2

Terse proof for max_value_bits_TCC2.
max_value_bits_TCC2:

{1} ∀ (typ: (cv(unsigned_integer?)), t: Cpp_Type_): typ = const(t) ⊃ cv(unsigned_integer?)(t)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of max_value_bits_TCC2. Q.E.D.

C.43.32 Cpp_Integral_Types.max_value_bits_TCC3

Terse proof for max_value_bits_TCC3.
max_value_bits_TCC3:

{1} ∀ (typ: (cv(unsigned_integer?)), t: Cpp_Type_): typ = const(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_], [(cv(unsigned_integer?)), (cv(unsigned_integer?))],

boolean] (≪)(t, typ)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of max_value_bits_TCC3. Q.E.D.

C.43.33 Cpp_Integral_Types.max_value_bits_TCC4

Terse proof for max_value_bits_TCC4.
max_value_bits_TCC4:

{1} ∀ (typ: (cv(unsigned_integer?)), t: Cpp_Type_): typ = volatile(t) ⊃ cv(unsigned_integer?)(t)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of max_value_bits_TCC4. Q.E.D.

C.43.34 Cpp_Integral_Types.max_value_bits_TCC5

Terse proof for max_value_bits_TCC5.
max_value_bits_TCC5:

{1} ∀ (typ: (cv(unsigned_integer?)), t: Cpp_Type_): typ = volatile(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_], [(cv(unsigned_integer?)), (cv(unsigned_integer?))],

boolean] (≪)(t, typ)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of max_value_bits_TCC5. Q.E.D.

C.43.35 Cpp_Integral_Types.max_value_bits_TCC6

Terse proof for max_value_bits_TCC6.

C.44 Proofs for Cpp_Types (types.pvs)

max_value_bits_TCC6:

{1} ∀ (typ: (cv(unsigned_integer?))): ¬ (schar?(typ) ∨ char?(typ) ∨ short?(typ) ∨ int?(typ) ∨ long?(typ) ∨ longlong?(typ) ∨ wchar_t?(typ) ∨ bool?(typ) ∨ float?(typ) ∨ double?(typ) ∨ longdouble?(typ) ∨ void?(typ) ∨ array?(typ) ∨ function?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ class?(typ) ∨ union?(typ) ∨ bitfield?(typ) ∨ enum?(typ) ∨ pointer_to_member?(typ))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of max_value_bits_TCC6. Q.E.D.

C.44 Proofs for Cpp_Types (types.pvs)

C.44.1 Cpp_Types.alignment_TCC1

Terse proof for alignment_TCC1.
alignment_TCC1:

{1} well_founded?(λ (x: Cpp_Type, y: Cpp_Type):

restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean] (≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Type], Expanding the definition of restrict, which is trivially true. This completes the proof of alignment_TCC1. Q.E.D.

C.44.2 Cpp_Types.alignment_TCC2

Terse proof for alignment_TCC2.
alignment_TCC2:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_, s: nat): typ = array_type(t, s) ⊃ array?(typ)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC2. Q.E.D.

C.44.3 Cpp_Types.alignment_TCC3

Terse proof for alignment_TCC3.
alignment_TCC3:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = pointer(t) ⊃ pointer?(typ)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC3. Q.E.D.

C.44.4 Cpp_Types.alignment_TCC4

Terse proof for alignment_TCC4.
alignment_TCC4:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = reference(t) ⊃ reference?(typ)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC4. Q.E.D.

C.44.5 Cpp_Types.alignment_TCC5

Terse proof for alignment_TCC5.
alignment_TCC5:

{1} ∀ (typ: Cpp_Type, n: string, a: bool): typ = class(n, a) ⊃ class?(typ)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC5. Q.E.D.

C.44.6 Cpp_Types.alignment_TCC6

Terse proof for alignment_TCC6.
alignment_TCC6:

{1} ∀ (typ: Cpp_Type, n: string): typ = union(n) ⊃ union?(typ)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC6. Q.E.D.

C.44.7 Cpp_Types.alignment_TCC7

Terse proof for alignment_TCC7.
alignment_TCC7:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_, bo: nat, s: posnat): typ = bitfield(t, bo, s) ⊃ bitfield?(typ)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC7. Q.E.D.

C.44.8 Cpp_Types.alignment_TCC8

Terse proof for alignment_TCC8.
alignment_TCC8:

{1} ∀ (typ: Cpp_Type, n: string, t: Cpp_Type_, m: posnat, c: [below[m] → int]): typ = enum(n, t, m, c) ⊃ enum?(typ)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC8. Q.E.D.

C.44.9 Cpp_Types.alignment_TCC9

Terse proof for alignment_TCC9.
alignment_TCC9:

{1} ∀ (typ: Cpp_Type, t: (class?), m: Cpp_Type_):

typ = pointer_to_member(t, m) ⊃ pointer_to_member?(typ)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC9. Q.E.D.

C.44.10 Cpp_Types.alignment_TCC10

Terse proof for alignment_TCC10.
alignment_TCC10:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC10. Q.E.D.

C.44.11 Cpp_Types.alignment_TCC11

Terse proof for alignment_TCC11.
alignment_TCC11:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = const(t) ⊃ restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean](≪)(t, typ)

Repeatedly Skolemizing and flattening, Expanding the definition of restrict, Replacing using formula -2, Expanding the definition of «, which is trivially true. This completes the proof of alignment_TCC11. Q.E.D.

C.44.12 Cpp_Types.alignment_TCC12

Terse proof for alignment_TCC12.
alignment_TCC12:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (t!2), Expanding the definition of subterm, Replacing using formula -2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of alignment_TCC12. Q.E.D.

C.44.13 Cpp_Types.alignment_TCC13

Terse proof for alignment_TCC13.

alignment_TCC13:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = volatile(t) ⊃

restrict[[Cpp_Type_, Cpp_Type_], [Cpp_Type, Cpp_Type], boolean](≪)(t, typ)

Repeatedly Skolemizing and flattening, Expanding the definition of restrict, Replacing using formula -2, Expanding the definition of «, which is trivially true. This completes the proof of alignment_TCC13. Q.E.D.

C.44.14 Cpp_Types.pointer_to_aligned_object_TCC1

Terse proof for pointer_to_aligned_object_TCC1.
pointer_to_aligned_object_TCC1:

{1} ∀ (p: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(p)))): not_null?(p)(ptr_val) ⊃ array?(cv_base(p)) ∨ pointer?(cv_base(p)) ∨ reference?(cv_base(p)) ∨ bitfield?(cv_base(p)) ∨ enum?(cv_base(p)) ∨ pointer_to_member?(cv_base(p)) ∨ const?(cv_base(p)) ∨ volatile?(cv_base(p))

Repeatedly Skolemizing and flattening, Keeping (-2 2) and hiding *, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pointer_to_aligned_object_TCC1.

Q.E.D.

C.44.15 Cpp_Types.pointer_to_aligned_object_TCC2

Terse proof for pointer_to_aligned_object_TCC2.
pointer_to_aligned_object_TCC2:

{1} ∀ (p: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(p)))): not_null?(p)(ptr_val) ⊃ Cpp_Type?(typ(cv_base(p)))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (t!1), Splitting conjunctions, we get 2 subgoals:

pointer_to_aligned_object_TCC2.1:

{-1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

{-2} cv(pointer?)(p′)
{-3} range_pointer(cv_base(p′))(ptr_val′)
{-4} not_null?(p′)(ptr_val′)
{-5} subterm(t′, typ(cv_base(p′)))

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

956

which is trivially true.

This completes the proof of pointer_to_aligned_object_TCC2.1.
pointer_to_aligned_object_TCC2.2:

{-1} cv(pointer?)(p′)
{-2} range_pointer(cv_base(p′))(ptr_val′)
{-3} not_null?(p′)(ptr_val′)
{-4} subterm(t′, typ(cv_base(p′)))
{1} subterm(t′, p′)

{2} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Hiding formulas: 2, Using lemma subterm_cv_base, Using lemma subterm_transitive, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma cv_base_result, we get 2 subgoals:

pointer_to_aligned_object_TCC2.2.1:

{-1} pointer?(cv_base(p′))
{-2} subterm(cv_base(p′), p′)
{-3} cv(pointer?)(p′)
{-4} range_pointer(cv_base(p′))(ptr_val′)
{-5} not_null?(p′)(ptr_val′)
{-6} subterm(t′, typ(cv_base(p′)))
{1} subterm(t′, cv_base(p′))
{2} subterm(t′, p′)

Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pointer_to_aligned_object_TCC2.2.1.
pointer_to_aligned_object_TCC2.2.2:

{-1} subterm(cv_base(p′), p′)
{-2} cv(pointer?)(p′)
{-3} range_pointer(cv_base(p′))(ptr_val′)
{-4} not_null?(p′)(ptr_val′)
{-5} subterm(t′, typ(cv_base(p′)))
{1} (pointer? ⊆ interpreted?)
{2} subterm(t′, cv_base(p′))
{3} subterm(t′, p′)

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pointer_to_aligned_object_TCC2.2.2.

Q.E.D.

C.44.16 Cpp_Types.pointer_to_aligned_object_TCC3

Terse proof for pointer_to_aligned_object_TCC3.
pointer_to_aligned_object_TCC3:

{1} ∀ (p: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(p)))): not_null?(p)(ptr_val) ⊃ up?[Memory_Address](address_of(p)(ptr_val))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *,

This completes the proof of pointer_to_aligned_object_TCC3.

Q.E.D.

C.44.17 Cpp_Types.align_array_of_type_TCC1

Terse proof for align_array_of_type_TCC1.
align_array_of_type_TCC1:

{1} ∀ (a: Cpp_Subtype(array?)):

array?(a) ∨ pointer?(a) ∨ reference?(a) ∨ bitfield?(a) ∨ enum?(a) ∨ pointer_to_member?(a) ∨ const?(a) ∨ volatile?(a)

Repeatedly Skolemizing and flattening,

This completes the proof of align_array_of_type_TCC1.

Q.E.D.

C.44.18 Cpp_Types.align_array_of_type_TCC2

Terse proof for align_array_of_type_TCC2.

align_array_of_type_TCC2:

{1} ∀ (a: Cpp_Subtype(array?)): Cpp_Type?(typ(a))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (t!1), Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of align_array_of_type_TCC2.

Q.E.D.

C.44.19 Cpp_Types.range_TCC1

Terse proof for range_TCC1.

range_TCC1:

{1} well_founded?(λ (x: Cpp_Subtype(cv(non_bool_integral_enum?)),

y: Cpp_Subtype(cv(non_bool_integral_enum?))): restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(non_bool_integral_enum?)), Cpp_Subtype(cv(non_bool_integral_enum?))],

boolean]

(≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Subtype(cv(non_bool_integral_enum?))], Expanding the definition of restrict, which is trivially true. This completes the proof of range_TCC1. Q.E.D.

C.44.20 Cpp_Types.range_TCC2

Terse proof for range_TCC2.

range_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), n: string, t: Cpp_Type_, m: pos-

nat,

c: [below[m] → int]): typ = enum(n, t, m, c) ⊃ enum?(typ)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_TCC2. Q.E.D.

C.44.21 Cpp_Types.range_TCC3

Terse proof for range_TCC3.

range_TCC3:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t) ∧ cv(non_bool_integral_enum?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

range_TCC3.1:

{-1} Cpp_Type?(typ′)
{-2} cv(non_bool_integral_enum?)(typ′)
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Replacing using formula -4, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_TCC3.1.

range_TCC3.2:

{-1} Cpp_Type?(typ′)
{-2} cv(non_bool_integral_enum?)(typ′)
{-3} typ′ = const(t′)
{1} cv(non_bool_integral_enum?)(t′)

Replacing using formula -3, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_TCC3.2. Q.E.D.

C.44.22 Cpp_Types.range_TCC4

Terse proof for range_TCC4.

range_TCC4:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = const(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(non_bool_integral_enum?)), Cpp_Subtype(cv(non_bool_integral_enum?))],

boolean]

(≪)(t, typ)

Expanding the definition of restrict, Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of «, which is trivially true. This completes the proof of range_TCC4.

Q.E.D.

C.44.23 Cpp_Types.range_TCC5

Terse proof for range_TCC5.

range_TCC5:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t) ∧ cv(non_bool_integral_enum?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

range_TCC5.1:

{-1} Cpp_Type?(typ′)
{-2} cv(non_bool_integral_enum?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Replacing using formula -4, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_TCC5.1.

range_TCC5.2:

{-1} Cpp_Type?(typ′)
{-2} cv(non_bool_integral_enum?)(typ′)
{-3} typ′ = volatile(t′)
{1} cv(non_bool_integral_enum?)(t′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_TCC5.2. Q.E.D.

C.44.24 Cpp_Types.range_TCC6

Terse proof for range_TCC6.

range_TCC6:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = volatile(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(non_bool_integral_enum?)), Cpp_Subtype(cv(non_bool_integral_enum?))],

boolean]

(≪)(t, typ)

Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_TCC6. Q.E.D.

C.44.25 Cpp_Types.range_TCC7

Terse proof for range_TCC7.

range_TCC7:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ∧ ¬ enum?(typ) ⊃ non_bool_integral?(typ)

Repeatedly Skolemizing and flattening, Expanding the definition of cv, Expanding the definition of v, Expanding the definition of c, Expanding the definition of non_bool_integral_enum?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of range_TCC7. Q.E.D.

C.44.26 Cpp_Types.range_cv_base_TCC1

Terse proof for range_cv_base_TCC1.
range_cv_base_TCC1:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))): cv(non_bool_integral_enum?)(cv_base(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of cv, Expanding the definition of c, Applying disjunctive simplification to flatten sequent, Expanding the definition of v, Hiding formulas: (2 3 4), Applying propositional simplification, we get 5 subgoals:

range_cv_base_TCC1.1:

{-1} non_bool_integral_enum?(typ′)
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base_TCC1.1.1:

{-1} non_bool_integral_enum?(typ′)
{-2} const?(typ′)
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

Hiding formulas: 1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.1.1.

range_cv_base_TCC1.1.2:

{-1} non_bool_integral_enum?(typ′)
{-2} volatile?(typ′)
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

Hiding formulas: 1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.1.2.

range_cv_base_TCC1.2:

{-1} const?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base_TCC1.2.1:

{-1} const?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} const?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ′))))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.2.1.

range_cv_base_TCC1.2.2:

{-1} const?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ′))))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.2.2.

range_cv_base_TCC1.3:

{-1} non_bool_integral_enum?(typ′)
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base_TCC1.3.1:

{-1} non_bool_integral_enum?(typ′)
{-2} const?(typ′)
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

Keeping (-2 -1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.3.1.

range_cv_base_TCC1.3.2:

{-1} non_bool_integral_enum?(typ′)
{-2} volatile?(typ′)
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

Keeping (-2 -1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.3.2.

range_cv_base_TCC1.4:

{-1} volatile?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base_TCC1.4.1:

{-1} volatile?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} const?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ′))))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.4.1.

range_cv_base_TCC1.4.2:

{-1} volatile?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ(typ′))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ′))))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.4.2.

range_cv_base_TCC1.5:

{-1} const?(typ′)
{-2} volatile?(typ(typ′))
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{1} non_bool_integral_enum?(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of cv_base, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base_TCC1.5.1:

{-1} const?(typ′)
{-2} volatile?(typ(typ′))
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{-4} const?(typ(typ(typ′)))
{1} non_bool_integral_enum?(cv_base(typ(typ′)))

Keeping (-4 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.5.1.

range_cv_base_TCC1.5.2:

{-1} const?(typ′)
{-2} volatile?(typ(typ′))
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{-4} volatile?(typ(typ(typ′)))
{1} non_bool_integral_enum?(cv_base(typ(typ(typ(typ′)))))

Keeping (-4 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base_TCC1.5.2. Q.E.D.

C.44.27 Cpp_Types.range_cv_base

Terse proof for range_cv_base.

range_cv_base:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))): range(typ) = range(cv_base(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

range_cv_base.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ′)
{1} range(typ′) = range(cv_base(typ′))

Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base.1.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ′)
{-3} const?(typ′)
{1} range(typ′) = range(cv_base(typ(typ′)))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base.1.1.

range_cv_base.1.2:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ′)
{-3} volatile?(typ′)
{1} range(typ′) = range(cv_base(typ(typ′)))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base.1.2.

range_cv_base.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} range(typ′) = range(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of range, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base.2.1:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{-4} const?(typ(typ′))
{1} range(typ(typ′)) = range(cv_base(typ(typ(typ′))))

Keeping (-3 -4) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base.2.1.

range_cv_base.2.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{-4} volatile?(typ(typ′))
{1} range(typ(typ′)) = range(cv_base(typ(typ(typ′))))

Keeping (-3 -4) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base.2.2.

range_cv_base.3:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{1} range(typ′) = range(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of cv_base, Expanding the definition of range, Expanding the definition of range, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base.3.1:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{-5} const?(typ(typ(typ′)))
{1} range(typ(typ(typ′))) = range(cv_base(typ(typ(typ(typ′)))))

Keeping (-4 -5) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base.3.1.

range_cv_base.3.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{-5} volatile?(typ(typ(typ′)))
{1} range(typ(typ(typ′))) = range(cv_base(typ(typ(typ(typ′)))))

Keeping (-4 -5) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base.3.2.

range_cv_base.4:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{1} range(typ′) = range(cv_base(typ′))

Expanding the definition of cv_base, Expanding the definition of cv_base, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

range_cv_base.4.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{-4} const?(typ(typ′))
{1} range(typ(typ′)) = range(cv_base(typ(typ(typ′))))

Keeping (-2 -4) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base.4.1.

range_cv_base.4.2:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{-4} volatile?(typ(typ′))
{1} range(typ(typ′)) = range(cv_base(typ(typ(typ′))))

Keeping (-2 -4) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_cv_base.4.2. Q.E.D.

C.44.28 Cpp_Types.dt_non_bool_integral_enum_TCC1

Terse proof for dt_non_bool_integral_enum_TCC1.
dt_non_bool_integral_enum_TCC1:

{1} ∀ (typ: Cpp_Subtype(non_bool_integral_enum?), n: string, t: Cpp_Type_, m: pos-

nat,

c: [below[m] → int]): typ = enum(n, t, m, c) ⊃ enum?(typ)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC1.

Q.E.D.

C.44.29 Cpp_Types.dt_non_bool_integral_enum_TCC2

Terse proof for dt_non_bool_integral_enum_TCC2.
dt_non_bool_integral_enum_TCC2:

{1} ∀ (typ: Cpp_Subtype(non_bool_integral_enum?), n: string, t: Cpp_Type_, m: pos-

nat,

c: [below[m] → int]): typ = enum(n, t, m, c) ⊃ (∀ (x: int): range_enum(typ)(x) ≡ range(typ)(x)) ∧ (∀ (x: int): range_enum(typ)(x) ≡ range(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ)))]((range(typ)))(dt_enum(typ)`from_byte(x_{1}))) ∧ interpreted_data_type?[(range(typ))](dt_enum(typ))

Repeatedly Skolemizing and flattening, Replacing using formula -4, Expanding the definition of range, Adding type constraints for dt_enum(enum(n!1, t!1, m!1, c!1)), we get 2 subgoals:

dt_non_bool_integral_enum_TCC2.1:

{-1} pod_data_type?[((range_enum(enum(n′, t′, m′, c′))))]

(dt_enum(enum(n′, t′, m′, c′)))

{-2} Cpp_Type?(enum(n′, t′, m′, c′))
{-3} non_bool_integral_enum?(enum(n′, t′, m′, c′))
{-4} m′ > 0
{-5} typ′ = enum(n′, t′, m′, c′)

{1} (∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ′)))] (range_enum(enum(n′, t′, m′, c′))) (dt_enum(enum(n′, t′, m′, c′))`from_byte(x_{1})))

∧ interpreted_data_type?[((range(typ′)))](dt_enum(enum(n′, t′, m′, c′)))

Applying propositional simplification, we get 2 subgoals:

dt_non_bool_integral_enum_TCC2.1.1:

{-1} pod_data_type?[((range_enum(enum(n′, t′, m′, c′))))]

(dt_enum(enum(n′, t′, m′, c′)))

{-2} Cpp_Type?(enum(n′, t′, m′, c′))
{-3} non_bool_integral_enum?(enum(n′, t′, m′, c′))
{-4} m′ > 0
{-5} typ′ = enum(n′, t′, m′, c′)

{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ′)))] (range_enum(enum(n′, t′, m′, c′))) (dt_enum(enum(n′, t′, m′, c′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC2.1.1.
dt_non_bool_integral_enum_TCC2.1.2:

{-1} pod_data_type?[((range_enum(enum(n′, t′, m′, c′))))]

(dt_enum(enum(n′, t′, m′, c′)))

{-2} Cpp_Type?(enum(n′, t′, m′, c′))
{-3} non_bool_integral_enum?(enum(n′, t′, m′, c′))
{-4} m′ > 0
{-5} typ′ = enum(n′, t′, m′, c′)
{1} interpreted_data_type?[((range(typ′)))](dt_enum(enum(n′, t′, m′, c′)))

Expanding the definition of pod_data_type?, Applying disjunctive simplification to flatten sequent, Keeping (-1 -7 1) and hiding *, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_non_bool_integral_enum_TCC2.1.2.1:

{-1} uninterpreted_data_type?(dt_enum(enum(n′, t′, m′, c′))`uidt)
{-2} ∀ (d: ((range_enum(enum(n′, t′, m′, c′)))), a: Address):

valid?(uidt(dt_enum(enum(n′, t′, m′, c′))))

(to_byte(dt_enum(enum(n′, t′, m′, c′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(enum(n′, t′, m′, c′))))(l, a) ≡ up?(from_byte(dt_enum(enum(n′, t′, m′, c′)))(l, a))

{-4} ∀ (d: ((range_enum(enum(n′, t′, m′, c′)))), a: Address): down(from_byte(dt_enum(enum(n′, t′, m′, c′)))

(to_byte(dt_enum(enum(n′, t′, m′, c′)))(d, a), a))

= d {-5} typ′ = enum(n′, t′, m′, c′)

{1} ∀ (d: ((range(typ′))), a: Address):

valid?(uidt(dt_enum(enum(n′, t′, m′, c′))))

(to_byte(dt_enum(enum(n′, t′, m′, c′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC2.1.2.1.
dt_non_bool_integral_enum_TCC2.1.2.2:

{-1} uninterpreted_data_type?(dt_enum(enum(n′, t′, m′, c′))`uidt)
{-2} ∀ (d: ((range_enum(enum(n′, t′, m′, c′)))), a: Address):

valid?(uidt(dt_enum(enum(n′, t′, m′, c′))))

(to_byte(dt_enum(enum(n′, t′, m′, c′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(enum(n′, t′, m′, c′))))(l, a) ≡ up?(from_byte(dt_enum(enum(n′, t′, m′, c′)))(l, a))

{-4} ∀ (d: ((range_enum(enum(n′, t′, m′, c′)))), a: Address): down(from_byte(dt_enum(enum(n′, t′, m′, c′)))

(to_byte(dt_enum(enum(n′, t′, m′, c′)))(d, a), a))

= d {-5} typ′ = enum(n′, t′, m′, c′)

{1} ∀ (d: ((range(typ′))), a: Address):

down(from_byte(dt_enum(enum(n′, t′, m′, c′)))

(to_byte(dt_enum(enum(n′, t′, m′, c′)))(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC2.1.2.2.

dt_non_bool_integral_enum_TCC2.2:

{-1} Cpp_Type?(enum(n′, t′, m′, c′))
{-2} non_bool_integral_enum?(enum(n′, t′, m′, c′))
{-3} m′ > 0
{-4} typ′ = enum(n′, t′, m′, c′)
{1} Cpp_Type?(enum(n′, t′, m′, c′))
{2} (∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ′)))] (range_enum(enum(n′, t′, m′, c′)))

(dt_enum(enum(n′, t′, m′, c′))`from_byte(x_{1})))

∧ interpreted_data_type?[((range(typ′)))](dt_enum(enum(n′, t′, m′, c′)))

which is trivially true.

This completes the proof of dt_non_bool_integral_enum_TCC2.2.

Q.E.D.

C.44.30 Cpp_Types.dt_non_bool_integral_enum_TCC3

Terse proof for dt_non_bool_integral_enum_TCC3.
dt_non_bool_integral_enum_TCC3:

{1} ∀ (typ: Cpp_Subtype(non_bool_integral_enum?)): ¬ enum?(typ) ⊃ non_bool_integral?(typ)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC3.

Q.E.D.

C.44.31 Cpp_Types.dt_non_bool_integral_enum_TCC4

Terse proof for dt_non_bool_integral_enum_TCC4.
dt_non_bool_integral_enum_TCC4:

{1} ∀ (typ: Cpp_Subtype(non_bool_integral_enum?)):

¬ enum?(typ) ⊃ (∀ (x: int): range_integral(typ)(x) ≡ range(typ)(x)) ∧ (∀ (x: int): range_integral(typ)(x) ≡ range(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_integral(typ)))]

((range(typ)))(dt_integral(typ)`from_byte(x_{1}))) ∧ interpreted_data_type?[(range(typ))](dt_integral(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of non_bool_integral_enum?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_non_bool_integral_enum_TCC4.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral?(typ′)
{1} enum?(typ′)
{2} interpreted_data_type?[((range(typ′)))](dt_integral(typ′))

Adding type constraints for dt_integral(typ!1), Using lemma pod_is_interpreted_data[(range_integral(typ′))], Expanding the definition of interpreted_data_type?, Keeping (-1 -4 2) and hiding *, Applying propositional simplification, we get 2 subgoals:

dt_non_bool_integral_enum_TCC4.1.1:

{-1} uninterpreted_data_type?(dt_integral(typ′)`uidt)

{-2} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ′)))(l, a) ≡ up?(from_byte(dt_integral(typ′))(l, a))

{-4} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d, a), a)) = d

{-5} non_bool_integral?(typ′)

{1} ∀ (d: ((range(typ′))), a: Address): valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 -5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC4.1.1.
dt_non_bool_integral_enum_TCC4.1.2:

{-1} uninterpreted_data_type?(dt_integral(typ′)`uidt)

{-2} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ′)))(l, a) ≡ up?(from_byte(dt_integral(typ′))(l, a))

{-4} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d, a), a)) = d

{-5} non_bool_integral?(typ′)

{1} ∀ (d: ((range(typ′))), a: Address): down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 -5 1) and hiding *, Expanding the definition of range, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC4.1.2.
dt_non_bool_integral_enum_TCC4.2:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral?(typ′)
{1} enum?(typ′)
{2} ∀ (x_{1}: [list[Byte], Address]):

every[((range_integral(typ′)))] ((range(typ′)))(dt_integral(typ′)`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_non_bool_integral_enum_TCC4.2.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral?(typ′)
{-3} const?(typ′)
{1} bottom?(dt_integral(typ′)`from_byte(x′_{1}))
{2} range(typ(typ′))(down(dt_integral(typ′)`from_byte(x′_{1})))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC4.2.1.
dt_non_bool_integral_enum_TCC4.2.2:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral?(typ′)
{-3} volatile?(typ′)
{1} bottom?(dt_integral(typ′)`from_byte(x′_{1}))
{2} range(typ(typ′))(down(dt_integral(typ′)`from_byte(x′_{1})))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC4.2.2.
dt_non_bool_integral_enum_TCC4.3:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral?(typ′)
{1} enum?(typ′)
{2} ∀ (x: int): range_integral(typ′)(x) ≡ range(typ′)(x)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Keeping (-3 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_TCC4.3.

Q.E.D.

C.44.32 Cpp_Types.dt_non_bool_integral_enum_pod

Terse proof for dt_non_bool_integral_enum_pod.
dt_non_bool_integral_enum_pod:

{1} ∀ (typ: Cpp_Subtype(non_bool_integral_enum?)): pod_data_type?[(range(typ))](dt_non_bool_integral_enum(typ))

Repeatedly Skolemizing and flattening, Expanding the definition of dt_non_bool_integral_enum, Expanding the definition of non_bool_integral_enum?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_non_bool_integral_enum_pod.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral?(typ′)
{-3} enum?(typ′)
{1} pod_data_type?[((range(typ′)))](dt_enum(typ′))

Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_pod.1.
dt_non_bool_integral_enum_pod.2:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral?(typ′)
{1} enum?(typ′)
{2} pod_data_type?[((range(typ′)))](dt_integral(typ′))

Adding type constraints for dt_integral(typ!1), Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_non_bool_integral_enum_pod.2.1:

{-1} uninterpreted_data_type?(dt_integral(typ′)`uidt)

{-2} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ′)))(l, a) ≡ up?(from_byte(dt_integral(typ′))(l, a))

{-4} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_integral(typ′)))(l, a_{1}) ≡ valid?(uidt(dt_integral(typ′)))(l, a_{2})

{-6} size(uidt(dt_integral(typ′))) > 0
{-7} Cpp_Type?(typ′)
{-8} non_bool_integral?(typ′)

{1} ∀ (d: ((range(typ′))), a: Address):

valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d, a), a)

{2} enum?(typ′)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_non_bool_integral_enum_pod.2.1.1:

{-1} const?(typ′)
{-2} range(typ(typ′))(d′)
{-3} uninterpreted_data_type?(dt_integral(typ′)`uidt)

{-4} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ′)))(l, a) ≡ up?(from_byte(dt_integral(typ′))(l, a))

{-5} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d, a), a)) = d

{-6} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_integral(typ′)))(l, a_{1}) ≡ valid?(uidt(dt_integral(typ′)))(l, a_{2})

{-7} size(uidt(dt_integral(typ′))) > 0
{-8} Cpp_Type?(typ′)
{-9} non_bool_integral?(typ′)
{1} range_integral(typ′)(d′)
{2} valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d′, a′), a′)

Keeping (-1 -9) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_pod.2.1.1.
dt_non_bool_integral_enum_pod.2.1.2:

{-1} range(typ(typ′))(d′)
{-2} volatile?(typ′)
{-3} uninterpreted_data_type?(dt_integral(typ′)`uidt)

{-4} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ′)))(l, a) ≡ up?(from_byte(dt_integral(typ′))(l, a))

{-5} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d, a), a)) = d

{-6} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_integral(typ′)))(l, a_{1}) ≡ valid?(uidt(dt_integral(typ′)))(l, a_{2})

{-7} size(uidt(dt_integral(typ′))) > 0
{-8} Cpp_Type?(typ′)
{-9} non_bool_integral?(typ′)
{1} range_integral(typ′)(d′)
{2} valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d′, a′), a′)

Keeping (-2 -9) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_pod.2.1.2.

dt_non_bool_integral_enum_pod.2.2:

{-1} uninterpreted_data_type?(dt_integral(typ′)`uidt)

{-2} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ′)))(l, a) ≡ up?(from_byte(dt_integral(typ′))(l, a))

{-4} ∀ (d: ((range_integral(typ′))), a: Address):

down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_integral(typ′)))(l, a_{1}) ≡ valid?(uidt(dt_integral(typ′)))(l, a_{2})

{-6} size(uidt(dt_integral(typ′))) > 0
{-7} Cpp_Type?(typ′)
{-8} non_bool_integral?(typ′)

{1} ∀ (d: ((range(typ′))), a: Address):

down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d, a), a)) = d

{2} enum?(typ′)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

dt_non_bool_integral_enum_pod.2.2.1:

{-1} const?(typ′)
{-2} range(typ(typ′))(d′)
{-3} uninterpreted_data_type?(dt_integral(typ′)`uidt)

{-4} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d, a), a)

{-5} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ′)))(l, a) ≡ up?(from_byte(dt_integral(typ′))(l, a))

{-6} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_integral(typ′)))(l, a_{1}) ≡ valid?(uidt(dt_integral(typ′)))(l, a_{2})

{-7} size(uidt(dt_integral(typ′))) > 0
{-8} Cpp_Type?(typ′)
{-9} non_bool_integral?(typ′)
{1} range_integral(typ′)(d′)
{2} down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d′, a′), a′)) = d′

Keeping (-1 -9) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_pod.2.2.1.

dt_non_bool_integral_enum_pod.2.2.2:

{-1} range(typ(typ′))(d′)
{-2} volatile?(typ′)
{-3} uninterpreted_data_type?(dt_integral(typ′)`uidt)

{-4} ∀ (d: ((range_integral(typ′))), a: Address):

valid?(uidt(dt_integral(typ′)))(to_byte(dt_integral(typ′))(d, a), a)

{-5} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ′)))(l, a) ≡ up?(from_byte(dt_integral(typ′))(l, a))

{-6} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_integral(typ′)))(l, a_{1}) ≡ valid?(uidt(dt_integral(typ′)))(l, a_{2})

{-7} size(uidt(dt_integral(typ′))) > 0
{-8} Cpp_Type?(typ′)
{-9} non_bool_integral?(typ′)
{1} range_integral(typ′)(d′)
{2} down(from_byte(dt_integral(typ′))(to_byte(dt_integral(typ′))(d′, a′), a′)) = d′

Keeping (-2 -9) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of dt_non_bool_integral_enum_pod.2.2.2.
dt_non_bool_integral_enum_pod.3:

{-1} Cpp_Type?(typ′)
{-2} enum?(typ′)
{1} pod_data_type?[((range(typ′)))](dt_enum(typ′))

Adding type constraints for dt_enum(typ!1), Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_non_bool_integral_enum_pod.3.1:

{-1} uninterpreted_data_type?(dt_enum(typ′)`uidt)

{-2} ∀ (d: ((range_enum(typ′))), a: Address):

valid?(uidt(dt_enum(typ′)))(to_byte(dt_enum(typ′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(typ′)))(l, a) ≡ up?(from_byte(dt_enum(typ′))(l, a))

{-4} ∀ (d: ((range_enum(typ′))), a: Address):

down(from_byte(dt_enum(typ′))(to_byte(dt_enum(typ′))(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_enum(typ′)))(l, a_{1}) ≡ valid?(uidt(dt_enum(typ′)))(l, a_{2})

{-6} size(uidt(dt_enum(typ′))) > 0
{-7} Cpp_Type?(typ′)
{-8} enum?(typ′)

{1} ∀ (d: ((range(typ′))), a: Address):

valid?(uidt(dt_enum(typ′)))(to_byte(dt_enum(typ′))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true.

This completes the proof of dt_non_bool_integral_enum_pod.3.1.

dt_non_bool_integral_enum_pod.3.2:

{-1} uninterpreted_data_type?(dt_enum(typ′)`uidt)

{-2} ∀ (d: ((range_enum(typ′))), a: Address):

valid?(uidt(dt_enum(typ′)))(to_byte(dt_enum(typ′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(typ′)))(l, a) ≡ up?(from_byte(dt_enum(typ′))(l, a))

{-4} ∀ (d: ((range_enum(typ′))), a: Address):

down(from_byte(dt_enum(typ′))(to_byte(dt_enum(typ′))(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_enum(typ′)))(l, a_{1}) ≡ valid?(uidt(dt_enum(typ′)))(l, a_{2})

{-6} size(uidt(dt_enum(typ′))) > 0
{-7} Cpp_Type?(typ′)
{-8} enum?(typ′)

{1} ∀ (d: ((range(typ′))), a: Address):

down(from_byte(dt_enum(typ′))(to_byte(dt_enum(typ′))(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true.

This completes the proof of dt_non_bool_integral_enum_pod.3.2.

Q.E.D.

C.44.33 Cpp_Types.dt_TCC1

Terse proof for dt_TCC1.

dt_TCC1:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = const(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range(t)))])): true)

Repeatedly Skolemizing and flattening, Expanding the definition of cv, Expanding the definition of v, Expanding the definition of c, Replacing using formula -3, Simplifying, rewriting, and recording with decision procedures, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_TCC1.1:

{-1} Cpp_Type?(const(t′))
{-2} non_bool_integral_enum?(const(t′))
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Keeping (-2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.1.

dt_TCC1.2:

{-1} Cpp_Type?(const(t′))
{-2} non_bool_integral_enum?(t′)
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Expanding the definition of non_bool_integral_enum?, Applying propositional simplification, we get 2 subgoals:

dt_TCC1.2.1:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Instantiating the top quantifier in 1 with the terms: (dt_integral(t!1)), we get 3 subgoals:

dt_TCC1.2.1.1:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} true

which is trivially true. This completes the proof of dt_TCC1.2.1.1.

dt_TCC1.2.1.2:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} (∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)) ∧

(∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[((range_integral(t′)))]

((range(t′)))(dt_integral(t′)`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_integral(t′))

Adding type constraints for dt_integral(t!1), we get 2 subgoals:

dt_TCC1.2.1.2.1:

{-1} pod_data_type?[((range_integral(t′)))](dt_integral(t′))
{-2} non_bool_integral?(t′)
{-3} Cpp_Type?(const(t′))
{-4} typ′ = const(t′)
{1} (∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)) ∧

(∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[((range_integral(t′)))]

((range(t′)))(dt_integral(t′)`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_integral(t′))

Applying propositional simplification, we get 4 subgoals:

dt_TCC1.2.1.2.1.1:

{-1} pod_data_type?[((range_integral(t′)))](dt_integral(t′))
{-2} non_bool_integral?(t′)
{-3} Cpp_Type?(const(t′))
{-4} typ′ = const(t′)
{1} ∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.2.1.2.1.1.

dt_TCC1.2.1.2.1.2:

{-1} pod_data_type?[((range_integral(t′)))](dt_integral(t′))
{-2} non_bool_integral?(t′)
{-3} Cpp_Type?(const(t′))
{-4} typ′ = const(t′)
{1} ∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)

Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.2.1.2.1.2.

dt_TCC1.2.1.2.1.3:

{-1} pod_data_type?[((range_integral(t′)))](dt_integral(t′))
{-2} non_bool_integral?(t′)
{-3} Cpp_Type?(const(t′))
{-4} typ′ = const(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_integral(t′)))]((range(t′)))(dt_integral(t′)`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range, Keeping (-2 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.2.1.2.1.3.

dt_TCC1.2.1.2.1.4:

{-1} pod_data_type?[((range_integral(t′)))](dt_integral(t′))
{-2} non_bool_integral?(t′)
{-3} Cpp_Type?(const(t′))
{-4} typ′ = const(t′)
{1} interpreted_data_type?[((range(t′)))](dt_integral(t′))

Using lemma pod_is_interpreted_data[(range_integral(t′))], Keeping (-1 -3 1) and hiding *, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_TCC1.2.1.2.1.4.1:

{-1} uninterpreted_data_type?(dt_integral(t′)`uidt)

{-2} ∀ (d: ((range_integral(t′))), a: Address):

valid?(uidt(dt_integral(t′)))(to_byte(dt_integral(t′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(t′)))(l, a) ≡ up?(from_byte(dt_integral(t′))(l, a))

{-4} ∀ (d: ((range_integral(t′))), a: Address):

down(from_byte(dt_integral(t′))(to_byte(dt_integral(t′))(d, a), a)) = d

{-5} non_bool_integral?(t′)
{1} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_integral(t′)))(to_byte(dt_integral(t′))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, Keeping (-1 -5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.2.1.2.1.4.1.

dt_TCC1.2.1.2.1.4.2:

{-1} uninterpreted_data_type?(dt_integral(t′)`uidt)

{-2} ∀ (d: ((range_integral(t′))), a: Address):

valid?(uidt(dt_integral(t′)))(to_byte(dt_integral(t′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(t′)))(l, a) ≡ up?(from_byte(dt_integral(t′))(l, a))

{-4} ∀ (d: ((range_integral(t′))), a: Address):

down(from_byte(dt_integral(t′))(to_byte(dt_integral(t′))(d, a), a)) = d

{-5} non_bool_integral?(t′)
{1} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_integral(t′))(to_byte(dt_integral(t′))(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 -5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.2.1.2.1.4.2.

dt_TCC1.2.1.2.2:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} non_bool_integral?(t′)
{2} (∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)) ∧

(∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[((range_integral(t′)))]

((range(t′)))(dt_integral(t′)`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_integral(t′))

which is trivially true. This completes the proof of dt_TCC1.2.1.2.2.

dt_TCC1.2.1.3:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} non_bool_integral?(t′)

which is trivially true. This completes the proof of dt_TCC1.2.1.3.

dt_TCC1.2.2:

{-1} enum?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Instantiating the top quantifier in 1 with the terms: (dt_enum(t!1)), we get 3 subgoals:

dt_TCC1.2.2.1:

{-1} enum?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} true

which is trivially true. This completes the proof of dt_TCC1.2.2.1.

dt_TCC1.2.2.2:

{-1} enum?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} (∀ (x: int): range_enum(t′)(x) ≡ range(t′)(x)) ∧
(∀ (x: int): range_enum(t′)(x) ≡ range(t′)(x)) ∧
(∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(t′)))]((range(t′)))(dt_enum(t′)`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_enum(t′))

Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_TCC1.2.2.2.1:

{-1} enum?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} interpreted_data_type?[((range(t′)))](dt_enum(t′))

Adding type constraints for dt_enum(t!1), Using lemma pod_is_interpreted_data[(range_enum(t′))], Keeping (-1 -3 1) and hiding *, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_TCC1.2.2.2.1.1:

{-1} uninterpreted_data_type?(dt_enum(t′)`uidt)

{-2} ∀ (d: ((range_enum(t′))), a: Address):

valid?(uidt(dt_enum(t′)))(to_byte(dt_enum(t′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(t′)))(l, a) ≡ up?(from_byte(dt_enum(t′))(l, a))

{-4} ∀ (d: ((range_enum(t′))), a: Address):

down(from_byte(dt_enum(t′))(to_byte(dt_enum(t′))(d, a), a)) = d

{-5} enum?(t′)
{1} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_enum(t′)))(to_byte(dt_enum(t′))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 -5 1) and hiding *, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC1.2.2.2.1.1.

dt_TCC1.2.2.2.1.2:

{-1} uninterpreted_data_type?(dt_enum(t′)`uidt)

{-2} ∀ (d: ((range_enum(t′))), a: Address):

valid?(uidt(dt_enum(t′)))(to_byte(dt_enum(t′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(t′)))(l, a) ≡ up?(from_byte(dt_enum(t′))(l, a))

{-4} ∀ (d: ((range_enum(t′))), a: Address):

down(from_byte(dt_enum(t′))(to_byte(dt_enum(t′))(d, a), a)) = d

{-5} enum?(t′)
{1} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_enum(t′))(to_byte(dt_enum(t′))(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC1.2.2.2.1.2.

dt_TCC1.2.2.2.2:

{-1} enum?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(t′)))](range_enum(t′))(dt_enum(t′)`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC1.2.2.2.2.

dt_TCC1.2.2.3:

{-1} enum?(t′)
{-2} Cpp_Type?(const(t′))
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′) ∧ enum?(t′)

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -3 with the terms: (t!2), Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC1.2.2.3.

dt_TCC1.3:

{-1} Cpp_Type?(const(t′))
{-2} volatile?(t′)
{-3} non_bool_integral_enum?(typ(t′))
{-4} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Expanding the definition of non_bool_integral_enum?, Applying propositional simplification, we get 2 subgoals:

dt_TCC1.3.1:

{-1} non_bool_integral?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Instantiating the top quantifier in 1 with the terms: (dt_integral(typ(t!1))), we get 3 subgoals:

dt_TCC1.3.1.1:

{-1} non_bool_integral?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} true

which is trivially true. This completes the proof of dt_TCC1.3.1.1.

dt_TCC1.3.1.2:

{-1} non_bool_integral?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)

{1} (∀ (x: int): range_integral(typ(t′))(x) ≡ range(t′)(x)) ∧ (∀ (x: int): range_integral(typ(t′))(x) ≡ range(t′)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_integral(typ(t′))))]

((range(t′)))(dt_integral(typ(t′))`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_integral(typ(t′)))

Adding type constraints for dt_integral(typ(t!1)), we get 2 subgoals:

dt_TCC1.3.1.2.1:

{-1} pod_data_type?[((range_integral(typ(t′))))](dt_integral(typ(t′)))
{-2} non_bool_integral?(typ(t′))
{-3} Cpp_Type?(const(t′))
{-4} volatile?(t′)
{-5} typ′ = const(t′)

{1} (∀ (x: int): range_integral(typ(t′))(x) ≡ range(t′)(x)) ∧ (∀ (x: int): range_integral(typ(t′))(x) ≡ range(t′)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_integral(typ(t′))))]

((range(t′)))(dt_integral(typ(t′))`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_integral(typ(t′)))

Applying propositional simplification, we get 4 subgoals:

dt_TCC1.3.1.2.1.1:

{-1} pod_data_type?[((range_integral(typ(t′))))](dt_integral(typ(t′)))
{-2} non_bool_integral?(typ(t′))
{-3} Cpp_Type?(const(t′))
{-4} volatile?(t′)
{-5} typ′ = const(t′)
{1} ∀ (x: int): range_integral(typ(t′))(x) ≡ range(t′)(x)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.3.1.2.1.1.

dt_TCC1.3.1.2.1.2:

{-1} pod_data_type?[((range_integral(typ(t′))))](dt_integral(typ(t′)))
{-2} non_bool_integral?(typ(t′))
{-3} Cpp_Type?(const(t′))
{-4} volatile?(t′)
{-5} typ′ = const(t′)
{1} ∀ (x: int): range_integral(typ(t′))(x) ≡ range(t′)(x)

Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.3.1.2.1.2.

dt_TCC1.3.1.2.1.3:

{-1} pod_data_type?[((range_integral(typ(t′))))](dt_integral(typ(t′)))
{-2} non_bool_integral?(typ(t′))
{-3} Cpp_Type?(const(t′))
{-4} volatile?(t′)
{-5} typ′ = const(t′)

{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_integral(typ(t′))))] ((range(t′)))(dt_integral(typ(t′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range, Keeping (-2 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.3.1.2.1.3.

dt_TCC1.3.1.2.1.4:

{-1} pod_data_type?[((range_integral(typ(t′))))](dt_integral(typ(t′)))
{-2} non_bool_integral?(typ(t′))
{-3} Cpp_Type?(const(t′))
{-4} volatile?(t′)
{-5} typ′ = const(t′)
{1} interpreted_data_type?[((range(t′)))](dt_integral(typ(t′)))

Using lemma pod_is_interpreted_data[(range_integral(typ(t′)))], Keeping (-1 -3 1) and hiding *, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_TCC1.3.1.2.1.4.1:

{-1} uninterpreted_data_type?(dt_integral(typ(t′))`uidt)

{-2} ∀ (d: ((range_integral(typ(t′)))), a: Address):

valid?(uidt(dt_integral(typ(t′))))(to_byte(dt_integral(typ(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ(t′))))(l, a) ≡ up?(from_byte(dt_integral(typ(t′)))(l, a))

{-4} ∀ (d: ((range_integral(typ(t′)))), a: Address): down(from_byte(dt_integral(typ(t′)))

(to_byte(dt_integral(typ(t′)))(d, a), a))

= d

{-5} non_bool_integral?(typ(t′))
{1} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_integral(typ(t′))))(to_byte(dt_integral(typ(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, Keeping (-1 -5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.3.1.2.1.4.1.

dt_TCC1.3.1.2.1.4.2:

{-1} uninterpreted_data_type?(dt_integral(typ(t′))`uidt)

{-2} ∀ (d: ((range_integral(typ(t′)))), a: Address):

valid?(uidt(dt_integral(typ(t′))))(to_byte(dt_integral(typ(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(typ(t′))))(l, a) ≡ up?(from_byte(dt_integral(typ(t′)))(l, a))

{-4} ∀ (d: ((range_integral(typ(t′)))), a: Address):

down(from_byte(dt_integral(typ(t′)))

(to_byte(dt_integral(typ(t′)))(d, a), a))

= d

{-5} non_bool_integral?(typ(t′))

{1} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_integral(typ(t′)))

(to_byte(dt_integral(typ(t′)))(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 -5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC1.3.1.2.1.4.2.

dt_TCC1.3.1.2.2:

{-1} non_bool_integral?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} non_bool_integral?(typ(t′))

{2} (∀ (x: int): range_integral(typ(t′))(x) ≡ range(t′)(x)) ∧ (∀ (x: int): range_integral(typ(t′))(x) ≡ range(t′)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_integral(typ(t′))))]

((range(t′)))(dt_integral(typ(t′))`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_integral(typ(t′)))

which is trivially true. This completes the proof of dt_TCC1.3.1.2.2.

dt_TCC1.3.1.3:

{-1} non_bool_integral?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} non_bool_integral?(typ(t′))

which is trivially true. This completes the proof of dt_TCC1.3.1.3.

dt_TCC1.3.2:

{-1} enum?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Instantiating the top quantifier in 1 with the terms: (dt_enum(typ(t!1))), we get 3 subgoals:

dt_TCC1.3.2.1:

{-1} enum?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} true

which is trivially true. This completes the proof of dt_TCC1.3.2.1.

dt_TCC1.3.2.2:

{-1} enum?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} (∀ (x: int): range_enum(typ(t′))(x) ≡ range(t′)(x)) ∧

(∀ (x: int): range_enum(typ(t′))(x) ≡ range(t′)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ(t′))))]

((range(t′)))(dt_enum(typ(t′))`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_enum(typ(t′)))

Expanding the definition of range, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_TCC1.3.2.2.1:

{-1} enum?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} interpreted_data_type?[((range(t′)))](dt_enum(typ(t′)))

Adding type constraints for dt_enum(typ(t!1)), Using lemma pod_is_interpreted_data[(range_enum(typ(t′)))], Keeping (-1 -3 1) and hiding *, Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_TCC1.3.2.2.1.1:

{-1} uninterpreted_data_type?(dt_enum(typ(t′))`uidt)

{-2} ∀ (d: ((range_enum(typ(t′)))), a: Address):

valid?(uidt(dt_enum(typ(t′))))(to_byte(dt_enum(typ(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(typ(t′))))(l, a) ≡ up?(from_byte(dt_enum(typ(t′)))(l, a))

{-4} ∀ (d: ((range_enum(typ(t′)))), a: Address):

down(from_byte(dt_enum(typ(t′)))(to_byte(dt_enum(typ(t′)))(d, a), a)) = d

{-5} enum?(typ(t′))
{1} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_enum(typ(t′))))(to_byte(dt_enum(typ(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 -5 1) and hiding *, Expanding the definition of range, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC1.3.2.2.1.1.

dt_TCC1.3.2.2.1.2:

{-1} uninterpreted_data_type?(dt_enum(typ(t′))`uidt)

{-2} ∀ (d: ((range_enum(typ(t′)))), a: Address):

valid?(uidt(dt_enum(typ(t′))))(to_byte(dt_enum(typ(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(typ(t′))))(l, a) ≡ up?(from_byte(dt_enum(typ(t′)))(l, a))

{-4} ∀ (d: ((range_enum(typ(t′)))), a: Address):

down(from_byte(dt_enum(typ(t′)))(to_byte(dt_enum(typ(t′)))(d, a), a)) = d

{-5} enum?(typ(t′))
{1} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_enum(typ(t′)))(to_byte(dt_enum(typ(t′)))(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC1.3.2.2.1.2.

dt_TCC1.3.2.2.2:

{-1} enum?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(typ(t′))))] (range_enum(typ(t′)))(dt_enum(typ(t′))`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC1.3.2.2.2.

dt_TCC1.3.2.3:

{-1} enum?(typ(t′))
{-2} Cpp_Type?(const(t′))
{-3} volatile?(t′)
{-4} typ′ = const(t′)
{1} Cpp_Type?(typ(t′)) ∧ enum?(typ(t′))

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -3 with the terms: (t!2), Expanding the definition of subterm, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC1.3.2.3. Q.E.D.

C.44.34 Cpp_Types.dt_TCC2

Terse proof for dt_TCC2.

dt_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(non_bool_integral_enum?)) |

restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(non_bool_integral_enum?)), Cpp_Subtype(cv(non_bool_integral_enum?))],

boolean]

(≪)(z, typ)} →

(interpreted_data_type?[((range(typ1)))])], t: Cpp_Type_):

typ = const(t) ⊃ (∀ (x: int): range(t)(x) ≡ range(typ)(x)) ∧ (∀ (x: int): range(t)(x) ≡ range(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[((range(t)))]

((range(typ)))(dt_const[((range(t)))](v(t))`from_byte(x_{1}))) ∧ interpreted_data_type?[(range(typ))](dt_const[((range(t)))](v(t)))

Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of range, Applying propositional simplification, we get 2 subgoals:

dt_TCC2.1:

{-1} Cpp_Type?(const(t′))
{-2} cv(non_bool_integral_enum?)(const(t′))
{-3} typ′ = const(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range(t′)))] ((range(const(t′)))) (dt_const[((range(t′)))](v′(t′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC2.1.

dt_TCC2.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(non_bool_integral_enum?)(const(t′))
{-3} typ′ = const(t′)
{1} interpreted_data_type?[((range(typ′)))](dt_const[((range(t′)))](v′(t′)))

Adding type constraints for dt_const(v!1(t!1)), we get 2 subgoals:

dt_TCC2.2.1:

{-1} interpreted_data_type?[((range(t′)))](dt_const(v′(t′)))
{-2} Cpp_Type?(const(t′))
{-3} cv(non_bool_integral_enum?)(const(t′))
{-4} typ′ = const(t′)
{1} interpreted_data_type?[((range(typ′)))](dt_const[((range(t′)))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_TCC2.2.1.1:

{-1} uninterpreted_data_type?(dt_const(v′(t′))`uidt)
{-2} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_const(v′(t′))))(to_byte(dt_const(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(v′(t′))))(l, a) ≡ up?(from_byte(dt_const(v′(t′)))(l, a))

{-4} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_const(v′(t′)))(to_byte(dt_const(v′(t′)))(d, a), a)) = d

{-5} Cpp_Type?(const(t′))
{-6} cv(non_bool_integral_enum?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range(typ′))), a: Address):

valid?(uidt(dt_const[((range(t′)))](v′(t′))))

(to_byte(dt_const[((range(t′)))](v′(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -7, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC2.2.1.1.

dt_TCC2.2.1.2:

{-1} uninterpreted_data_type?(dt_const(v′(t′))`uidt)
{-2} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_const(v′(t′))))(to_byte(dt_const(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(v′(t′))))(l, a) ≡ up?(from_byte(dt_const(v′(t′)))(l, a))

{-4} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_const(v′(t′)))(to_byte(dt_const(v′(t′)))(d, a), a)) = d

{-5} Cpp_Type?(const(t′))
{-6} cv(non_bool_integral_enum?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range(typ′))), a: Address):

down(from_byte(dt_const[((range(t′)))](v′(t′)))

(to_byte(dt_const[((range(t′)))](v′(t′)))(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC2.2.1.2.

dt_TCC2.2.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(non_bool_integral_enum?)(const(t′))
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true
{2} interpreted_data_type?[((range(typ′)))](dt_const[((range(t′)))](v′(t′)))

Using lemma dt_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC2.2.2. Q.E.D.

C.44.35 Cpp_Types.dt_TCC3

Terse proof for dt_TCC3.

dt_TCC3:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)), t: Cpp_Type_): typ = volatile(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range(t)))])): true)

Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_TCC3.1:

{-1} Cpp_Type?(volatile(t′))
{-2} non_bool_integral_enum?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Keeping (-2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC3.1.

dt_TCC3.2:

{-1} Cpp_Type?(volatile(t′))
{-2} non_bool_integral_enum?(t′)
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Expanding the definition of non_bool_integral_enum?, Applying propositional simplification, we get 2 subgoals:

dt_TCC3.2.1:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Instantiating the top quantifier in 1 with the terms: (dt_integral(t!1)), we get 3 subgoals:

dt_TCC3.2.1.1:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} true

which is trivially true. This completes the proof of dt_TCC3.2.1.1.

dt_TCC3.2.1.2:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)

{1} (∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)) ∧ (∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[((range_integral(t′)))]

((range(t′)))(dt_integral(t′)`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_integral(t′))

Applying propositional simplification, we get 4 subgoals:

dt_TCC3.2.1.2.1:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC3.2.1.2.1.

dt_TCC3.2.1.2.2:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∀ (x: int): range_integral(t′)(x) ≡ range(t′)(x)

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC3.2.1.2.2.

dt_TCC3.2.1.2.3:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_integral(t′)))]((range(t′)))(dt_integral(t′)`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Adding type constraints for down(dt_integral(t!1)‘from_byte(x1!1)), Expanding the definition of range, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC3.2.1.2.3.

dt_TCC3.2.1.2.4:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} interpreted_data_type?[((range(t′)))](dt_integral(t′))

Adding type constraints for dt_integral(t!1), Using lemma pod_is_interpreted_data[(range_integral(t′))], Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_TCC3.2.1.2.4.1:

{-1} uninterpreted_data_type?(dt_integral(t′)`uidt)

{-2} ∀ (d: ((range_integral(t′))), a: Address):

valid?(uidt(dt_integral(t′)))(to_byte(dt_integral(t′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(t′)))(l, a) ≡ up?(from_byte(dt_integral(t′))(l, a))

{-4} ∀ (d: ((range_integral(t′))), a: Address):

down(from_byte(dt_integral(t′))(to_byte(dt_integral(t′))(d, a), a)) = d

{-5} pod_data_type?[((range_integral(t′)))](dt_integral(t′))
{-6} non_bool_integral?(t′)
{-7} Cpp_Type?(volatile(t′))
{-8} typ′ = volatile(t′)
{1} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_integral(t′)))(to_byte(dt_integral(t′))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 -6 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC3.2.1.2.4.1.

dt_TCC3.2.1.2.4.2:

{-1} uninterpreted_data_type?(dt_integral(t′)`uidt)

{-2} ∀ (d: ((range_integral(t′))), a: Address):

valid?(uidt(dt_integral(t′)))(to_byte(dt_integral(t′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_integral(t′)))(l, a) ≡ up?(from_byte(dt_integral(t′))(l, a))

{-4} ∀ (d: ((range_integral(t′))), a: Address):

down(from_byte(dt_integral(t′))(to_byte(dt_integral(t′))(d, a), a)) = d

{-5} pod_data_type?[((range_integral(t′)))](dt_integral(t′))
{-6} non_bool_integral?(t′)
{-7} Cpp_Type?(volatile(t′))
{-8} typ′ = volatile(t′)
{1} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_integral(t′))(to_byte(dt_integral(t′))(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 -6 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC3.2.1.2.4.2.

dt_TCC3.2.1.3:

{-1} non_bool_integral?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} non_bool_integral?(t′)

which is trivially true. This completes the proof of dt_TCC3.2.1.3.

dt_TCC3.2.2:

{-1} enum?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

Instantiating the top quantifier in 1 with the terms: (dt_enum(t!1)), we get 3 subgoals:

dt_TCC3.2.2.1:

{-1} enum?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} true

which is trivially true. This completes the proof of dt_TCC3.2.2.1.

dt_TCC3.2.2.2:

{-1} enum?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} (∀ (x: int): range_enum(t′)(x) ≡ range(t′)(x)) ∧
(∀ (x: int): range_enum(t′)(x) ≡ range(t′)(x)) ∧
(∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(t′)))]((range(t′)))(dt_enum(t′)`from_byte(x_{1}))) ∧ interpreted_data_type?[((range(t′)))](dt_enum(t′))

Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_TCC3.2.2.2.1:

{-1} enum?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} interpreted_data_type?[((range(t′)))](dt_enum(t′))

Adding type constraints for dt_enum(t!1), Using lemma pod_is_interpreted_data[(range_enum(t′))], Hiding formulas: (-2 -4 -5), Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_TCC3.2.2.2.1.1:

{-1} uninterpreted_data_type?(dt_enum(t′)`uidt)

{-2} ∀ (d: ((range_enum(t′))), a: Address):

valid?(uidt(dt_enum(t′)))(to_byte(dt_enum(t′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(t′)))(l, a) ≡ up?(from_byte(dt_enum(t′))(l, a))

{-4} ∀ (d: ((range_enum(t′))), a: Address):

down(from_byte(dt_enum(t′))(to_byte(dt_enum(t′))(d, a), a)) = d

{-5} enum?(t′)
{1} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_enum(t′)))(to_byte(dt_enum(t′))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC3.2.2.2.1.1.

dt_TCC3.2.2.2.1.2:

{-1} uninterpreted_data_type?(dt_enum(t′)`uidt)

{-2} ∀ (d: ((range_enum(t′))), a: Address):

valid?(uidt(dt_enum(t′)))(to_byte(dt_enum(t′))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_enum(t′)))(l, a) ≡ up?(from_byte(dt_enum(t′))(l, a))

{-4} ∀ (d: ((range_enum(t′))), a: Address):

down(from_byte(dt_enum(t′))(to_byte(dt_enum(t′))(d, a), a)) = d

{-5} enum?(t′)
{1} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_enum(t′))(to_byte(dt_enum(t′))(d, a), a)) = d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC3.2.2.2.1.2.

dt_TCC3.2.2.2.2:

{-1} enum?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_enum(t′)))](range_enum(t′))(dt_enum(t′)`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC3.2.2.2.2.

dt_TCC3.2.2.3:

{-1} enum?(t′)
{-2} Cpp_Type?(volatile(t′))
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′) ∧ enum?(t′)

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -3 with the terms: (t!2), Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC3.2.2.3. Q.E.D.

C.44.36 Cpp_Types.dt_TCC4

Terse proof for dt_TCC4.

dt_TCC4:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(non_bool_integral_enum?)) |

restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(non_bool_integral_enum?)), Cpp_Subtype(cv(non_bool_integral_enum?))],

boolean]

(≪)(z, typ)} →

(interpreted_data_type?[((range(typ1)))])], t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (x: int): range(t)(x) ≡ range(typ)(x)) ∧ (∀ (x: int): range(t)(x) ≡ range(typ)(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[((range(t)))] ((range(typ))) (dt_volatile[((range(t)))](v(t))`from_byte(x_{1})))

∧

interpreted_data_type?[(range(typ))](dt_volatile[((range(t)))](v(t)))

Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of range, Applying propositional simplification, we get 2 subgoals:

dt_TCC4.1:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(non_bool_integral_enum?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range(t′)))] ((range(volatile(t′)))) (dt_volatile[((range(t′)))](v′(t′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC4.1.

dt_TCC4.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(non_bool_integral_enum?)(volatile(t′))
{-3} typ′ = volatile(t′)

{1} interpreted_data_type?[((range(typ′)))] (dt_volatile[((range(t′)))](v′(t′)))

Adding type constraints for dt_volatile(v!1(t!1)),

C.44 Proofs for Cpp_Types (types.pvs)

we get 2 subgoals:

dt_TCC4.2.1:

{-1} interpreted_data_type?[((range(t′)))](dt_volatile(v′(t′)))
{-2} Cpp_Type?(volatile(t′))
{-3} cv(non_bool_integral_enum?)(volatile(t′))
{-4} typ′ = volatile(t′)

{1} interpreted_data_type?[((range(typ′)))]

(dt_volatile[((range(t′)))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_TCC4.2.1.1:

{-1} uninterpreted_data_type?(dt_volatile(v′(t′))`uidt)
{-2} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_volatile(v′(t′))))(to_byte(dt_volatile(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(v′(t′))))(l, a) ≡ up?(from_byte(dt_volatile(v′(t′)))(l, a))

{-4} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_volatile(v′(t′)))

(to_byte(dt_volatile(v′(t′)))(d, a), a))

= d

{-5} Cpp_Type?(volatile(t′))
{-6} cv(non_bool_integral_enum?)(volatile(t′))
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range(typ′))), a: Address):

valid?(uidt(dt_volatile[((range(t′)))](v′(t′))))

(to_byte(dt_volatile[((range(t′)))](v′(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -7, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC4.2.1.1.

dt_TCC4.2.1.2:

{-1} uninterpreted_data_type?(dt_volatile(v′(t′))`uidt)
{-2} ∀ (d: ((range(t′))), a: Address):

valid?(uidt(dt_volatile(v′(t′))))(to_byte(dt_volatile(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(v′(t′))))(l, a) ≡ up?(from_byte(dt_volatile(v′(t′)))(l, a))

{-4} ∀ (d: ((range(t′))), a: Address):

down(from_byte(dt_volatile(v′(t′)))

(to_byte(dt_volatile(v′(t′)))(d, a), a))

= d

{-5} Cpp_Type?(volatile(t′))
{-6} cv(non_bool_integral_enum?)(volatile(t′))
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range(typ′))), a: Address):

down(from_byte(dt_volatile[((range(t′)))](v′(t′)))

(to_byte(dt_volatile[((range(t′)))](v′(t′)))(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of range, which is trivially true. This completes the proof of dt_TCC4.2.1.2.

dt_TCC4.2.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(non_bool_integral_enum?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range(t′)))])): true

{2} interpreted_data_type?[((range(typ′)))] (dt_volatile[((range(t′)))](v′(t′)))

Using lemma dt_TCC3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_TCC4.2.2. Q.E.D.

C.44.37 Cpp_Types.dt_TCC5

Terse proof for dt_TCC5.

dt_TCC5:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ non_bool_integral_enum?(typ)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_TCC5. Q.E.D.

C.44.38 Cpp_Types.dt_pod

Terse proof for dt_pod.

dt_pod:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))):

pod_data_type?[(range(typ))](dt(typ))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: cv c v Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

dt_pod.1:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ′)
{1} pod_data_type?[((range(typ′)))](dt(typ′))

Expanding the definition of dt, Adding type constraints for dt_non_bool_integral_enum(typ!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_pod.1.1:

{-1} pod_data_type?[((range(typ′)))](dt_non_bool_integral_enum(typ′))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ′)
{-4} const?(typ′)
{1} pod_data_type?[((range(typ′)))](dt_const(dt(typ(typ′))))

Keeping (-3 -4) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_pod.1.1.

dt_pod.1.2:

{-1} pod_data_type?[((range(typ′)))](dt_non_bool_integral_enum(typ′))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ′)
{-4} volatile?(typ′)
{1} pod_data_type?[((range(typ′)))](dt_volatile(dt(typ(typ′))))

Keeping (-3 -4) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_pod.1.2.

dt_pod.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} pod_data_type?[((range(typ′)))](dt(typ′))

Expanding the definition of dt, Using lemma dt_const_pod[(range(typ(typ′)))], we get 3 subgoals:

dt_pod.2.1:

{-1} pod_data_type?[(range(typ(typ′)))](dt_const(dt(typ(typ′))))
{-2} Cpp_Type?(typ′)
{-3} const?(typ′)
{-4} non_bool_integral_enum?(typ(typ′))
{1} pod_data_type?[((range(typ′)))](dt_const(dt(typ(typ′))))

Expanding the definition of pod_data_type?, Adding type constraints for dt_const(dt(typ(typ!1))), we get 2 subgoals:

dt_pod.2.1.1:

{-1} interpreted_data_type?[(range(typ(typ′)))](dt_const(dt(typ(typ′))))

{-2} (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_const(dt(typ(typ′))))) > 0

{-3} Cpp_Type?(typ′)
{-4} const?(typ′)
{-5} non_bool_integral_enum?(typ(typ′))

{1} interpreted_data_type?(dt_const(dt(typ(typ′)))) ∧

(∀ (l: list[Byte], a_{1}, a_{2}: Address): valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_const(dt(typ(typ′))))) > 0

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_pod.2.1.1.1:

{-1} uninterpreted_data_type?(dt_const(dt(typ(typ′)))`uidt)

{-2} ∀ (d: ((range(typ(typ′)))), a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a) ≡ up?(from_byte(dt_const(dt(typ(typ′))))(l, a))

{-4} ∀ (d: ((range(typ(typ′)))), a: Address):

down(from_byte(dt_const(dt(typ(typ′))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a))

= d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2})

{-6} size(uidt(dt_const(dt(typ(typ′))))) > 0
{-7} Cpp_Type?(typ′)
{-8} const?(typ′)
{-9} non_bool_integral_enum?(typ(typ′))

{1} ∀ (d: ((range(typ′))), a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_pod.2.1.1.1.

dt_pod.2.1.1.2:

{-1} uninterpreted_data_type?(dt_const(dt(typ(typ′)))`uidt)

{-2} ∀ (d: ((range(typ(typ′)))), a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a) ≡ up?(from_byte(dt_const(dt(typ(typ′))))(l, a))

{-4} ∀ (d: ((range(typ(typ′)))), a: Address):

down(from_byte(dt_const(dt(typ(typ′))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a))

= d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2})

{-6} size(uidt(dt_const(dt(typ(typ′))))) > 0
{-7} Cpp_Type?(typ′)
{-8} const?(typ′)
{-9} non_bool_integral_enum?(typ(typ′))

{1} ∀ (d: ((range(typ′))), a: Address):

down(from_byte(dt_const(dt(typ(typ′))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_pod.2.1.1.2.

dt_pod.2.1.2:

{-1} (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_const(dt(typ(typ′))))) > 0

{-2} Cpp_Type?(typ′)
{-3} const?(typ′)
{-4} non_bool_integral_enum?(typ(typ′))
{1} ∃ (x_{1}: (interpreted_data_type?[(range(typ(typ′)))])): true

{2} interpreted_data_type?(dt_const(dt(typ(typ′)))) ∧ (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_const(dt(typ(typ′))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt(typ(typ!1))), which is trivially true. This completes the proof of dt_pod.2.1.2.

dt_pod.2.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} pod_data_type?[(range(typ(typ′)))](dt(typ(typ′)))
{2} pod_data_type?[((range(typ′)))](dt_const(dt(typ(typ′))))

Hiding formulas: (-2 2), Expanding the definition of dt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_pod.2.2.1:

{-1} const?(typ(typ′))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} pod_data_type?[(range(typ(typ′)))](dt_const(dt(typ(typ(typ′)))))

Keeping (-1 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_pod.2.2.1.

dt_pod.2.2.2:

{-1} volatile?(typ(typ′))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} pod_data_type?[(range(typ(typ′)))](dt_volatile(dt(typ(typ(typ′)))))

Keeping (-1 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_pod.2.2.2.

dt_pod.2.3:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} ∃ (x_{1}: (interpreted_data_type?[(range(typ(typ′)))])): true
{2} pod_data_type?[((range(typ′)))](dt_const(dt(typ(typ′))))

Instantiating the top quantifier in 1 with the terms: (dt(typ(typ!1))), which is trivially true. This completes the proof of dt_pod.2.3.

dt_pod.3:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{1} pod_data_type?[((range(typ′)))](dt(typ′))

Expanding the definition of dt, Using lemma dt_const_pod[(range(typ(typ′)))], we get 3 subgoals:

dt_pod.3.1:

{-1} pod_data_type?[(range(typ(typ′)))](dt_const(dt(typ(typ′))))
{-2} Cpp_Type?(typ′)
{-3} const?(typ′)
{-4} volatile?(typ(typ′))
{-5} non_bool_integral_enum?(typ(typ(typ′)))
{1} pod_data_type?[((range(typ′)))](dt_const(dt(typ(typ′))))

Expanding the definition of pod_data_type?, Adding type constraints for dt_const(dt(typ(typ!1))), we get 2 subgoals:

dt_pod.3.1.1:

{-1} interpreted_data_type?[(range(typ(typ′)))](dt_const(dt(typ(typ′))))

{-2} (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_const(dt(typ(typ′))))) > 0

{-3} Cpp_Type?(typ′)
{-4} const?(typ′)
{-5} volatile?(typ(typ′))
{-6} non_bool_integral_enum?(typ(typ(typ′)))

{1} interpreted_data_type?(dt_const(dt(typ(typ′)))) ∧

(∀ (l: list[Byte], a_{1}, a_{2}: Address): valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_const(dt(typ(typ′))))) > 0

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_pod.3.1.1.1:

{-1} uninterpreted_data_type?(dt_const(dt(typ(typ′)))`uidt)

{-2} ∀ (d: ((range(typ(typ′)))), a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a) ≡ up?(from_byte(dt_const(dt(typ(typ′))))(l, a))

{-4} ∀ (d: ((range(typ(typ′)))), a: Address):

down(from_byte(dt_const(dt(typ(typ′))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a))

= d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2})

{-6} size(uidt(dt_const(dt(typ(typ′))))) > 0
{-7} Cpp_Type?(typ′)
{-8} const?(typ′)
{-9} volatile?(typ(typ′))
{-10} non_bool_integral_enum?(typ(typ(typ′)))

{1} ∀ (d: ((range(typ′))), a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_pod.3.1.1.1.

dt_pod.3.1.1.2:

{-1} uninterpreted_data_type?(dt_const(dt(typ(typ′)))`uidt)

{-2} ∀ (d: ((range(typ(typ′)))), a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a) ≡ up?(from_byte(dt_const(dt(typ(typ′))))(l, a))

{-4} ∀ (d: ((range(typ(typ′)))), a: Address):

down(from_byte(dt_const(dt(typ(typ′))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a))

= d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2})

{-6} size(uidt(dt_const(dt(typ(typ′))))) > 0
{-7} Cpp_Type?(typ′)
{-8} const?(typ′)
{-9} volatile?(typ(typ′))
{-10} non_bool_integral_enum?(typ(typ(typ′)))

{1} ∀ (d: ((range(typ′))), a: Address):

down(from_byte(dt_const(dt(typ(typ′))))

(to_byte(dt_const(dt(typ(typ′))))(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_pod.3.1.1.2.

dt_pod.3.1.2:

{-1} (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_const(dt(typ(typ′))))) > 0

{-2} Cpp_Type?(typ′)
{-3} const?(typ′)
{-4} volatile?(typ(typ′))
{-5} non_bool_integral_enum?(typ(typ(typ′)))
{1} ∃ (x_{1}: (interpreted_data_type?[(range(typ(typ′)))])): true

{2} interpreted_data_type?(dt_const(dt(typ(typ′)))) ∧ (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_const(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_const(dt(typ(typ′))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt(typ(typ!1))), which is trivially true.

This completes the proof of dt_pod.3.1.2.

dt_pod.3.2:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{1} pod_data_type?[(range(typ(typ′)))](dt(typ(typ′)))
{2} pod_data_type?[((range(typ′)))](dt_const(dt(typ(typ′))))

Hiding formulas: (-2 2), Expanding the definition of dt, Using lemma dt_volatile_pod[(range(typ(typ(typ′))))], we get 3 subgoals:

dt_pod.3.2.1:

{-1} pod_data_type?[(range(typ(typ(typ′))))](dt_volatile(dt(typ(typ(typ′)))))
{-2} Cpp_Type?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{1} pod_data_type?[(range(typ(typ′)))](dt_volatile(dt(typ(typ(typ′)))))

Expanding the definition of pod_data_type?, Adding type constraints for dt_volatile(dt(typ(typ(typ!1)))), we get 2 subgoals:

dt_pod.3.2.1.1:

{-1} interpreted_data_type?[(range(typ(typ(typ′))))] (dt_volatile(dt(typ(typ(typ′)))))

{-2} (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{2}))

∧ size(uidt(dt_volatile(dt(typ(typ(typ′)))))) > 0

{-3} Cpp_Type?(typ′)
{-4} volatile?(typ(typ′))
{-5} non_bool_integral_enum?(typ(typ(typ′)))

{1} interpreted_data_type?(dt_volatile(dt(typ(typ(typ′))))) ∧

(∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{2}))

∧ size(uidt(dt_volatile(dt(typ(typ(typ′)))))) > 0

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_pod.3.2.1.1.1:

{-1} uninterpreted_data_type?(dt_volatile(dt(typ(typ(typ′))))`uidt)

{-2} ∀ (d: ((range(typ(typ(typ′))))), a: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))

(to_byte(dt_volatile(dt(typ(typ(typ′)))))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a) ≡ up?(from_byte(dt_volatile(dt(typ(typ(typ′)))))(l, a))

{-4} ∀ (d: ((range(typ(typ(typ′))))), a: Address):

down(from_byte(dt_volatile(dt(typ(typ(typ′)))))

(to_byte(dt_volatile(dt(typ(typ(typ′)))))(d, a), a))

= d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{2})

{-6} size(uidt(dt_volatile(dt(typ(typ(typ′)))))) > 0
{-7} Cpp_Type?(typ′)
{-8} volatile?(typ(typ′))
{-9} non_bool_integral_enum?(typ(typ(typ′)))

{1} ∀ (d: ((range(typ(typ′)))), a: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))

(to_byte(dt_volatile(dt(typ(typ(typ′)))))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_pod.3.2.1.1.1.

dt_pod.3.2.1.1.2:

{-1} uninterpreted_data_type?(dt_volatile(dt(typ(typ(typ′))))`uidt)

{-2} ∀ (d: ((range(typ(typ(typ′))))), a: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))

(to_byte(dt_volatile(dt(typ(typ(typ′)))))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a) ≡ up?(from_byte(dt_volatile(dt(typ(typ(typ′)))))(l, a))

{-4} ∀ (d: ((range(typ(typ(typ′))))), a: Address):

down(from_byte(dt_volatile(dt(typ(typ(typ′)))))

(to_byte(dt_volatile(dt(typ(typ(typ′)))))(d, a), a))

= d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{2})

{-6} size(uidt(dt_volatile(dt(typ(typ(typ′)))))) > 0
{-7} Cpp_Type?(typ′)
{-8} volatile?(typ(typ′))
{-9} non_bool_integral_enum?(typ(typ(typ′)))

{1} ∀ (d: ((range(typ(typ′)))), a: Address):

down(from_byte(dt_volatile(dt(typ(typ(typ′)))))

(to_byte(dt_volatile(dt(typ(typ(typ′)))))(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_pod.3.2.1.1.2.

dt_pod.3.2.1.2:

{-1} (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{2}))

∧ size(uidt(dt_volatile(dt(typ(typ(typ′)))))) > 0

{-2} Cpp_Type?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{1} ∃ (x_{1}: (interpreted_data_type?[(range(typ(typ(typ′))))])): true

{2} interpreted_data_type?(dt_volatile(dt(typ(typ(typ′))))) ∧

(∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ(typ′))))))(l, a_{2}))

∧ size(uidt(dt_volatile(dt(typ(typ(typ′)))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt(typ(typ(typ!1)))), which is trivially true. This completes the proof of dt_pod.3.2.1.2.

dt_pod.3.2.2:

{-1} Cpp_Type?(typ′)
{-2} volatile?(typ(typ′))
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{1} pod_data_type?[(range(typ(typ(typ′))))](dt(typ(typ(typ′))))
{2} pod_data_type?[(range(typ(typ′)))](dt_volatile(dt(typ(typ(typ′)))))

Hiding formulas: (-2 2), Expanding the definition of dt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_pod.3.2.2.1:

{-1} const?(typ(typ(typ′)))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{1} pod_data_type?[(range(typ(typ(typ′))))](dt_const(dt(typ(typ(typ(typ′))))))

Keeping (-1 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_pod.3.2.2.1.

dt_pod.3.2.2.2:

{-1} volatile?(typ(typ(typ′)))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ(typ(typ′)))

{1} pod_data_type?[(range(typ(typ(typ′))))] (dt_volatile(dt(typ(typ(typ(typ′))))))

Keeping (-1 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_pod.3.2.2.2.

dt_pod.3.2.3:

{-1} Cpp_Type?(typ′)
{-2} volatile?(typ(typ′))
{-3} non_bool_integral_enum?(typ(typ(typ′)))
{1} ∃ (x_{1}: (interpreted_data_type?[(range(typ(typ(typ′))))])): true
{2} pod_data_type?[(range(typ(typ′)))](dt_volatile(dt(typ(typ(typ′)))))

Instantiating the top quantifier in 1 with the terms: (dt(typ(typ(typ!1)))), which is trivially true. This completes the proof of dt_pod.3.2.3.

dt_pod.3.3:

{-1} Cpp_Type?(typ′)
{-2} const?(typ′)
{-3} volatile?(typ(typ′))
{-4} non_bool_integral_enum?(typ(typ(typ′)))
{1} ∃ (x_{1}: (interpreted_data_type?[(range(typ(typ′)))])): true
{2} pod_data_type?[((range(typ′)))](dt_const(dt(typ(typ′))))

Instantiating the top quantifier in 1 with the terms: (dt(typ(typ!1))), which is trivially true. This completes the proof of dt_pod.3.3.

dt_pod.4:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{1} pod_data_type?[((range(typ′)))](dt(typ′))

Expanding the definition of dt, Using lemma dt_volatile_pod[(range(typ(typ′)))], we get 3 subgoals:

dt_pod.4.1:

{-1} pod_data_type?[(range(typ(typ′)))](dt_volatile(dt(typ(typ′))))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{-4} volatile?(typ′)
{1} pod_data_type?[((range(typ′)))](dt_volatile(dt(typ(typ′))))

Expanding the definition of pod_data_type?, Adding type constraints for dt_volatile(dt(typ(typ!1))), we get 2 subgoals:

dt_pod.4.1.1:

{-1} interpreted_data_type?[(range(typ(typ′)))](dt_volatile(dt(typ(typ′))))

{-2} (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_volatile(dt(typ(typ′))))) > 0

{-3} Cpp_Type?(typ′)
{-4} non_bool_integral_enum?(typ(typ′))
{-5} volatile?(typ′)

{1} interpreted_data_type?(dt_volatile(dt(typ(typ′)))) ∧

(∀ (l: list[Byte], a_{1}, a_{2}: Address): valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_volatile(dt(typ(typ′))))) > 0

Expanding the definition of interpreted_data_type?,

Applying propositional simplification,

we get 2 subgoals:

dt_pod.4.1.1.1:

{-1} uninterpreted_data_type?(dt_volatile(dt(typ(typ′)))`uidt)

{-2} ∀ (d: ((range(typ(typ′)))), a: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))

(to_byte(dt_volatile(dt(typ(typ′))))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a) ≡ up?(from_byte(dt_volatile(dt(typ(typ′))))(l, a))

{-4} ∀ (d: ((range(typ(typ′)))), a: Address):

down(from_byte(dt_volatile(dt(typ(typ′))))

(to_byte(dt_volatile(dt(typ(typ′))))(d, a), a))

= d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{2})

{-6} size(uidt(dt_volatile(dt(typ(typ′))))) > 0
{-7} Cpp_Type?(typ′)
{-8} non_bool_integral_enum?(typ(typ′))
{-9} volatile?(typ′)

{1} ∀ (d: ((range(typ′))), a: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))

(to_byte(dt_volatile(dt(typ(typ′))))(d, a), a)

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of range,

which is trivially true.

This completes the proof of dt_pod.4.1.1.1.

dt_pod.4.1.1.2:

{-1} uninterpreted_data_type?(dt_volatile(dt(typ(typ′)))`uidt)

{-2} ∀ (d: ((range(typ(typ′)))), a: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))

(to_byte(dt_volatile(dt(typ(typ′))))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a) ≡ up?(from_byte(dt_volatile(dt(typ(typ′))))(l, a))

{-4} ∀ (d: ((range(typ(typ′)))), a: Address):

down(from_byte(dt_volatile(dt(typ(typ′))))

(to_byte(dt_volatile(dt(typ(typ′))))(d, a), a))

= d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{2})

{-6} size(uidt(dt_volatile(dt(typ(typ′))))) > 0
{-7} Cpp_Type?(typ′)
{-8} non_bool_integral_enum?(typ(typ′))
{-9} volatile?(typ′)

{1} ∀ (d: ((range(typ′))), a: Address):

down(from_byte(dt_volatile(dt(typ(typ′))))

(to_byte(dt_volatile(dt(typ(typ′))))(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of range, which is trivially true. This completes the proof of dt_pod.4.1.1.2.

dt_pod.4.1.2:

{-1} (∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_volatile(dt(typ(typ′))))) > 0

{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{-4} volatile?(typ′)
{1} ∃ (x_{1}: (interpreted_data_type?[(range(typ(typ′)))])): true

{2} interpreted_data_type?(dt_volatile(dt(typ(typ′)))) ∧

(∀ (l: list[Byte], a_{1}, a_{2}: Address): valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{1}) ≡ valid?(uidt(dt_volatile(dt(typ(typ′)))))(l, a_{2}))

∧ size(uidt(dt_volatile(dt(typ(typ′))))) > 0

Instantiating the top quantifier in 1 with the terms: (dt(typ(typ!1))), which is trivially true. This completes the proof of dt_pod.4.1.2.

dt_pod.4.2:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{1} pod_data_type?[(range(typ(typ′)))](dt(typ(typ′)))
{2} pod_data_type?[((range(typ′)))](dt_volatile(dt(typ(typ′))))

Hiding formulas: (-3 2), Expanding the definition of dt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_pod.4.2.1:

{-1} const?(typ(typ′))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} pod_data_type?[(range(typ(typ′)))](dt_const(dt(typ(typ(typ′)))))

Keeping (-1 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_pod.4.2.1.

dt_pod.4.2.2:

{-1} volatile?(typ(typ′))
{-2} Cpp_Type?(typ′)
{-3} non_bool_integral_enum?(typ(typ′))
{1} pod_data_type?[(range(typ(typ′)))](dt_volatile(dt(typ(typ(typ′)))))

Keeping (-1 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_pod.4.2.2.

dt_pod.4.3:

{-1} Cpp_Type?(typ′)
{-2} non_bool_integral_enum?(typ(typ′))
{-3} volatile?(typ′)
{1} ∃ (x_{1}: (interpreted_data_type?[(range(typ(typ′)))])): true
{2} pod_data_type?[((range(typ′)))](dt_volatile(dt(typ(typ′))))

Instantiating the top quantifier in 1 with the terms: (dt(typ(typ!1))), which is trivially true. This completes the proof of dt_pod.4.3. Q.E.D.

C.44.39 Cpp_Types.dt_cv_pointer_TCC1

Terse proof for dt_cv_pointer_TCC1.
dt_cv_pointer_TCC1:

{1} well_founded?(λ (x: Cpp_Subtype(cv(pointer?)), y: Cpp_Subtype(cv(pointer?))):

restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(pointer?)), Cpp_Subtype(cv(pointer?))], boolean] (≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Subtype(cv(pointer?))], Expanding the definition of restrict, which is trivially true. This completes the proof of dt_cv_pointer_TCC1. Q.E.D.

C.44.40 Cpp_Types.dt_cv_pointer_TCC2

Terse proof for dt_cv_pointer_TCC2.
dt_cv_pointer_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t) ∧ cv(pointer?)(t)

Repeatedly Skolemizing and flattening, Replacing using formula -3, Applying propositional simplification, we get 2 subgoals:

dt_cv_pointer_TCC2.1:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer?)(const(t′))
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC2.1.

dt_cv_pointer_TCC2.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer?)(const(t′))
{-3} typ′ = const(t′)
{1} cv(pointer?)(t′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_pointer_TCC2.2. Q.E.D.

C.44.41 Cpp_Types.dt_cv_pointer_TCC3

Terse proof for dt_cv_pointer_TCC3.
dt_cv_pointer_TCC3:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_): typ = const(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(pointer?)), Cpp_Subtype(cv(pointer?))], boolean] (≪)(t, typ)

Repeatedly Skolemizing and flattening, Expanding the definition of restrict, Replacing using formula -3, Expanding the definition of «, which is trivially true. This completes the proof of dt_cv_pointer_TCC3.

Q.E.D.

C.44.42 Cpp_Types.dt_cv_pointer_TCC4

Terse proof for dt_cv_pointer_TCC4.
dt_cv_pointer_TCC4:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_pointer_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC4. Q.E.D.

C.44.43 Cpp_Types.dt_cv_pointer_TCC5

Terse proof for dt_cv_pointer_TCC5.
dt_cv_pointer_TCC5:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_):

typ = const(t) ⊃ pointer?(cv_base(t))

Repeatedly Skolemizing and flattening, Replacing using formula -3, Using lemma cv_base_result, we get 2 subgoals:

dt_cv_pointer_TCC5.1:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer?)(const(t′))
{-3} typ′ = const(t′)
{1} cv(pointer?)(t′)
{2} pointer?(cv_base(t′))

Using lemma dt_cv_pointer_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC5.1.

dt_cv_pointer_TCC5.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer?)(const(t′))
{-3} typ′ = const(t′)
{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(t′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_pointer_TCC5.2. Q.E.D.

C.44.44 Cpp_Types.dt_cv_pointer_TCC6

Terse proof for dt_cv_pointer_TCC6.
dt_cv_pointer_TCC6:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_): typ = const(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range_pointer(cv_base(t))))])): true)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (dt_pointer(cv_base(t!1))), we get 3 subgoals:

dt_cv_pointer_TCC6.1:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer?)(typ′)
{-3} typ′ = const(t′)
{1} true

which is trivially true. This completes the proof of dt_cv_pointer_TCC6.1.

dt_cv_pointer_TCC6.2:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer?)(typ′)
{-3} typ′ = const(t′)
{1} pointer?(cv_base(t′))

Using lemma dt_cv_pointer_TCC5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC6.2.

dt_cv_pointer_TCC6.3:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer?)(typ′)
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)

Using lemma dt_cv_pointer_TCC4, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC6.3. Q.E.D.

C.44.45 Cpp_Types.dt_cv_pointer_TCC7

Terse proof for dt_cv_pointer_TCC7.

dt_cv_pointer_TCC7:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(pointer?)) | restrict

[[Cpp_Type_, Cpp_Type_], [Cpp_Subtype(cv(pointer?)), Cpp_Subtype(cv(pointer?))], boolean] (≪)(z, typ)} →

(interpreted_data_type?[((range_pointer(cv_base(typ1))))])], t: Cpp_Type_):

typ = const(t) ⊃ (∀ (x: lift[Pointer_Base_Type]):

range_pointer(cv_base(t))(x) ≡ range_pointer(cv_base(typ))(x)) ∧ (∀ (x: lift[Pointer_Base_Type]):

range_pointer(cv_base(t))(x) ≡ range_pointer(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_pointer(cv_base(t))))] ((range_pointer(cv_base(typ)))) (dt_const[((range_pointer(cv_base(t))))](v(t))`from_byte(x_{1})))

∧

interpreted_data_type?[(range_pointer(cv_base(typ)))] (dt_const[((range_pointer(cv_base(t))))](v(t)))

Repeatedly Skolemizing and flattening,

Replacing using formula -3,

Expanding the definition of cv_base,

Applying propositional simplification,

we get 2 subgoals:

dt_cv_pointer_TCC7.1:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer?)(const(t′))
{-3} typ′ = const(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_pointer(cv_base(t′))))] ((range_pointer(cv_base(const(t′))))) (dt_const[((range_pointer(cv_base(t′))))](v′(t′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening,

Expanding the definition of every,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of cv_base,

which is trivially true.

This completes the proof of dt_cv_pointer_TCC7.1.

dt_cv_pointer_TCC7.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer?)(const(t′))
{-3} typ′ = const(t′)

{1} interpreted_data_type?[((range_pointer(cv_base(typ′))))] (dt_const[((range_pointer(cv_base(t′))))](v′(t′)))

Adding type constraints for dt_const(v!1(t!1)), we get 3 subgoals:

dt_cv_pointer_TCC7.2.1:

{-1} interpreted_data_type?[((range_pointer(cv_base(t′))))](dt_const(v′(t′)))
{-2} Cpp_Type?(const(t′))
{-3} cv(pointer?)(const(t′))
{-4} typ′ = const(t′)

{1} interpreted_data_type?[((range_pointer(cv_base(typ′))))] (dt_const[((range_pointer(cv_base(t′))))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_cv_pointer_TCC7.2.1.1:

{-1} uninterpreted_data_type?(dt_const(v′(t′))`uidt)

{-2} ∀ (d: ((range_pointer(cv_base(t′)))), a: Address):

valid?(uidt(dt_const(v′(t′))))(to_byte(dt_const(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(v′(t′))))(l, a) ≡ up?(from_byte(dt_const(v′(t′)))(l, a)) {-4} ∀ (d: ((range_pointer(cv_base(t′)))), a: Address):

down(from_byte(dt_const(v′(t′)))(to_byte(dt_const(v′(t′)))(d, a), a)) = d

{-5} Cpp_Type?(const(t′))
{-6} cv(pointer?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range_pointer(cv_base(typ′)))), a: Address):

valid?(uidt(dt_const[((range_pointer(cv_base(t′))))](v′(t′))))

(to_byte(dt_const[((range_pointer(cv_base(t′))))](v′(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true.

This completes the proof of dt_cv_pointer_TCC7.2.1.1.

dt_cv_pointer_TCC7.2.1.2:

{-1} uninterpreted_data_type?(dt_const(v′(t′))`uidt)

{-2} ∀ (d: ((range_pointer(cv_base(t′)))), a: Address):

valid?(uidt(dt_const(v′(t′))))(to_byte(dt_const(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(v′(t′))))(l, a) ≡ up?(from_byte(dt_const(v′(t′)))(l, a)) {-4} ∀ (d: ((range_pointer(cv_base(t′)))), a: Address):

down(from_byte(dt_const(v′(t′)))(to_byte(dt_const(v′(t′)))(d, a), a)) = d

{-5} Cpp_Type?(const(t′))
{-6} cv(pointer?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range_pointer(cv_base(typ′)))), a: Address):

down(from_byte(dt_const[((range_pointer(cv_base(t′))))](v′(t′)))

(to_byte(dt_const[((range_pointer(cv_base(t′))))](v′(t′)))

(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true.

This completes the proof of dt_cv_pointer_TCC7.2.1.2.
dt_cv_pointer_TCC7.2.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer?)(const(t′))
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_pointer(cv_base(t′))))])): true

{2} interpreted_data_type?[((range_pointer(cv_base(typ′))))] (dt_const[((range_pointer(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_pointer_TCC6, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC7.2.2.

dt_cv_pointer_TCC7.2.3:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer?)(const(t′))
{-3} typ′ = const(t′)
{1} pointer?(cv_base(t′))

{2} interpreted_data_type?[((range_pointer(cv_base(typ′))))] (dt_const[((range_pointer(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_pointer_TCC5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC7.2.3. Q.E.D.

C.44.46 Cpp_Types.dt_cv_pointer_TCC8

Terse proof for dt_cv_pointer_TCC8.
dt_cv_pointer_TCC8:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t) ∧ cv(pointer?)(t)

Repeatedly Skolemizing and flattening, Replacing using formula -3, Applying propositional simplification, we get 2 subgoals:

dt_cv_pointer_TCC8.1:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC8.1.

dt_cv_pointer_TCC8.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} cv(pointer?)(t′)

Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_pointer_TCC8.2. Q.E.D.

C.44.47 Cpp_Types.dt_cv_pointer_TCC9

Terse proof for dt_cv_pointer_TCC9.
dt_cv_pointer_TCC9:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_): typ = volatile(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(pointer?)), Cpp_Subtype(cv(pointer?))], boolean] (≪)(t, typ)

Expanding the definition of restrict, Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of «, which is trivially true.

This completes the proof of dt_cv_pointer_TCC9. Q.E.D.

C.44.48 Cpp_Types.dt_cv_pointer_TCC10

Terse proof for dt_cv_pointer_TCC10.
dt_cv_pointer_TCC10:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_pointer_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC10. Q.E.D.

C.44.49 Cpp_Types.dt_cv_pointer_TCC11

Terse proof for dt_cv_pointer_TCC11.
dt_cv_pointer_TCC11:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_): typ = volatile(t) ⊃ pointer?(cv_base(t))

Repeatedly Skolemizing and flattening, Using lemma dt_cv_pointer_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_pointer_TCC11. Q.E.D.

C.44.50 Cpp_Types.dt_cv_pointer_TCC12

Terse proof for dt_cv_pointer_TCC12.
dt_cv_pointer_TCC12:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)), t: Cpp_Type_):

typ = volatile(t) ⊃

(∃ (x_{1}: (interpreted_data_type?[((range_pointer(cv_base(t))))])): true)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (dt_pointer(cv_base(t!1))), we get 3 subgoals:

dt_cv_pointer_TCC12.1:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer?)(typ′)
{-3} typ′ = volatile(t′)
{1} true

C Proof scripts

which is trivially true. This completes the proof of dt_cv_pointer_TCC12.1.

dt_cv_pointer_TCC12.2:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer?)(typ′)
{-3} typ′ = volatile(t′)
{1} pointer?(cv_base(t′))

Using lemma dt_cv_pointer_TCC11, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC12.2.

dt_cv_pointer_TCC12.3:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)

Using lemma dt_cv_pointer_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC12.3. Q.E.D.

C.44.51 Cpp_Types.dt_cv_pointer_TCC13

Terse proof for dt_cv_pointer_TCC13.

dt_cv_pointer_TCC13:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(pointer?)) | restrict

[[Cpp_Type_, Cpp_Type_], [Cpp_Subtype(cv(pointer?)), Cpp_Subtype(cv(pointer?))], boolean] (≪)(z, typ)} →

(interpreted_data_type?[((range_pointer(cv_base(typ1))))])], t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (x: lift[Pointer_Base_Type]):

range_pointer(cv_base(t))(x) ≡ range_pointer(cv_base(typ))(x)) ∧ (∀ (x: lift[Pointer_Base_Type]):

range_pointer(cv_base(t))(x) ≡ range_pointer(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_pointer(cv_base(t))))] ((range_pointer(cv_base(typ)))) (dt_volatile[((range_pointer(cv_base(t))))](v(t))`from_byte

(x_{1})))

∧

interpreted_data_type?[(range_pointer(cv_base(typ)))] (dt_volatile[((range_pointer(cv_base(t))))](v(t)))

Repeatedly Skolemizing and flattening, Expanding the definition of cv_base, Replacing using formula -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_cv_pointer_TCC13.1:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer?)(volatile(t′))
{-3} typ′ = volatile(t′)

{1} interpreted_data_type?[((range_pointer(cv_base(typ′))))] (dt_volatile[((range_pointer(cv_base(t′))))](v′(t′)))

Adding type constraints for dt_volatile(v!1(t!1)), we get 3 subgoals:

dt_cv_pointer_TCC13.1.1:

{-1} interpreted_data_type?[((range_pointer(cv_base(t′))))](dt_volatile(v′(t′)))
{-2} Cpp_Type?(volatile(t′))
{-3} cv(pointer?)(volatile(t′))
{-4} typ′ = volatile(t′)

{1} interpreted_data_type?[((range_pointer(cv_base(typ′))))] (dt_volatile[((range_pointer(cv_base(t′))))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_cv_pointer_TCC13.1.1.1:

{-1} uninterpreted_data_type?(dt_volatile(v′(t′))`uidt)

{-2} ∀ (d: ((range_pointer(cv_base(t′)))), a: Address):

valid?(uidt(dt_volatile(v′(t′))))(to_byte(dt_volatile(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(v′(t′))))(l, a) ≡ up?(from_byte(dt_volatile(v′(t′)))(l, a)) {-4} ∀ (d: ((range_pointer(cv_base(t′)))), a: Address):

down(from_byte(dt_volatile(v′(t′)))

(to_byte(dt_volatile(v′(t′)))(d, a), a))

= d

{-5} Cpp_Type?(volatile(t′))
{-6} cv(pointer?)(volatile(t′))
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range_pointer(cv_base(typ′)))), a: Address):

valid?(uidt(dt_volatile[((range_pointer(cv_base(t′))))](v′(t′))))

(to_byte(dt_volatile[((range_pointer(cv_base(t′))))](v′(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true.

This completes the proof of dt_cv_pointer_TCC13.1.1.1.
dt_cv_pointer_TCC13.1.1.2:

{-1} uninterpreted_data_type?(dt_volatile(v′(t′))`uidt)

{-2} ∀ (d: ((range_pointer(cv_base(t′)))), a: Address):

valid?(uidt(dt_volatile(v′(t′))))(to_byte(dt_volatile(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(v′(t′))))(l, a) ≡ up?(from_byte(dt_volatile(v′(t′)))(l, a)) {-4} ∀ (d: ((range_pointer(cv_base(t′)))), a: Address):

down(from_byte(dt_volatile(v′(t′)))

(to_byte(dt_volatile(v′(t′)))(d, a), a))

= d

{-5} Cpp_Type?(volatile(t′))
{-6} cv(pointer?)(volatile(t′))
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range_pointer(cv_base(typ′)))), a: Address):

down(from_byte(dt_volatile[((range_pointer(cv_base(t′))))](v′(t′)))

(to_byte(dt_volatile[((range_pointer(cv_base(t′))))](v′(t′)))

(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true.

This completes the proof of dt_cv_pointer_TCC13.1.1.2.
dt_cv_pointer_TCC13.1.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_pointer(cv_base(t′))))])): true

{2} interpreted_data_type?[((range_pointer(cv_base(typ′))))] (dt_volatile[((range_pointer(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_pointer_TCC12, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC13.1.2.

dt_cv_pointer_TCC13.1.3:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} pointer?(cv_base(t′))

{2} interpreted_data_type?[((range_pointer(cv_base(typ′))))] (dt_volatile[((range_pointer(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_pointer_TCC11, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC13.1.3.

dt_cv_pointer_TCC13.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_pointer(cv_base(t′))))] ((range_pointer(cv_base(volatile(t′))))) (dt_volatile[((range_pointer(cv_base(t′))))](v′(t′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_pointer_TCC13.2. Q.E.D.

C.44.52 Cpp_Types.dt_cv_pointer_TCC14

Terse proof for dt_cv_pointer_TCC14.
dt_cv_pointer_TCC14:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ pointer?(typ)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_pointer_TCC14. Q.E.D.

C.44.53 Cpp_Types.dt_cv_pointer_TCC15

Terse proof for dt_cv_pointer_TCC15.
dt_cv_pointer_TCC15:

{1} ∀ (typ: Cpp_Subtype(cv(pointer?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ (∀ (x: lift[Pointer_Base_Type]):

range_pointer(typ)(x) ≡ range_pointer(cv_base(typ))(x)) ∧ (∀ (x: lift[Pointer_Base_Type]):

range_pointer(typ)(x) ≡ range_pointer(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_pointer(typ)))]

((range_pointer(cv_base(typ))))(dt_pointer(typ)`from_byte(x_{1}))) ∧ interpreted_data_type?[(range_pointer(cv_base(typ)))](dt_pointer(typ))

Repeatedly Skolemizing and flattening, Using lemma cv_base_result2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_cv_pointer_TCC15.1:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(pointer?)(typ′)
{1} const?(typ′)
{2} volatile?(typ′)
{3} interpreted_data_type?[((range_pointer(cv_base(typ′))))](dt_pointer(typ′))

Replacing using formula -1, Adding type constraints for dt_pointer(cv_base(typ!1)), Rewriting using pod_is_interpreted_data, matching in *, This completes the proof of dt_cv_pointer_TCC15.1.

dt_cv_pointer_TCC15.2:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(pointer?)(typ′)
{1} const?(typ′)
{2} volatile?(typ′)
{3} ∀ (x_{1}: [list[Byte], Address]):

every[((range_pointer(typ′)))] ((range_pointer(cv_base(typ′))))(dt_pointer(typ′)`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC15.2.

dt_cv_pointer_TCC15.3:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(pointer?)(typ′)
{1} const?(typ′)
{2} volatile?(typ′)

{3} ∀ (x: lift[Pointer_Base_Type]): range_pointer(typ′)(x) ≡ range_pointer(cv_base(typ′))(x)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_pointer_TCC15.3. Q.E.D.

C.44.54 Cpp_Types.dt_cv_bitfield_TCC1

Terse proof for dt_cv_bitfield_TCC1.
dt_cv_bitfield_TCC1:

{1} well_founded?(λ (x: Cpp_Subtype(cv(bitfield?)), y: Cpp_Subtype(cv(bitfield?))):

restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(bitfield?)), Cpp_Subtype(cv(bitfield?))], boolean] (≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Subtype(cv(bitfield?))], Expanding the definition of restrict, which is trivially true. This completes the proof of dt_cv_bitfield_TCC1. Q.E.D.

C.44.55 Cpp_Types.dt_cv_bitfield_TCC2

Terse proof for dt_cv_bitfield_TCC2.
dt_cv_bitfield_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_):

typ = const(t) ⊃ Cpp_Type?(t) ∧ cv(bitfield?)(t)

Repeatedly Skolemizing and flattening, Replacing using formula -3, Applying propositional simplification, we get 2 subgoals:

dt_cv_bitfield_TCC2.1:

{-1} Cpp_Type?(const(t′))
{-2} cv(bitfield?)(const(t′))
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC2.1.

dt_cv_bitfield_TCC2.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(bitfield?)(const(t′))
{-3} typ′ = const(t′)
{1} cv(bitfield?)(t′)

Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_bitfield_TCC2.2. Q.E.D.

C.44.56 Cpp_Types.dt_cv_bitfield_TCC3

Terse proof for dt_cv_bitfield_TCC3.
dt_cv_bitfield_TCC3:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_):

typ = const(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(bitfield?)), Cpp_Subtype(cv(bitfield?))], boolean] (≪)(t, typ)

Expanding the definition of restrict, Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of «, which is trivially true. This completes the proof of dt_cv_bitfield_TCC3. Q.E.D.

C.44.57 Cpp_Types.dt_cv_bitfield_TCC4

Terse proof for dt_cv_bitfield_TCC4.
dt_cv_bitfield_TCC4:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_bitfield_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC4. Q.E.D.

C.44.58 Cpp_Types.dt_cv_bitfield_TCC5

Terse proof for dt_cv_bitfield_TCC5.

dt_cv_bitfield_TCC5:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_): typ = const(t) ⊃ bitfield?(cv_base(t))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

dt_cv_bitfield_TCC5.1:

{-1} Cpp_Type?(typ′)
{-2} cv(bitfield?)(typ′)
{-3} typ′ = const(t′)
{1} cv(bitfield?)(t′)
{2} bitfield?(cv_base(t′))

Using lemma dt_cv_bitfield_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC5.1.

dt_cv_bitfield_TCC5.2:

{-1} Cpp_Type?(typ′)
{-2} cv(bitfield?)(typ′)
{-3} typ′ = const(t′)
{1} (bitfield? ⊆ interpreted?)
{2} bitfield?(cv_base(t′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_bitfield_TCC5.2. Q.E.D.

C.44.59 Cpp_Types.dt_cv_bitfield_TCC6

Terse proof for dt_cv_bitfield_TCC6.
dt_cv_bitfield_TCC6:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_): typ = const(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range_bitfield(cv_base(t))))])): true)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_bitfield_TCC2, Using lemma dt_bitfield_exists, we get 2 subgoals:

dt_cv_bitfield_TCC6.1:

{-1} typ′ = const(t′) ⊃ Cpp_Type?(t′) ∧ cv(bitfield?)(t′)
{-2} Cpp_Type?(typ′)
{-3} cv(bitfield?)(typ′)
{-4} typ′ = const(t′)
{1} bitfield?(cv_base(t′))
{2} ∃ (x_{1}: (interpreted_data_type?[((range_bitfield(cv_base(t′))))])): true

Using lemma dt_cv_bitfield_TCC5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC6.1.

dt_cv_bitfield_TCC6.2:

{-1} typ′ = const(t′) ⊃ Cpp_Type?(t′) ∧ cv(bitfield?)(t′)
{-2} Cpp_Type?(typ′)
{-3} cv(bitfield?)(typ′)
{-4} typ′ = const(t′)
{1} Cpp_Type?(t′)
{2} ∃ (x_{1}: (interpreted_data_type?[((range_bitfield(cv_base(t′))))])): true

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC6.2. Q.E.D.

C.44.60 Cpp_Types.dt_cv_bitfield_TCC7

Terse proof for dt_cv_bitfield_TCC7.
dt_cv_bitfield_TCC7:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(bitfield?)) | restrict

[[Cpp_Type_, Cpp_Type_], [Cpp_Subtype(cv(bitfield?)), Cpp_Subtype(cv(bitfield?))], boolean] (≪)(z, typ)} →

(interpreted_data_type?[((range_bitfield(cv_base(typ1))))])], t: Cpp_Type_):

typ = const(t) ⊃ (∀ (x: int):

range_bitfield(cv_base(t))(x) ≡ range_bitfield(cv_base(typ))(x)) ∧ (∀ (x: int):

range_bitfield(cv_base(t))(x) ≡ range_bitfield(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_bitfield(cv_base(t))))] ((range_bitfield(cv_base(typ)))) (dt_const[((range_bitfield(cv_base(t))))](v(t))`from_byte(x_{1})))

∧

interpreted_data_type?[(range_bitfield(cv_base(typ)))] (dt_const[((range_bitfield(cv_base(t))))](v(t)))

Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of cv_base, Applying propositional simplification, we get 2 subgoals:

dt_cv_bitfield_TCC7.1:

{-1} Cpp_Type?(const(t′))
{-2} cv(bitfield?)(const(t′))
{-3} typ′ = const(t′)

{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_bitfield(cv_base(t′))))] ((range_bitfield(cv_base(const(t′))))) (dt_const[((range_bitfield(cv_base(t′))))](v′(t′))`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_bitfield_TCC7.1.

dt_cv_bitfield_TCC7.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(bitfield?)(const(t′))
{-3} typ′ = const(t′)

{1} interpreted_data_type?[((range_bitfield(cv_base(typ′))))] (dt_const[((range_bitfield(cv_base(t′))))](v′(t′)))

Adding type constraints for dt_const(v!1(t!1)), we get 3 subgoals:

dt_cv_bitfield_TCC7.2.1:

{-1} interpreted_data_type?[((range_bitfield(cv_base(t′))))](dt_const(v′(t′)))
{-2} Cpp_Type?(const(t′))
{-3} cv(bitfield?)(const(t′))
{-4} typ′ = const(t′)

{1} interpreted_data_type?[((range_bitfield(cv_base(typ′))))] (dt_const[((range_bitfield(cv_base(t′))))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_cv_bitfield_TCC7.2.1.1:

{-1} uninterpreted_data_type?(dt_const(v′(t′))`uidt)

{-2} ∀ (d: ((range_bitfield(cv_base(t′)))), a: Address):

valid?(uidt(dt_const(v′(t′))))(to_byte(dt_const(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(v′(t′))))(l, a) ≡ up?(from_byte(dt_const(v′(t′)))(l, a))

{-4} ∀ (d: ((range_bitfield(cv_base(t′)))), a: Address):

down(from_byte(dt_const(v′(t′)))(to_byte(dt_const(v′(t′)))(d, a), a)) = d

{-5} Cpp_Type?(const(t′))
{-6} cv(bitfield?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range_bitfield(cv_base(typ′)))), a: Address):

valid?(uidt(dt_const[((range_bitfield(cv_base(t′))))](v′(t′))))

(to_byte(dt_const[((range_bitfield(cv_base(t′))))](v′(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true.

This completes the proof of dt_cv_bitfield_TCC7.2.1.1.
dt_cv_bitfield_TCC7.2.1.2:

{-1} uninterpreted_data_type?(dt_const(v′(t′))`uidt)

{-2} ∀ (d: ((range_bitfield(cv_base(t′)))), a: Address):

valid?(uidt(dt_const(v′(t′))))(to_byte(dt_const(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const(v′(t′))))(l, a) ≡ up?(from_byte(dt_const(v′(t′)))(l, a)) {-4} ∀ (d: ((range_bitfield(cv_base(t′)))), a: Address):

down(from_byte(dt_const(v′(t′)))(to_byte(dt_const(v′(t′)))(d, a), a)) = d

{-5} Cpp_Type?(const(t′))
{-6} cv(bitfield?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range_bitfield(cv_base(typ′)))), a: Address):

down(from_byte(dt_const[((range_bitfield(cv_base(t′))))](v′(t′)))

(to_byte(dt_const[((range_bitfield(cv_base(t′))))](v′(t′)))

(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true.

This completes the proof of dt_cv_bitfield_TCC7.2.1.2.
dt_cv_bitfield_TCC7.2.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(bitfield?)(const(t′))
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_bitfield(cv_base(t′))))])): true

{2} interpreted_data_type?[((range_bitfield(cv_base(typ′))))] (dt_const[((range_bitfield(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_bitfield_TCC6, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC7.2.2.

dt_cv_bitfield_TCC7.2.3:

{-1} Cpp_Type?(const(t′))
{-2} cv(bitfield?)(const(t′))
{-3} typ′ = const(t′)
{1} bitfield?(cv_base(t′))

{2} interpreted_data_type?[((range_bitfield(cv_base(typ′))))] (dt_const[((range_bitfield(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_bitfield_TCC5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC7.2.3. Q.E.D.

C.44.61 Cpp_Types.dt_cv_bitfield_TCC8

Terse proof for dt_cv_bitfield_TCC8.
dt_cv_bitfield_TCC8:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t) ∧ cv(bitfield?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

dt_cv_bitfield_TCC8.1:

{-1} Cpp_Type?(typ′)
{-2} cv(bitfield?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Replacing using formula -4, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC8.1.

dt_cv_bitfield_TCC8.2:

{-1} Cpp_Type?(typ′)
{-2} cv(bitfield?)(typ′)
{-3} typ′ = volatile(t′)
{1} cv(bitfield?)(t′)

Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_bitfield_TCC8.2. Q.E.D.

C.44.62 Cpp_Types.dt_cv_bitfield_TCC9

Terse proof for dt_cv_bitfield_TCC9.
dt_cv_bitfield_TCC9:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_): typ = volatile(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(bitfield?)), Cpp_Subtype(cv(bitfield?))], boolean] (≪)(t, typ)

Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of restrict, Expanding the definition of «, which is trivially true. This completes the proof of dt_cv_bitfield_TCC9. Q.E.D.

C.44.63 Cpp_Types.dt_cv_bitfield_TCC10

Terse proof for dt_cv_bitfield_TCC10.
dt_cv_bitfield_TCC10:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_bitfield_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC10. Q.E.D.

C.44.64 Cpp_Types.dt_cv_bitfield_TCC11

Terse proof for dt_cv_bitfield_TCC11.
dt_cv_bitfield_TCC11:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_): typ = volatile(t) ⊃ bitfield?(cv_base(t))

Repeatedly Skolemizing and flattening, Using lemma dt_cv_bitfield_TCC8, Using lemma cv_base_result, we get 2 subgoals:

dt_cv_bitfield_TCC11.1:

{-1} typ′ = volatile(t′) ⊃ Cpp_Type?(t′) ∧ cv(bitfield?)(t′)
{-2} Cpp_Type?(typ′)
{-3} cv(bitfield?)(typ′)
{-4} typ′ = volatile(t′)
{1} cv(bitfield?)(t′)
{2} bitfield?(cv_base(t′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC11.1.

dt_cv_bitfield_TCC11.2:

{-1} typ′ = volatile(t′) ⊃ Cpp_Type?(t′) ∧ cv(bitfield?)(t′)
{-2} Cpp_Type?(typ′)
{-3} cv(bitfield?)(typ′)
{-4} typ′ = volatile(t′)
{1} (bitfield? ⊆ interpreted?)
{2} bitfield?(cv_base(t′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_bitfield_TCC11.2.

Q.E.D.

C.44.65 Cpp_Types.dt_cv_bitfield_TCC12

Terse proof for dt_cv_bitfield_TCC12.
dt_cv_bitfield_TCC12:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)), t: Cpp_Type_): typ = volatile(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range_bitfield(cv_base(t))))])): true)

Repeatedly Skolemizing and flattening, Using lemma dt_bitfield_exists, we get 2 subgoals:

dt_cv_bitfield_TCC12.1:

{-1} Cpp_Type?(typ′)
{-2} cv(bitfield?)(typ′)
{-3} typ′ = volatile(t′)
{1} bitfield?(cv_base(t′))
{2} ∃ (x_{1}: (interpreted_data_type?[((range_bitfield(cv_base(t′))))])): true

Using lemma dt_cv_bitfield_TCC11, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC12.1.

dt_cv_bitfield_TCC12.2:

{-1} Cpp_Type?(typ′)
{-2} cv(bitfield?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)
{2} ∃ (x_{1}: (interpreted_data_type?[((range_bitfield(cv_base(t′))))])): true

Using lemma dt_cv_bitfield_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC12.2. Q.E.D.

C.44.66 Cpp_Types.dt_cv_bitfield_TCC13

Terse proof for dt_cv_bitfield_TCC13.

dt_cv_bitfield_TCC13:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(bitfield?)) | restrict

[[Cpp_Type_, Cpp_Type_], [Cpp_Subtype(cv(bitfield?)), Cpp_Subtype(cv(bitfield?))], boolean] (≪)(z, typ)} →

(interpreted_data_type?[((range_bitfield(cv_base(typ1))))])], t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (x: int):

range_bitfield(cv_base(t))(x) ≡ range_bitfield(cv_base(typ))(x)) ∧ (∀ (x: int):

range_bitfield(cv_base(t))(x) ≡ range_bitfield(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_bitfield(cv_base(t))))] ((range_bitfield(cv_base(typ)))) (dt_volatile[((range_bitfield(cv_base(t))))](v(t))`from_byte

(x_{1})))

∧

interpreted_data_type?[(range_bitfield(cv_base(typ)))] (dt_volatile[((range_bitfield(cv_base(t))))](v(t)))

Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of cv_base, Applying propositional simplification, we get 2 subgoals:

dt_cv_bitfield_TCC13.1:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(bitfield?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_bitfield(cv_base(t′))))] ((range_bitfield(cv_base(volatile(t′))))) (dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′))`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_bitfield_TCC13.1.

dt_cv_bitfield_TCC13.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(bitfield?)(volatile(t′))
{-3} typ′ = volatile(t′)

{1} interpreted_data_type?[((range_bitfield(cv_base(typ′))))] (dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′)))

Adding type constraints for dt_volatile(v!1(t!1)), we get 3 subgoals:

dt_cv_bitfield_TCC13.2.1:

{-1} interpreted_data_type?[((range_bitfield(cv_base(t′))))](dt_volatile(v′(t′)))
{-2} Cpp_Type?(volatile(t′))
{-3} cv(bitfield?)(volatile(t′))
{-4} typ′ = volatile(t′)

{1} interpreted_data_type?[((range_bitfield(cv_base(typ′))))] (dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_cv_bitfield_TCC13.2.1.1:

{-1} uninterpreted_data_type?(dt_volatile(v′(t′))`uidt)

{-2} ∀ (d: ((range_bitfield(cv_base(t′)))), a: Address):

valid?(uidt(dt_volatile(v′(t′))))(to_byte(dt_volatile(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(v′(t′))))(l, a) ≡ up?(from_byte(dt_volatile(v′(t′)))(l, a)) {-4} ∀ (d: ((range_bitfield(cv_base(t′)))), a: Address):

down(from_byte(dt_volatile(v′(t′)))

(to_byte(dt_volatile(v′(t′)))(d, a), a))

= d

{-5} Cpp_Type?(volatile(t′))
{-6} cv(bitfield?)(volatile(t′))
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range_bitfield(cv_base(typ′)))), a: Address):

valid?(uidt(dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′))))

(to_byte(dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true.

This completes the proof of dt_cv_bitfield_TCC13.2.1.1.

dt_cv_bitfield_TCC13.2.1.2:

{-1} uninterpreted_data_type?(dt_volatile(v′(t′))`uidt)

{-2} ∀ (d: ((range_bitfield(cv_base(t′)))), a: Address):

valid?(uidt(dt_volatile(v′(t′))))(to_byte(dt_volatile(v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile(v′(t′))))(l, a) ≡ up?(from_byte(dt_volatile(v′(t′)))(l, a)) {-4} ∀ (d: ((range_bitfield(cv_base(t′)))), a: Address):

down(from_byte(dt_volatile(v′(t′)))

(to_byte(dt_volatile(v′(t′)))(d, a), a))

= d

{-5} Cpp_Type?(volatile(t′))
{-6} cv(bitfield?)(volatile(t′))
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range_bitfield(cv_base(typ′)))), a: Address):

down(from_byte(dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′)))

(to_byte(dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′)))

(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true.

This completes the proof of dt_cv_bitfield_TCC13.2.1.2.
dt_cv_bitfield_TCC13.2.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(bitfield?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_bitfield(cv_base(t′))))])): true

{2} interpreted_data_type?[((range_bitfield(cv_base(typ′))))] (dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_bitfield_TCC12, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_cv_bitfield_TCC13.2.2.
dt_cv_bitfield_TCC13.2.3:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(bitfield?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} bitfield?(cv_base(t′))

{2} interpreted_data_type?[((range_bitfield(cv_base(typ′))))] (dt_volatile[((range_bitfield(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_bitfield_TCC11, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of dt_cv_bitfield_TCC13.2.3.

Q.E.D.

C.44.67 Cpp_Types.dt_cv_bitfield_TCC14

Terse proof for dt_cv_bitfield_TCC14.
dt_cv_bitfield_TCC14:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ bitfield?(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_bitfield_TCC14. Q.E.D.

C.44.68 Cpp_Types.dt_cv_bitfield_TCC15

Terse proof for dt_cv_bitfield_TCC15.
dt_cv_bitfield_TCC15:

{1} ∀ (typ: Cpp_Subtype(cv(bitfield?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ (∀ (x: int): range_bitfield(typ)(x) ≡ range_bitfield(cv_base(typ))(x)) ∧ (∀ (x: int): range_bitfield(typ)(x) ≡ range_bitfield(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_bitfield(typ)))]

((range_bitfield(cv_base(typ))))(dt_bitfield(typ)`from_byte(x_{1}))) ∧ interpreted_data_type?[(range_bitfield(cv_base(typ)))](dt_bitfield(typ))

Repeatedly Skolemizing and flattening, Using lemma cv_base_result2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_cv_bitfield_TCC15.1:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(bitfield?)(typ′)
{1} const?(typ′)
{2} volatile?(typ′)
{3} interpreted_data_type?[((range_bitfield(cv_base(typ′))))](dt_bitfield(typ′))

Replacing using formula -1, Adding type constraints for dt_bitfield(cv_base(typ!1)), which is trivially true. This completes the proof of dt_cv_bitfield_TCC15.1.

dt_cv_bitfield_TCC15.2:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(bitfield?)(typ′)
{1} const?(typ′)
{2} volatile?(typ′)
{3} ∀ (x_{1}: [list[Byte], Address]):

every[((range_bitfield(typ′)))] ((range_bitfield(cv_base(typ′))))(dt_bitfield(typ′)`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC15.2.

dt_cv_bitfield_TCC15.3:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(bitfield?)(typ′)
{1} const?(typ′)
{2} volatile?(typ′)
{3} ∀ (x: int): range_bitfield(typ′)(x) ≡ range_bitfield(cv_base(typ′))(x)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_bitfield_TCC15.3. Q.E.D.

C.44.69 Cpp_Types.dt_cv_ptm_TCC1

Terse proof for dt_cv_ptm_TCC1.
dt_cv_ptm_TCC1:

{1} well_founded?(λ (x: Cpp_Subtype(cv(pointer_to_member?)),

y: Cpp_Subtype(cv(pointer_to_member?))): restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(pointer_to_member?)), Cpp_Subtype(cv(pointer_to_member?))],

boolean]

(≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Subtype(cv(pointer_to_member?))], Expanding the definition of restrict, which is trivially true. This completes the proof of dt_cv_ptm_TCC1. Q.E.D.

C.44.70 Cpp_Types.dt_cv_ptm_TCC2

Terse proof for dt_cv_ptm_TCC2.

dt_cv_ptm_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t) ∧ cv(pointer_to_member?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

dt_cv_ptm_TCC2.1:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Expanding the definition of subterm, Replacing using formula -4, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC2.1.

dt_cv_ptm_TCC2.2:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = const(t′)
{1} cv(pointer_to_member?)(t′)

Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_ptm_TCC2.2. Q.E.D.

C.44.71 Cpp_Types.dt_cv_ptm_TCC3

Terse proof for dt_cv_ptm_TCC3.
dt_cv_ptm_TCC3:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = const(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_], [Cpp_Subtype(cv(pointer_to_member?)), Cpp_Subtype(cv(pointer_to_member?))], boolean] (≪)(t, typ)

Expanding the definition of restrict, Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of «, which is trivially true. This completes the proof of dt_cv_ptm_TCC3. Q.E.D.

C.44.72 Cpp_Types.dt_cv_ptm_TCC4

Terse proof for dt_cv_ptm_TCC4.
dt_cv_ptm_TCC4:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_ptm_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC4. Q.E.D.

C.44.73 Cpp_Types.dt_cv_ptm_TCC5

Terse proof for dt_cv_ptm_TCC5.
dt_cv_ptm_TCC5:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = const(t) ⊃ pointer_to_member?(cv_base(t))

Repeatedly Skolemizing and flattening, Using lemma cv_base_result, we get 2 subgoals:

dt_cv_ptm_TCC5.1:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = const(t′)
{1} cv(pointer_to_member?)(t′)
{2} pointer_to_member?(cv_base(t′))

Using lemma dt_cv_ptm_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC5.1.

dt_cv_ptm_TCC5.2:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = const(t′)
{1} (pointer_to_member?⊆ interpreted?)
{2} pointer_to_member?(cv_base(t′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_ptm_TCC5.2. Q.E.D.

C.44.74 Cpp_Types.dt_cv_ptm_TCC6

Terse proof for dt_cv_ptm_TCC6.

dt_cv_ptm_TCC6:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = const(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t))))])): true)

Repeatedly Skolemizing and flattening, Using lemma dt_pointer_to_member_exists, we get 3 subgoals:

dt_cv_ptm_TCC6.1:

{-1} ∃ (dt: (pod_data_type?[((range_ptm(cv_base(t′))))])): true
{-2} Cpp_Type?(typ′)
{-3} cv(pointer_to_member?)(typ′)
{-4} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t′))))])): true

Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of dt_cv_ptm_TCC6.1.

dt_cv_ptm_TCC6.2:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = const(t′)
{1} pointer_to_member?(cv_base(t′))
{2} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t′))))])): true

Using lemma dt_cv_ptm_TCC5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC6.2.

dt_cv_ptm_TCC6.3:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)
{2} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t′))))])): true

Using lemma dt_cv_ptm_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC6.3. Q.E.D.

C.44.75 Cpp_Types.dt_cv_ptm_TCC7

Terse proof for dt_cv_ptm_TCC7.

dt_cv_ptm_TCC7:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(pointer_to_member?)) |

restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(pointer_to_member?)), Cpp_Subtype(cv(pointer_to_member?))],

boolean]

(≪)(z, typ)} →

(interpreted_data_type?[((range_ptm(cv_base(typ1))))])], t: Cpp_Type_):

typ = const(t) ⊃ (∀ (x: nat): range_ptm(cv_base(t))(x) ≡ range_ptm(cv_base(typ))(x)) ∧ (∀ (x: nat): range_ptm(cv_base(t))(x) ≡ range_ptm(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_ptm(cv_base(t))))] ((range_ptm(cv_base(typ)))) (dt_const[((range_ptm(cv_base(t))))](v(t))`from_byte(x_{1})))

∧

interpreted_data_type?[(range_ptm(cv_base(typ)))] (dt_const[((range_ptm(cv_base(t))))](v(t)))

Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of cv_base, Applying propositional simplification, we get 2 subgoals:

dt_cv_ptm_TCC7.1:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer_to_member?)(const(t′))
{-3} typ′ = const(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_ptm(cv_base(t′))))] ((range_ptm(cv_base(const(t′))))) (dt_const[((range_ptm(cv_base(t′))))](v′(t′))`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_ptm_TCC7.1.

dt_cv_ptm_TCC7.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer_to_member?)(const(t′))
{-3} typ′ = const(t′)

{1} interpreted_data_type?[((range_ptm(cv_base(typ′))))] (dt_const[((range_ptm(cv_base(t′))))](v′(t′)))

C.44 Proofs for Cpp_Types (types.pvs)

Adding type constraints for dt_const[((range_ptm(cv_base(t!1))))](v!1(t!1)), we get 3 subgoals:

dt_cv_ptm_TCC7.2.1:

{-1} interpreted_data_type?[((range_ptm(cv_base(t′))))]

(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))

{-2} Cpp_Type?(const(t′))
{-3} cv(pointer_to_member?)(const(t′))
{-4} typ′ = const(t′)

{1} interpreted_data_type?[((range_ptm(cv_base(typ′))))] (dt_const[((range_ptm(cv_base(t′))))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_cv_ptm_TCC7.2.1.1:

{-1} uninterpreted_data_type?(dt_const[((range_ptm(cv_base(t′))))](v′(t′))`uidt)

{-2} ∀ (d: (((range_ptm(cv_base(t′))))), a: Address):

valid?(uidt(dt_const[((range_ptm(cv_base(t′))))](v′(t′))))

(to_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const[((range_ptm(cv_base(t′))))](v′(t′))))(l, a) ≡ up?(from_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))(l, a))

{-4} ∀ (d: (((range_ptm(cv_base(t′))))), a: Address):

down(from_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))

(to_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))(d, a),

a))

= d
{-5} Cpp_Type?(const(t′))
{-6} cv(pointer_to_member?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range_ptm(cv_base(typ′)))), a: Address):

valid?(uidt(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))) (to_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_ptm_TCC7.2.1.1.

dt_cv_ptm_TCC7.2.1.2:

{-1} uninterpreted_data_type?(dt_const[((range_ptm(cv_base(t′))))](v′(t′))`uidt)

{-2} ∀ (d: (((range_ptm(cv_base(t′))))), a: Address):

valid?(uidt(dt_const[((range_ptm(cv_base(t′))))](v′(t′))))

(to_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const[((range_ptm(cv_base(t′))))](v′(t′))))(l, a) ≡ up?(from_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))(l, a))

{-4} ∀ (d: (((range_ptm(cv_base(t′))))), a: Address):

down(from_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))

(to_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))(d, a),

a))

= d
{-5} Cpp_Type?(const(t′))
{-6} cv(pointer_to_member?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range_ptm(cv_base(typ′)))), a: Address):

down(from_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))

(to_byte(dt_const[((range_ptm(cv_base(t′))))](v′(t′)))(d, a),

a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_ptm_TCC7.2.1.2.

dt_cv_ptm_TCC7.2.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer_to_member?)(const(t′))
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t′))))])): true

{2} interpreted_data_type?[((range_ptm(cv_base(typ′))))] (dt_const[((range_ptm(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_ptm_TCC6, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC7.2.2.

dt_cv_ptm_TCC7.2.3:

{-1} Cpp_Type?(const(t′))
{-2} cv(pointer_to_member?)(const(t′))
{-3} typ′ = const(t′)
{1} pointer_to_member?(cv_base(t′))

{2} interpreted_data_type?[((range_ptm(cv_base(typ′))))] (dt_const[((range_ptm(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_ptm_TCC5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC7.2.3. Q.E.D.

C.44.76 Cpp_Types.dt_cv_ptm_TCC8

Terse proof for dt_cv_ptm_TCC8.
dt_cv_ptm_TCC8:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t) ∧ cv(pointer_to_member?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

dt_cv_ptm_TCC8.1:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Expanding the definition of subterm, Replacing using formula -4, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC8.1.

dt_cv_ptm_TCC8.2:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = volatile(t′)
{1} cv(pointer_to_member?)(t′)

Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_ptm_TCC8.2. Q.E.D.

C.44.77 Cpp_Types.dt_cv_ptm_TCC9

Terse proof for dt_cv_ptm_TCC9.
dt_cv_ptm_TCC9:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = volatile(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_], [Cpp_Subtype(cv(pointer_to_member?)), Cpp_Subtype(cv(pointer_to_member?))], boolean] (≪)(t, typ)

Expanding the definition of restrict, Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of «, which is trivially true. This completes the proof of dt_cv_ptm_TCC9. Q.E.D.

C.44.78 Cpp_Types.dt_cv_ptm_TCC10

Terse proof for dt_cv_ptm_TCC10.
dt_cv_ptm_TCC10:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_ptm_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC10. Q.E.D.

C.44.79 Cpp_Types.dt_cv_ptm_TCC11

Terse proof for dt_cv_ptm_TCC11.
dt_cv_ptm_TCC11:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = volatile(t) ⊃ pointer_to_member?(cv_base(t))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

dt_cv_ptm_TCC11.1:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = volatile(t′)
{1} cv(pointer_to_member?)(t′)
{2} pointer_to_member?(cv_base(t′))

Using lemma dt_cv_ptm_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC11.1.

dt_cv_ptm_TCC11.2:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = volatile(t′)
{1} (pointer_to_member?⊆ interpreted?)
{2} pointer_to_member?(cv_base(t′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_ptm_TCC11.2. Q.E.D.

C.44.80 Cpp_Types.dt_cv_ptm_TCC12

Terse proof for dt_cv_ptm_TCC12.
dt_cv_ptm_TCC12:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)), t: Cpp_Type_): typ = volatile(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t))))])): true)

Repeatedly Skolemizing and flattening, Using lemma dt_pointer_to_member_exists, we get 3 subgoals:

dt_cv_ptm_TCC12.1:

{-1} ∃ (dt: (pod_data_type?[((range_ptm(cv_base(t′))))])): true
{-2} Cpp_Type?(typ′)
{-3} cv(pointer_to_member?)(typ′)
{-4} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t′))))])): true

Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of dt_cv_ptm_TCC12.1.

dt_cv_ptm_TCC12.2:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = volatile(t′)
{1} pointer_to_member?(cv_base(t′))
{2} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t′))))])): true

Using lemma dt_cv_ptm_TCC11, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC12.2.

dt_cv_ptm_TCC12.3:

{-1} Cpp_Type?(typ′)
{-2} cv(pointer_to_member?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)
{2} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t′))))])): true

Using lemma dt_cv_ptm_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC12.3. Q.E.D.

C.44.81 Cpp_Types.dt_cv_ptm_TCC13

Terse proof for dt_cv_ptm_TCC13.

dt_cv_ptm_TCC13:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(pointer_to_member?)) |

restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(pointer_to_member?)), Cpp_Subtype(cv(pointer_to_member?))],

boolean]

(≪)(z, typ)} →

(interpreted_data_type?[((range_ptm(cv_base(typ1))))])], t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (x: nat): range_ptm(cv_base(t))(x) ≡ range_ptm(cv_base(typ))(x)) ∧ (∀ (x: nat): range_ptm(cv_base(t))(x) ≡ range_ptm(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_ptm(cv_base(t))))] ((range_ptm(cv_base(typ)))) (dt_volatile[((range_ptm(cv_base(t))))](v(t))`from_byte(x_{1})))

∧

interpreted_data_type?[(range_ptm(cv_base(typ)))] (dt_volatile[((range_ptm(cv_base(t))))](v(t)))

Repeatedly Skolemizing and flattening, Expanding the definition of cv_base, Replacing using formula -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

dt_cv_ptm_TCC13.1:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer_to_member?)(volatile(t′))
{-3} typ′ = volatile(t′)

{1} interpreted_data_type?[((range_ptm(cv_base(typ′))))] (dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

Adding type constraints for dt_volatile[((range_ptm(cv_base(t!1))))](v!1(t!1)), we get 3 subgoals:

dt_cv_ptm_TCC13.1.1:

{-1} interpreted_data_type?[((range_ptm(cv_base(t′))))]

(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

{-2} Cpp_Type?(volatile(t′))
{-3} cv(pointer_to_member?)(volatile(t′))
{-4} typ′ = volatile(t′)

{1} interpreted_data_type?[((range_ptm(cv_base(typ′))))] (dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_cv_ptm_TCC13.1.1.1:

{-1} uninterpreted_data_type?(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′))`uidt)

{-2} ∀ (d: (((range_ptm(cv_base(t′))))), a: Address):

valid?(uidt(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′))))

(to_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′))))(l, a) ≡ up?(from_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))(l, a))

{-4} ∀ (d: (((range_ptm(cv_base(t′))))), a: Address):

down(from_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

(to_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

(d, a), a))

= d
{-5} Cpp_Type?(volatile(t′))
{-6} cv(pointer_to_member?)(volatile(t′))
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range_ptm(cv_base(typ′)))), a: Address):

valid?(uidt(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))) (to_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_ptm_TCC13.1.1.1.

dt_cv_ptm_TCC13.1.1.2:

{-1} uninterpreted_data_type?(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′))`uidt)

{-2} ∀ (d: (((range_ptm(cv_base(t′))))), a: Address):

valid?(uidt(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′))))

(to_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′))))(l, a) ≡ up?(from_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))(l, a))

{-4} ∀ (d: (((range_ptm(cv_base(t′))))), a: Address):

down(from_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

(to_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

(d, a), a))

= d
{-5} Cpp_Type?(volatile(t′))
{-6} cv(pointer_to_member?)(volatile(t′))
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range_ptm(cv_base(typ′)))), a: Address):

down(from_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

(to_byte(dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -7, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_ptm_TCC13.1.1.2.

dt_cv_ptm_TCC13.1.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer_to_member?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_ptm(cv_base(t′))))])): true

{2} interpreted_data_type?[((range_ptm(cv_base(typ′))))] (dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_ptm_TCC12, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC13.1.2.

dt_cv_ptm_TCC13.1.3:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer_to_member?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} pointer_to_member?(cv_base(t′))

{2} interpreted_data_type?[((range_ptm(cv_base(typ′))))] (dt_volatile[((range_ptm(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_ptm_TCC11, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC13.1.3.

dt_cv_ptm_TCC13.2:

{-1} Cpp_Type?(volatile(t′))
{-2} cv(pointer_to_member?)(volatile(t′))
{-3} typ′ = volatile(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_ptm(cv_base(t′))))] ((range_ptm(cv_base(volatile(t′))))) (dt_volatile[((range_ptm(cv_base(t′))))](v′(t′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_ptm_TCC13.2. Q.E.D.

C.44.82 Cpp_Types.dt_cv_ptm_TCC14

Terse proof for dt_cv_ptm_TCC14.
dt_cv_ptm_TCC14:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ pointer_to_member?(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_ptm_TCC14. Q.E.D.

C.44.83 Cpp_Types.dt_cv_ptm_TCC15

Terse proof for dt_cv_ptm_TCC15.
dt_cv_ptm_TCC15:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ (∀ (x: nat): range_ptm(typ)(x) ≡ range_ptm(cv_base(typ))(x)) ∧ (∀ (x: nat): range_ptm(typ)(x) ≡ range_ptm(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]): every[((range_ptm(typ)))]

((range_ptm(cv_base(typ))))(dt_ptm(typ)`from_byte(x_{1}))) ∧ interpreted_data_type?[(range_ptm(cv_base(typ)))](dt_ptm(typ))

Repeatedly Skolemizing and flattening, Using lemma cv_base_result2, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_cv_ptm_TCC15.1:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(cv_base(typ′))
{-3} cv(pointer_to_member?)(cv_base(typ′))
{1} volatile?(cv_base(typ′))
{2} const?(cv_base(typ′))
{3} interpreted_data_type?[((range_ptm(cv_base(typ′))))](dt_ptm(cv_base(typ′)))

Adding type constraints for dt_ptm(cv_base(typ!1)), Rewriting using pod_is_interpreted_data, matching in *, This completes the proof of dt_cv_ptm_TCC15.1.

dt_cv_ptm_TCC15.2:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(cv_base(typ′))
{-3} cv(pointer_to_member?)(cv_base(typ′))
{1} volatile?(cv_base(typ′))
{2} const?(cv_base(typ′))
{3} ∀ (x_{1}: [list[Byte], Address]):

every[((range_ptm(typ′)))] ((range_ptm(cv_base(cv_base(typ′)))))(dt_ptm(cv_base(typ′))`from_byte(x_{1}))

Expanding the definition of every, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC15.2.

dt_cv_ptm_TCC15.3:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(cv_base(typ′))
{-3} cv(pointer_to_member?)(cv_base(typ′))
{1} volatile?(cv_base(typ′))
{2} const?(cv_base(typ′))
{3} ∀ (x: nat):

range_ptm(cv_base(typ′))(x) ≡ range_ptm(cv_base(cv_base(typ′)))(x)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_ptm_TCC15.3. Q.E.D.

C.44.84 Cpp_Types.dt_cv_float_TCC1

Terse proof for dt_cv_float_TCC1.
dt_cv_float_TCC1:

{1} well_founded?(λ (x: Cpp_Subtype(cv(floating_point?)),

y: Cpp_Subtype(cv(floating_point?))): restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(floating_point?)), Cpp_Subtype(cv(floating_point?))],

boolean]

(≪)(x, y))

Using lemma well_founded_restrict[Cpp_Type_, Cpp_Subtype(cv(floating_point?))], Expanding the definition of restrict, which is trivially true. This completes the proof of dt_cv_float_TCC1. Q.E.D.

C.44.85 Cpp_Types.dt_cv_float_TCC2

Terse proof for dt_cv_float_TCC2.
dt_cv_float_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t) ∧ cv(floating_point?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

dt_cv_float_TCC2.1:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Expanding the definition of subterm, Replacing using formula -4, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC2.1.

dt_cv_float_TCC2.2:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = const(t′)
{1} cv(floating_point?)(t′)

Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_float_TCC2.2. Q.E.D.

C.44.86 Cpp_Types.dt_cv_float_TCC3

Terse proof for dt_cv_float_TCC3.
dt_cv_float_TCC3:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = const(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(floating_point?)), Cpp_Subtype(cv(floating_point?))], boolean] (≪)(t, typ)

Expanding the definition of ≪, Expanding the definition of restrict, Repeatedly Skolemizing and flattening, Replacing using formula -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC3. Q.E.D.

C.44.87 Cpp_Types.dt_cv_float_TCC4

Terse proof for dt_cv_float_TCC4.
dt_cv_float_TCC4:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = const(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_float_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC4. Q.E.D.

C.44.88 Cpp_Types.dt_cv_float_TCC5

Terse proof for dt_cv_float_TCC5.
dt_cv_float_TCC5:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = const(t) ⊃ floating_point?(cv_base(t))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

dt_cv_float_TCC5.1:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = const(t′)
{1} cv(floating_point?)(t′)
{2} floating_point?(cv_base(t′))

Using lemma dt_cv_float_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC5.1.

dt_cv_float_TCC5.2:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = const(t′)
{1} (floating_point?⊆ interpreted?)
{2} floating_point?(cv_base(t′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_float_TCC5.2. Q.E.D.

C.44.89 Cpp_Types.dt_cv_float_TCC6

Terse proof for dt_cv_float_TCC6.
dt_cv_float_TCC6:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = const(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range_floating_point(cv_base(t))))])): true)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (dt_floating_point(cv_base(t!1))), we get 3 subgoals:

dt_cv_float_TCC6.1:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = const(t′)
{1} true

which is trivially true.

C.44 Proofs for Cpp_Types (types.pvs)

This completes the proof of dt_cv_float_TCC6.1.

dt_cv_float_TCC6.2:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = const(t′)
{1} floating_point?(cv_base(t′))

Using lemma dt_cv_float_TCC5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC6.2.

dt_cv_float_TCC6.3:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = const(t′)
{1} Cpp_Type?(t′)

Using lemma dt_cv_float_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC6.3. Q.E.D.

C.44.90 Cpp_Types.dt_cv_float_TCC7

Terse proof for dt_cv_float_TCC7.

dt_cv_float_TCC7:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(floating_point?)) |

restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(floating_point?)), Cpp_Subtype(cv(floating_point?))],

boolean]

(≪)(z, typ)} →

(interpreted_data_type?[((range_floating_point(cv_base(typ1))))])], t: Cpp_Type_):

typ = const(t) ⊃ (∀ (x: extended_real):

range_floating_point(cv_base(t))(x) ≡ range_floating_point(cv_base(typ))(x))

∧

(∀ (x: extended_real): range_floating_point(cv_base(t))(x) ≡ range_floating_point(cv_base(typ))(x))

∧

(∀ (x_{1}: [list[Byte], Address]):

every[((range_floating_point(cv_base(t))))] ((range_floating_point(cv_base(typ)))) (dt_const[((range_floating_point(cv_base(t))))](v(t))`from_byte

(x_{1})))

∧

interpreted_data_type?[(range_floating_point(cv_base(typ)))] (dt_const[((range_floating_point(cv_base(t))))](v(t)))

Repeatedly Skolemizing and flattening, Replacing using formula -3, Expanding the definition of cv_base, Applying propositional simplification, we get 2 subgoals:

dt_cv_float_TCC7.1:

{-1} Cpp_Type?(const(t′))
{-2} cv(floating_point?)(const(t′))
{-3} typ′ = const(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_floating_point(cv_base(t′))))] ((range_floating_point(cv_base(const(t′))))) (dt_const[((range_floating_point(cv_base(t′))))](v′(t′))`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_float_TCC7.1.

dt_cv_float_TCC7.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(floating_point?)(const(t′))
{-3} typ′ = const(t′)

{1} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

Adding type constraints for dt_const[((range_floating_point(cv_base(t!1))))](v!1(t!1)), we get 3 subgoals:

dt_cv_float_TCC7.2.1:

{-1} interpreted_data_type?[((range_floating_point(cv_base(t′))))]

(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

{-2} Cpp_Type?(const(t′))
{-3} cv(floating_point?)(const(t′))
{-4} typ′ = const(t′)

{1} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

Expanding the definition of interpreted_data_type?, Applying propositional simplification, we get 2 subgoals:

dt_cv_float_TCC7.2.1.1:

{-1} uninterpreted_data_type?(dt_const[((range_floating_point(cv_base(t′))))]

(v′(t′))`uidt)

{-2} ∀ (d: (((range_floating_point(cv_base(t′))))), a: Address):

valid?(uidt(dt_const[((range_floating_point(cv_base(t′))))](v′(t′))))

(to_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const[((range_floating_point(cv_base(t′))))](v′(t′))))

(l, a) ≡ up?(from_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(l, a))

{-4} ∀ (d: (((range_floating_point(cv_base(t′))))), a: Address):

down(from_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(to_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a))

= d
{-5} Cpp_Type?(const(t′))
{-6} cv(floating_point?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range_floating_point(cv_base(typ′)))), a: Address):

valid?(uidt(dt_const[((range_floating_point(cv_base(t′))))](v′(t′))))

(to_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -8, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_float_TCC7.2.1.1.

dt_cv_float_TCC7.2.1.2:

{-1} uninterpreted_data_type?(dt_const[((range_floating_point(cv_base(t′))))]

(v′(t′))`uidt)

{-2} ∀ (d: (((range_floating_point(cv_base(t′))))), a: Address):

valid?(uidt(dt_const[((range_floating_point(cv_base(t′))))](v′(t′))))

(to_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a) {-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_const[((range_floating_point(cv_base(t′))))](v′(t′))))

(l, a) ≡ up?(from_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(l, a))

{-4} ∀ (d: (((range_floating_point(cv_base(t′))))), a: Address):

down(from_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(to_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a))

= d
{-5} Cpp_Type?(const(t′))
{-6} cv(floating_point?)(const(t′))
{-7} typ′ = const(t′)

{1} ∀ (d: ((range_floating_point(cv_base(typ′)))), a: Address):

down(from_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(to_byte(dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of cv_base, Replacing using formula -8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC7.2.1.2.

dt_cv_float_TCC7.2.2:

{-1} Cpp_Type?(const(t′))
{-2} cv(floating_point?)(const(t′))
{-3} typ′ = const(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_floating_point(cv_base(t′))))])): true

{2} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_float_TCC6, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC7.2.2.

dt_cv_float_TCC7.2.3:

{-1} Cpp_Type?(const(t′))
{-2} cv(floating_point?)(const(t′))
{-3} typ′ = const(t′)
{1} floating_point?(cv_base(t′))

{2} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_const[((range_floating_point(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_float_TCC5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC7.2.3. Q.E.D.

C.44.91 Cpp_Types.dt_cv_float_TCC8

Terse proof for dt_cv_float_TCC8.
dt_cv_float_TCC8:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t) ∧ cv(floating_point?)(t)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

dt_cv_float_TCC8.1:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (t!2), Expanding the definition of subterm, Replacing using formula -4, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC8.1.

dt_cv_float_TCC8.2:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} cv(floating_point?)(t′)

Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_float_TCC8.2. Q.E.D.

C.44.92 Cpp_Types.dt_cv_float_TCC9

Terse proof for dt_cv_float_TCC9.

dt_cv_float_TCC9:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = volatile(t) ⊃ restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(floating_point?)), Cpp_Subtype(cv(floating_point?))], boolean] (≪)(t, typ)

Repeatedly Skolemizing and flattening, Expanding the definition of restrict, Expanding the definition of «, Replacing using formula -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC9. Q.E.D.

C.44.93 Cpp_Types.dt_cv_float_TCC10

Terse proof for dt_cv_float_TCC10.
dt_cv_float_TCC10:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = volatile(t) ⊃ Cpp_Type?(t)

Repeatedly Skolemizing and flattening, Using lemma dt_cv_float_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC10. Q.E.D.

C.44.94 Cpp_Types.dt_cv_float_TCC11

Terse proof for dt_cv_float_TCC11.
dt_cv_float_TCC11:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = volatile(t) ⊃ floating_point?(cv_base(t))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

dt_cv_float_TCC11.1:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} cv(floating_point?)(t′)
{2} floating_point?(cv_base(t′))

Using lemma dt_cv_float_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC11.1.

dt_cv_float_TCC11.2:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} (floating_point?⊆ interpreted?)
{2} floating_point?(cv_base(t′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_float_TCC11.2. Q.E.D.

C.44.95 Cpp_Types.dt_cv_float_TCC12

Terse proof for dt_cv_float_TCC12.
dt_cv_float_TCC12:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)), t: Cpp_Type_): typ = volatile(t) ⊃ (∃ (x_{1}: (interpreted_data_type?[((range_floating_point(cv_base(t))))])): true)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (dt_floating_point(cv_base(t!1))), we get 3 subgoals:

dt_cv_float_TCC12.1:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} true

which is trivially true. This completes the proof of dt_cv_float_TCC12.1.

dt_cv_float_TCC12.2:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} floating_point?(cv_base(t′))

Using lemma dt_cv_float_TCC11, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC12.2.

dt_cv_float_TCC12.3:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} Cpp_Type?(t′)

Using lemma dt_cv_float_TCC8, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC12.3. Q.E.D.

C.44.96 Cpp_Types.dt_cv_float_TCC13

Terse proof for dt_cv_float_TCC13.
dt_cv_float_TCC13:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?)),

              v:

[typ1:

{z: Cpp_Subtype(cv(floating_point?)) |

restrict

[[Cpp_Type_, Cpp_Type_],

[Cpp_Subtype(cv(floating_point?)), Cpp_Subtype(cv(floating_point?))],

boolean]

(≪)(z, typ)} →

(interpreted_data_type?[((range_floating_point(cv_base(typ1))))])], t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (x: extended_real):

range_floating_point(cv_base(t))(x) ≡ range_floating_point(cv_base(typ))(x))

∧

(∀ (x: extended_real): range_floating_point(cv_base(t))(x) ≡ range_floating_point(cv_base(typ))(x))

∧

(∀ (x_{1}: [list[Byte], Address]):

every[((range_floating_point(cv_base(t))))] ((range_floating_point(cv_base(typ)))) (dt_volatile[((range_floating_point(cv_base(t))))](v(t))`from_byte

(x_{1})))

∧

interpreted_data_type?[(range_floating_point(cv_base(typ)))] (dt_volatile[((range_floating_point(cv_base(t))))](v(t)))

Repeatedly Skolemizing and flattening,

Expanding the definition of cv_base,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

dt_cv_float_TCC13.1:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)

{1} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

Adding type constraints for dt_volatile[((range_floating_point(cv_base(t!1))))](v!1(t!1)),

we get 3 subgoals:

dt_cv_float_TCC13.1.1:

{-1} interpreted_data_type?[((range_floating_point(cv_base(t′))))]

(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

{-2} Cpp_Type?(typ′)
{-3} cv(floating_point?)(typ′)
{-4} typ′ = volatile(t′)

{1} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

Expanding the definition of interpreted_data_type?, Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

dt_cv_float_TCC13.1.1.1:

{-1} uninterpreted_data_type?(dt_volatile[((range_floating_point(cv_base(t′))))]

(v′(t′))`uidt)

{-2} ∀ (d: (((range_floating_point(cv_base(t′))))), a: Address):

valid?(uidt(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′))))

(to_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a) {-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′))))

(l, a) ≡ up?(from_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(l, a))

{-4} ∀ (d: (((range_floating_point(cv_base(t′))))), a: Address):

down(from_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(to_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a))

= d
{-5} Cpp_Type?(typ′)
{-6} cv(floating_point?)(typ′)
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range_floating_point(cv_base(typ′)))), a: Address):

valid?(uidt(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′))))

(to_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -8, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_float_TCC13.1.1.1.

dt_cv_float_TCC13.1.1.2:

{-1} uninterpreted_data_type?(dt_volatile[((range_floating_point(cv_base(t′))))]

(v′(t′))`uidt)

{-2} ∀ (d: (((range_floating_point(cv_base(t′))))), a: Address):

valid?(uidt(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′))))

(to_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a) {-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′))))

(l, a) ≡ up?(from_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(l, a))

{-4} ∀ (d: (((range_floating_point(cv_base(t′))))), a: Address):

down(from_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(to_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a))

= d
{-5} Cpp_Type?(typ′)
{-6} cv(floating_point?)(typ′)
{-7} typ′ = volatile(t′)

{1} ∀ (d: ((range_floating_point(cv_base(typ′)))), a: Address):

down(from_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(to_byte(dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

(d, a), a))

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Replacing using formula -8, Expanding the definition of cv_base, which is trivially true. This completes the proof of dt_cv_float_TCC13.1.1.2.

dt_cv_float_TCC13.1.2:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} ∃ (x_{1}: (interpreted_data_type?[((range_floating_point(cv_base(t′))))])): true

{2} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_float_TCC12, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC13.1.2.

dt_cv_float_TCC13.1.3:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} floating_point?(cv_base(t′))

{2} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′)))

Using lemma dt_cv_float_TCC11, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC13.1.3.

dt_cv_float_TCC13.2:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)
{1} ∀ (x_{1}: [list[Byte], Address]):

every[((range_floating_point(cv_base(t′))))] ((range_floating_point(cv_base(typ′)))) (dt_volatile[((range_floating_point(cv_base(t′))))](v′(t′))`from_byte

(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of cv_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC13.2.

dt_cv_float_TCC13.3:

{-1} Cpp_Type?(typ′)
{-2} cv(floating_point?)(typ′)
{-3} typ′ = volatile(t′)

{1} ∀ (x: extended_real):

range_floating_point(cv_base(t′))(x) ≡ range_floating_point(cv_base(typ(typ′)))(x)

Replacing using formula -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC13.3. Q.E.D.

C.44.97 Cpp_Types.dt_cv_float_TCC14

Terse proof for dt_cv_float_TCC14.
dt_cv_float_TCC14:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ floating_point?(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of dt_cv_float_TCC14. Q.E.D.

C.44.98 Cpp_Types.dt_cv_float_TCC15

Terse proof for dt_cv_float_TCC15.
dt_cv_float_TCC15:

{1} ∀ (typ: Cpp_Subtype(cv(floating_point?))): ¬ volatile?(typ) ∧ ¬ const?(typ) ⊃ (∀ (x: extended_real):

range_floating_point(typ)(x) ≡ range_floating_point(cv_base(typ))(x)) ∧ (∀ (x: extended_real):

range_floating_point(typ)(x) ≡ range_floating_point(cv_base(typ))(x)) ∧ (∀ (x_{1}: [list[Byte], Address]):

every[((range_floating_point(typ)))] ((range_floating_point(cv_base(typ)))) (dt_floating_point(typ)`from_byte(x_{1})))

∧

interpreted_data_type?[(range_floating_point(cv_base(typ)))] (dt_floating_point(typ))

Repeatedly Skolemizing and flattening, Using lemma cv_base_result2, Simplifying, rewriting, and recording with decision procedures, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

dt_cv_float_TCC15.1:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(floating_point?)(typ′)
{1} volatile?(typ′)
{2} const?(typ′)

{3} interpreted_data_type?[((range_floating_point(cv_base(typ′))))] (dt_floating_point(typ′))

Replacing using formula -1, Adding type constraints for dt_floating_point(cv_base(typ!1)), Rewriting using pod_is_interpreted_data, matching in *, This completes the proof of dt_cv_float_TCC15.1.

dt_cv_float_TCC15.2:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(floating_point?)(typ′)
{1} volatile?(typ′)
{2} const?(typ′)
{3} ∀ (x_{1}: [list[Byte], Address]):

every[((range_floating_point(typ′)))] ((range_floating_point(cv_base(typ′))))(dt_floating_point(typ′)`from_byte(x_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC15.2.

dt_cv_float_TCC15.3:

{-1} cv_base(typ′) = typ′
{-2} Cpp_Type?(typ′)
{-3} cv(floating_point?)(typ′)
{1} volatile?(typ′)
{2} const?(typ′)

{3} ∀ (x: extended_real): range_floating_point(typ′)(x) ≡ range_floating_point(cv_base(typ′))(x)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of dt_cv_float_TCC15.3. Q.E.D.

C.44.99 Cpp_Types.uidt_TCC1

Terse proof for uidt_TCC1.

uidt_TCC1:

{1} ∀ (typ: Cpp_Type, r: Cpp_Type_, a: list[Cpp_Type_], v: bool): typ = function_type(r, a, v) ⊃ function?(typ)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC1. Q.E.D.

C.44.100 Cpp_Types.uidt_TCC2

Terse proof for uidt_TCC2.

uidt_TCC2:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = pointer(t) ⊃ cv(pointer?)(typ)

Repeatedly Skolemizing and flattening, Replacing using formula -2, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC2. Q.E.D.

C.44.101 Cpp_Types.uidt_TCC3

Terse proof for uidt_TCC3.

uidt_TCC3:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = pointer(t) ⊃ uninterpreted_data_type?(uidt(dt_cv_pointer(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_pointer(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC3. Q.E.D.

C.44.102 Cpp_Types.uidt_TCC4

Terse proof for uidt_TCC4.

uidt_TCC4:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = reference(t) ⊃ uninterpreted_data_type?(uidt(dt_reference(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_reference(typ!1), Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC4. Q.E.D.

C.44.103 Cpp_Types.uidt_TCC5

Terse proof for uidt_TCC5.

uidt_TCC5:

{1} ∀ (typ: Cpp_Type, c: (class?), t: Cpp_Type_):

typ = pointer_to_member(c, t) ⊃ cv(pointer_to_member?)(typ)

Repeatedly Skolemizing and flattening, Replacing using formula -3, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC5. Q.E.D.

C.44.104 Cpp_Types.uidt_TCC6

Terse proof for uidt_TCC6.

uidt_TCC6:

{1} ∀ (typ: Cpp_Type, c: (class?), t: Cpp_Type_): typ = pointer_to_member(c, t) ⊃ uninterpreted_data_type?(uidt(dt_cv_ptm(typ)))

Repeatedly Skolemizing and flattening, Replacing using formula -3, Adding type constraints for dt_cv_ptm(pointer_to_member(c!1, t!1)), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC6.

Q.E.D.

C.44.105 Cpp_Types.uidt_TCC7

Terse proof for uidt_TCC7.

uidt_TCC7:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_, bo: nat, s: posnat):

typ = bitfield(t, bo, s) ⊃ cv(bitfield?)(typ)

Repeatedly Skolemizing and flattening, Replacing using formula -4, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC7. Q.E.D.

C.44.106 Cpp_Types.uidt_TCC8

Terse proof for uidt_TCC8.

uidt_TCC8:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_, bo: nat, s: posnat):

typ = bitfield(t, bo, s) ⊃ uninterpreted_data_type?(uidt(dt_cv_bitfield(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_bitfield(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC8. Q.E.D.

C.44.107 Cpp_Types.uidt_TCC9

Terse proof for uidt_TCC9.

uidt_TCC9:

{1} ∀ (typ: Cpp_Type): typ = bool ⊃ uninterpreted_data_type?(uidt(dt_bool))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_bool, Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC9. Q.E.D.

C.44.108 Cpp_Types.uidt_TCC10

Terse proof for uidt_TCC10.

uidt_TCC10:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): t = bool ∧ typ = const(t) ⊃ uninterpreted_data_type?(uidt(dt_bool))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_bool, Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC10. Q.E.D.

C.44.109 Cpp_Types.uidt_TCC11

Terse proof for uidt_TCC11.

uidt_TCC11:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ (∀ (t_{1}: Cpp_Type_): t = pointer(t_{1}) ⊃ cv(pointer?)(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC11. Q.E.D.

C.44.110 Cpp_Types.uidt_TCC12

Terse proof for uidt_TCC12.

uidt_TCC12:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ (∀ (t_{1}: Cpp_Type_):

t = pointer(t_{1}) ⊃ uninterpreted_data_type?(uidt(dt_cv_pointer(typ))))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_pointer(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC12. Q.E.D.

C.44.111 Cpp_Types.uidt_TCC13

Terse proof for uidt_TCC13.

uidt_TCC13:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ (∀ (c: (class?), t_{1}: Cpp_Type_):

t = pointer_to_member(c, t_{1}) ⊃ cv(pointer_to_member?)(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC13. Q.E.D.

C.44.112 Cpp_Types.uidt_TCC14

Terse proof for uidt_TCC14.

uidt_TCC14:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ (∀ (c: (class?), t_{1}: Cpp_Type_):

t = pointer_to_member(c, t_{1}) ⊃ uninterpreted_data_type?(uidt(dt_cv_ptm(typ))))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_ptm(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC14. Q.E.D.

C.44.113 Cpp_Types.uidt_TCC15

Terse proof for uidt_TCC15.

uidt_TCC15:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ (∀ (t_{1}: Cpp_Type_, bo: nat, s: posnat):

t = bitfield(t_{1}, bo, s) ⊃ cv(bitfield?)(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -3, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC15. Q.E.D.

C.44.114 Cpp_Types.uidt_TCC16

Terse proof for uidt_TCC16.

uidt_TCC16:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = const(t) ⊃ (∀ (t_{1}: Cpp_Type_, bo: nat, s: posnat): t = bitfield(t_{1}, bo, s) ⊃ uninterpreted_data_type?(uidt(dt_cv_bitfield(typ))))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_bitfield(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC16. Q.E.D.

C.44.115 Cpp_Types.uidt_TCC17

Terse proof for uidt_TCC17.

uidt_TCC17:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

floating_point?(t) ∧ ¬ volatile?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = const(t)

⊃ cv(floating_point?)(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC17. Q.E.D.

C.44.116 Cpp_Types.uidt_TCC18

Terse proof for uidt_TCC18.

uidt_TCC18:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

floating_point?(t) ∧ ¬ volatile?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = const(t)

⊃ uninterpreted_data_type?(uidt(dt_cv_float(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_float(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC18. Q.E.D.

C.44.117 Cpp_Types.uidt_TCC19

Terse proof for uidt_TCC19.

uidt_TCC19:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): non_bool_integral_enum?(t) ∧ ¬ volatile?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = const(t)

⊃ cv(non_bool_integral_enum?)(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC19. Q.E.D.

C.44.118 Cpp_Types.uidt_TCC20

Terse proof for uidt_TCC20.

uidt_TCC20:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): non_bool_integral_enum?(t) ∧ ¬ volatile?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = const(t)

⊃ uninterpreted_data_type?(uidt(dt(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt(typ!1), Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC20. Q.E.D.

C.44.119 Cpp_Types.uidt_TCC21

Terse proof for uidt_TCC21.

uidt_TCC21:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): ¬ volatile?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = const(t) ⊃ ¬ (floating_point?(t) ∧ non_bool_integral_enum?(t))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC21.

Q.E.D.

C.44.120 Cpp_Types.uidt_TCC22

Terse proof for uidt_TCC22.

uidt_TCC22:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): ¬ volatile?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = const(t) ⊃ floating_point?(t) ∨ non_bool_integral_enum?(t)

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Instantiating the top quantifier in -1 with the terms: (typ!1), Expanding the definition of subterm, Applying disjunctive simplification to flatten sequent, Keeping (-3 -17 -21 -23 -24 -25 -27 -29 1 2 3 4 5 6 7) and hiding *, Replacing using formula -8, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC22. Q.E.D.

C.44.121 Cpp_Types.uidt_TCC23

Terse proof for uidt_TCC23.

uidt_TCC23:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): t = bool ∧ typ = volatile(t) ⊃ uninterpreted_data_type?(uidt(dt_bool))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_bool, Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC23. Q.E.D.

C.44.122 Cpp_Types.uidt_TCC24

Terse proof for uidt_TCC24.

uidt_TCC24:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (t_{1}: Cpp_Type_): t = pointer(t_{1}) ⊃ cv(pointer?)(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC24.

Q.E.D.

C.44.123 Cpp_Types.uidt_TCC25

Terse proof for uidt_TCC25.

uidt_TCC25:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (t_{1}: Cpp_Type_):

t = pointer(t_{1}) ⊃ uninterpreted_data_type?(uidt(dt_cv_pointer(typ))))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_pointer(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC25. Q.E.D.

C.44.124 Cpp_Types.uidt_TCC26

Terse proof for uidt_TCC26.

uidt_TCC26:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (c: (class?), t_{1}: Cpp_Type_):

t = pointer_to_member(c, t_{1}) ⊃ cv(pointer_to_member?)(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC26. Q.E.D.

C.44.125 Cpp_Types.uidt_TCC27

Terse proof for uidt_TCC27.

uidt_TCC27:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (c: (class?), t_{1}: Cpp_Type_):

t = pointer_to_member(c, t_{1}) ⊃ uninterpreted_data_type?(uidt(dt_cv_ptm(typ))))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_ptm(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC27. Q.E.D.

C.44.126 Cpp_Types.uidt_TCC28

Terse proof for uidt_TCC28.

uidt_TCC28:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

typ = volatile(t) ⊃ (∀ (t_{1}: Cpp_Type_, bo: nat, s: posnat):

t = bitfield(t_{1}, bo, s) ⊃ cv(bitfield?)(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -3, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC28. Q.E.D.

C.44.127 Cpp_Types.uidt_TCC29

Terse proof for uidt_TCC29.

uidt_TCC29:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): typ = volatile(t) ⊃ (∀ (t_{1}: Cpp_Type_, bo: nat, s: posnat): t = bitfield(t_{1}, bo, s) ⊃ uninterpreted_data_type?(uidt(dt_cv_bitfield(typ))))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_bitfield(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC29. Q.E.D.

C.44.128 Cpp_Types.uidt_TCC30

Terse proof for uidt_TCC30.

uidt_TCC30:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_):

floating_point?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = volatile(t) ⊃ cv(floating_point?)(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC30. Q.E.D.

C.44.129 Cpp_Types.uidt_TCC31

Terse proof for uidt_TCC31.

uidt_TCC31:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): floating_point?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = volatile(t) ⊃ uninterpreted_data_type?(uidt(dt_cv_float(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_float(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC31. Q.E.D.

C.44.130 Cpp_Types.uidt_TCC32

Terse proof for uidt_TCC32.

uidt_TCC32:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): non_bool_integral_enum?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = volatile(t) ⊃ cv(non_bool_integral_enum?)(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC32. Q.E.D.

C.44.131 Cpp_Types.uidt_TCC33

Terse proof for uidt_TCC33.

uidt_TCC33:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): non_bool_integral_enum?(t) ∧ ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = volatile(t) ⊃ uninterpreted_data_type?(uidt(dt(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt(typ!1), Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC33. Q.E.D.

C.44.132 Cpp_Types.uidt_TCC34

Terse proof for uidt_TCC34.

uidt_TCC34:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = volatile(t) ⊃ ¬ (floating_point?(t) ∧ non_bool_integral_enum?(t))

Repeatedly Skolemizing and flattening, Keeping (-3 -4) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC34. Q.E.D.

C.44.133 Cpp_Types.uidt_TCC35

Terse proof for uidt_TCC35.

uidt_TCC35:

{1} ∀ (typ: Cpp_Type, t: Cpp_Type_): ¬ bitfield?(t) ∧ ¬ pointer_to_member?(t) ∧ ¬ pointer?(t) ∧ ¬ bool?(t) ∧ typ = volatile(t) ⊃ floating_point?(t) ∨ non_bool_integral_enum?(t)

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Instantiating the top quantifier in -1 with the terms: (typ!1), Expanding the definition of subterm, Applying disjunctive simplification to flatten sequent, Replacing using formula -29, Keeping (-3 -17 -20 -22 -23 -24 -25 -27 1 2 3 4 5 6) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC35. Q.E.D.

C.44.134 Cpp_Types.uidt_TCC36

Terse proof for uidt_TCC36.

uidt_TCC36:

{1} ∀ (typ: Cpp_Type): floating_point?(typ) ∧ ¬ volatile?(typ) ∧ ¬ const?(typ) ∧ ¬ bool?(typ) ∧ ¬ bitfield?(typ) ∧ ¬ pointer_to_member?(typ) ∧ ¬ reference?(typ) ∧ ¬ pointer?(typ) ∧ ¬ union?(typ) ∧ ¬ class?(typ) ∧ ¬ function?(typ) ∧ ¬ array?(typ) ∧ ¬ void?(typ)

⊃ cv(floating_point?)(typ)

Repeatedly Skolemizing and flattening, Keeping (-2 13) and hiding *, Expanding the definition of cv, Expanding the definition of c, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC36. Q.E.D.

C.44.135 Cpp_Types.uidt_TCC37

Terse proof for uidt_TCC37.

uidt_TCC37:

{1} ∀ (typ: Cpp_Type): floating_point?(typ) ∧ ¬ volatile?(typ) ∧ ¬ const?(typ) ∧ ¬ bool?(typ) ∧ ¬ bitfield?(typ) ∧ ¬ pointer_to_member?(typ) ∧ ¬ reference?(typ) ∧ ¬ pointer?(typ) ∧ ¬ union?(typ) ∧ ¬ class?(typ) ∧ ¬ function?(typ) ∧ ¬ array?(typ) ∧ ¬ void?(typ)

⊃ uninterpreted_data_type?(uidt(dt_cv_float(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt_cv_float(typ!1), Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC37. Q.E.D.

C.44.136 Cpp_Types.uidt_TCC38

Terse proof for uidt_TCC38.

uidt_TCC38:

{1} ∀ (typ: Cpp_Type): non_bool_integral_enum?(typ) ∧ ¬ volatile?(typ) ∧ ¬ const?(typ) ∧ ¬ bool?(typ) ∧ ¬ bitfield?(typ) ∧ ¬ pointer_to_member?(typ) ∧ ¬ reference?(typ) ∧ ¬ pointer?(typ) ∧ ¬ union?(typ) ∧ ¬ class?(typ) ∧ ¬ function?(typ) ∧ ¬ array?(typ) ∧ ¬ void?(typ)

⊃ cv(non_bool_integral_enum?)(typ)

Repeatedly Skolemizing and flattening, Expanding the definition of cv, Expanding the definition of c, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC38. Q.E.D.

C.44.137 Cpp_Types.uidt_TCC39

Terse proof for uidt_TCC39.

uidt_TCC39:

{1} ∀ (typ: Cpp_Type): non_bool_integral_enum?(typ) ∧ ¬ volatile?(typ) ∧ ¬ const?(typ) ∧ ¬ bool?(typ) ∧ ¬ bitfield?(typ) ∧ ¬ pointer_to_member?(typ) ∧ ¬ reference?(typ) ∧ ¬ pointer?(typ) ∧ ¬ union?(typ) ∧ ¬ class?(typ) ∧ ¬ function?(typ) ∧ ¬ array?(typ) ∧ ¬ void?(typ)

⊃ uninterpreted_data_type?(uidt(dt(typ)))

Repeatedly Skolemizing and flattening, Adding type constraints for dt(typ!1), Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_TCC39. Q.E.D.

C.44.138 Cpp_Types.uidt_TCC40

Terse proof for uidt_TCC40.

uidt_TCC40:

{1} ∀ (typ: Cpp_Type):

¬ volatile?(typ) ∧ ¬ const?(typ) ∧ ¬ bool?(typ) ∧ ¬ bitfield?(typ) ∧ ¬ pointer_to_member?(typ) ∧ ¬ reference?(typ) ∧ ¬ pointer?(typ) ∧ ¬ union?(typ) ∧ ¬ class?(typ) ∧ ¬ function?(typ) ∧ ¬ array?(typ) ∧ ¬ void?(typ)

⊃ ¬ (floating_point?(typ) ∧ non_bool_integral_enum?(typ))

Repeatedly Skolemizing and flattening, Keeping (-2 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC40. Q.E.D.

C.44.139 Cpp_Types.uidt_TCC41

Terse proof for uidt_TCC41.

uidt_TCC41:

{1} ∀ (typ: Cpp_Type):

¬ volatile?(typ) ∧ ¬ const?(typ) ∧ ¬ bool?(typ) ∧ ¬ bitfield?(typ) ∧ ¬ pointer_to_member?(typ) ∧ ¬ reference?(typ) ∧ ¬ pointer?(typ) ∧ ¬ union?(typ) ∧ ¬ class?(typ) ∧ ¬ function?(typ) ∧ ¬ array?(typ) ∧ ¬ void?(typ)

⊃ floating_point?(typ) ∨ non_bool_integral_enum?(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_TCC41. Q.E.D.

C.44.140 Cpp_Types.mod_float_TCC1

Terse proof for mod_float_TCC1.
mod_float_TCC1:

{1} ∃ (x: [Cpp_Subtype(cv(floating_point?)) → [extended_real → extended_real]]): true

Instantiating the top quantifier in 1 with the terms: (λ (t: Cpp_Subtype(cv(floating_point?))): λ (e: extended_real): e), which is trivially true. This completes the proof of mod_float_TCC1. Q.E.D.

C.44.141 Cpp_Types.value_bitmask_TCC1

Terse proof for value_bitmask_TCC1.
value_bitmask_TCC1:

{1} ∀ (typ: Cpp_Subtype(cv(non_bool_integral_enum?))):

¬ (bool?(typ) ∨ float?(typ) ∨ double?(typ) ∨ longdouble?(typ) ∨ void?(typ) ∨ array?(typ) ∨ function?(typ) ∨ pointer?(typ) ∨ reference?(typ) ∨ class?(typ) ∨ union?(typ) ∨ bitfield?(typ) ∨ pointer_to_member?(typ))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of cv, Expanding the definition of c, Expanding the definition of v, Expanding the definition of non_bool_integral_enum?, Expanding the definition of non_bool_integral?, Expanding the definition of unsigned_integer?, Expanding the definition of signed_integer?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of value_bitmask_TCC1. Q.E.D.

C.45 Proofs for Cpp_Verification (cpp-verification.pvs)

This theory contains no provable formal statements.

C.46 Proofs for Cpp_array (types.pvs)

C.46.1 Cpp_array.uidt_array_TCC1

Terse proof for uidt_array_TCC1.
uidt_array_TCC1:

{1} ∃ (x: [Cpp_Subtype(array?) → (uninterpreted_data_type?)]): true

Instantiating the top quantifier in 1 with the terms: (λ (c: Cpp_Subtype(array?)): choose(uninterpreted_data_type?)),

we get 2 subgoals:

C.47 Proofs for Cpp_bitfield (types.pvs)

uidt_array_TCC1.1:

{1} true

which is trivially true. This completes the proof of uidt_array_TCC1.1.

uidt_array_TCC1.2:

{1} ∀ (c: Cpp_Subtype(array?)): nonempty?[Uninterpreted_data_type](uninterpreted_data_type?)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in -3 with the terms: ((# size := 0, valid? := LAMBDA (l: list[Byte],

a: Address): FALSE #)), Repeatedly Skolemizing and flattening, This completes the proof of uidt_array_TCC1.2. Q.E.D.

C.47 Proofs for Cpp_bitfield (types.pvs)

C.47.1 Cpp_bitfield.range_bitfield_TCC1

Terse proof for range_bitfield_TCC1.
range_bitfield_TCC1:

{1} ∃ (x: [Cpp_Subtype(bitfield?) → non_empty_finite_set[int]]): true

Instantiating the top quantifier in 1 with the terms: (λ (b: Cpp_Subtype(bitfield?)): λ (i: int): i = 0),

we get 2 subgoals:

range_bitfield_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_bitfield_TCC1.1.

range_bitfield_TCC1.2:

{1} ∀ (b: Cpp_Subtype(bitfield?)):

is_finite[int](λ (i: int): i = 0) ∧ ¬ empty?[int](λ (i: int): i = 0)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (i: int): i = 0)):

0), which is trivially true. This completes the proof of range_bitfield_TCC1.2. Q.E.D.

C.47.2 Cpp_bitfield.bitfield_range_underlying_TCC1

Terse proof for bitfield_range_underlying_TCC1.
bitfield_range_underlying_TCC1:

{1} ∀ (b: Cpp_Subtype(bitfield?)):

array?(b) ∨ pointer?(b) ∨ reference?(b) ∨ bitfield?(b) ∨ enum?(b) ∨ pointer_to_member?(b) ∨ const?(b) ∨ volatile?(b)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of bitfield_range_underlying_TCC1.

Q.E.D.

C.47.3 Cpp_bitfield.bitfield_range_underlying_TCC2

Terse proof for bitfield_range_underlying_TCC2.
bitfield_range_underlying_TCC2:

{1} ∀ (b: Cpp_Subtype(bitfield?)): enum?(typ(b)) ⊃ Cpp_Type?(typ(b))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of bitfield_range_underlying_TCC2.

Q.E.D.

C.47.4 Cpp_bitfield.bitfield_range_underlying_TCC3

Terse proof for bitfield_range_underlying_TCC3.
bitfield_range_underlying_TCC3:

{1} ∀ (b: Cpp_Subtype(bitfield?)): ¬ enum?(typ(b)) ⊃ non_bool_integral?(typ(b))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Instantiating quantified variables, Expanding the definition of subterm, Applying disjunctive simplification to flatten sequent, Keeping (-16 -29 1 2) and hiding *, Expanding the definition of bitfield_underlying_integral_or_enum_type?, Expanding the definition of non_bool_integral_enum?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of bitfield_range_underlying_TCC3.

Q.E.D.

C.48 Proofs for Cpp_bool (types.pvs)

C.47.5 Cpp_bitfield.dt_bitfield_TCC1

Terse proof for dt_bitfield_TCC1.
dt_bitfield_TCC1:

{1} ∃ (x_{1}:

[b: Cpp_Subtype(bitfield?) →

(interpreted_data_type?[((range_bitfield(b)))])]):

true

Instantiating the top quantifier in 1 with the terms: (λ (b: Cpp_Subtype(bitfield?)): choose(interpreted_data_type?[((range_bitfield(b)))])),

we get 2 subgoals:

dt_bitfield_TCC1.1:

{1} true

which is trivially true. This completes the proof of dt_bitfield_TCC1.1.

dt_bitfield_TCC1.2:

{1} ∀ (b: Cpp_Subtype(bitfield?)):

nonempty?[Interpreted_data_type[((range_bitfield(b)))]] (interpreted_data_type?[((range_bitfield(b)))])

Repeatedly Skolemizing and flattening, Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Using lemma dt_bitfield_exists, Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of dt_bitfield_TCC1.2. Q.E.D.

C.48 Proofs for Cpp_bool (types.pvs)

C.48.1 Cpp_bool.range_bool_TCC1

Terse proof for range_bool_TCC1.
range_bool_TCC1:

{1} is_finite[bool](fullset[bool]) ∧ ¬ empty?[bool](fullset[bool])

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (2 LAMBDA (b: (fullset[bool])): IF b THEN 0

ELSE 1 ENDIF), Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_bool_TCC1. Q.E.D.

C.48.2 Cpp_bool.dt_bool_TCC1

Terse proof for dt_bool_TCC1.

dt_bool_TCC1:

{1} ∃ (x: (pod_data_type?[bool])): true

Rewriting using dt_bool_exists, matching in *, This completes the proof of dt_bool_TCC1. Q.E.D.

C.49 Proofs for Cpp_char (types.pvs)

C.49.1 Cpp_char.dt_char_TCC1

Terse proof for dt_char_TCC1.

dt_char_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_char)])): true

Rewriting using dt_char_exists, matching in *, This completes the proof of dt_char_TCC1. Q.E.D.

C.49.2 Cpp_char.value_bitmask_char_TCC1

Terse proof for value_bitmask_char_TCC1.
value_bitmask_char_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_char))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of value_bitmask_char_TCC1. Q.E.D.

C.49.3 Cpp_char.min_char

Terse proof for min_char.

min_char:

{1} min(range_char) ≤ 0

Using lemma char_is_uchar_or_schar, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

min_char.1:

{-1} range_char = range_schar
{1} min(range_char) ≤ 0

C.49 Proofs for Cpp_char (types.pvs)

Replacing using formula -1, Using lemma min_schar, Using lemma dt_schar_bits, Using lemma min_bits_per_byte, Using lemma bits_per_byte_minimum, Rewriting using dt_schar_size, matching in *, Rewriting using dt_uchar_size, matching in *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of min_char.1.

min_char.2:

{-1} range_char = extend[int, nat, bool, false](range_uchar)
{1} min(range_char) ≤ 0

Using lemma min_bits_per_byte, Using lemma bits_per_byte_minimum, Using lemma binary_range_uchar, Using lemma dt_uchar_bits, Rewriting using dt_uchar_size, matching in *, Using lemma expt_ge1, we get 2 subgoals:

min_char.2.1:

{-1} 2 ˆ (max_value_bits_uchar − 8) ≥ 1
{-2} max_value_bits_uchar = 1 × bits_per_byte
{-3} range_uchar(0) ≡ 0 ≤ max(range_uchar)
{-4} bits_per_byte ≥ min_bits_per_byte
{-5} min_bits_per_byte = 8
{-6} range_char = extend[int, nat, bool, false](range_uchar)
{1} min(range_char) ≤ 0

Trying repeated skolemization, instantiation, and if-lifting, Keeping (-3 1) and hiding *, Adding type constraints for min(extend[int, nat, bool, FALSE](range_uchar)), Instantiating the top quantifier in -2 with the terms: (0), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of min_char.2.1.

min_char.2.2:

{-1} max_value_bits_uchar = 1 × bits_per_byte
{-2} range_uchar(0) ≡ 0 ≤ max(range_uchar)
{-3} bits_per_byte ≥ min_bits_per_byte
{-4} min_bits_per_byte = 8
{-5} range_char = extend[int, nat, bool, false](range_uchar)
{1} max_value_bits_uchar − 8 ≥ 0
{2} min(range_char) ≤ 0

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of min_char.2.2. Q.E.D.

C.49.4 Cpp_char.max_char

Terse proof for max_char.

max_char:

{1} max(range_char) ≥ 127

Using lemma char_is_uchar_or_schar, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

max_char.1:

{-1} range_char = range_schar
{1} max(range_char) ≥ 127

Replacing using formula -1, Using lemma max_schar, Using lemma dt_schar_bits, Using lemma min_bits_per_byte, Using lemma bits_per_byte_minimum, Rewriting using dt_schar_size, matching in *, Rewriting using dt_uchar_size, matching in *, Using lemma expt_ge1, we get 2 subgoals:

max_char.1.1:

{-1} 2 ˆ (max_value_bits_schar − 7) ≥ 1
{-2} bits_per_byte ≥ min_bits_per_byte
{-3} min_bits_per_byte = 8
{-4} max_value_bits_schar ≥ 1 × bits_per_byte − 1
{-5} max(range_schar) ≥ (2 ˆ max_value_bits_schar ) − 1
{-6} range_char = range_schar
{1} max(range_schar) ≥ 127

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of max_char.1.1.

max_char.1.2:

{-1} bits_per_byte ≥ min_bits_per_byte
{-2} min_bits_per_byte = 8
{-3} max_value_bits_schar ≥ 1 × bits_per_byte − 1
{-4} max(range_schar) ≥ (2 ˆ max_value_bits_schar ) − 1
{-5} range_char = range_schar
{1} max_value_bits_schar − 7 ≥ 0
{2} max(range_schar) ≥ 127

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of max_char.1.2.

max_char.2:

{-1} range_char = extend[int, nat, bool, false](range_uchar)
{1} max(range_char) ≥ 127

Using lemma max_uchar, Using lemma dt_uchar_bits, Using lemma min_bits_per_byte, Using lemma bits_per_byte_minimum, Rewriting using dt_uchar_size, matching in *, Using lemma expt_ge1, we get 2 subgoals:

max_char.2.1:

{-1} 2 ˆ (max_value_bits_uchar − 8) ≥ 1
{-2} bits_per_byte ≥ min_bits_per_byte
{-3} min_bits_per_byte = 8
{-4} max_value_bits_uchar = 1 × bits_per_byte
{-5} max(range_uchar) ≥ (2 ˆ max_value_bits_uchar ) − 1
{-6} range_char = extend[int, nat, bool, false](range_uchar)
{1} max(range_char) ≥ 127

Replacing using formula -6, Trying repeated skolemization, instantiation, and if-lifting, Adding type constraints for max(extend[int, nat, bool, FALSE](range_uchar)), Instantiating the top quantifier in -2 with the terms: (127), Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using binary_range_uchar, matching in * where n gets 127, This completes the proof of max_char.2.1.

max_char.2.2:

{-1} bits_per_byte ≥ min_bits_per_byte
{-2} min_bits_per_byte = 8
{-3} max_value_bits_uchar = 1 × bits_per_byte
{-4} max(range_uchar) ≥ (2 ˆ max_value_bits_uchar ) − 1
{-5} range_char = extend[int, nat, bool, false](range_uchar)
{1} max_value_bits_uchar − 8 ≥ 0
{2} max(range_char) ≥ 127

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of max_char.2.2. Q.E.D.

C.49.5 Cpp_char.char_binary

Terse proof for char_binary.

char_binary:

{1} ∀ (i: int): range_char(i) ≡ (min(range_char) ≤ i ∧ i ≤ max(range_char))

Installing automatic rewrites from: extend Repeatedly Skolemizing and flattening, Using lemma char_is_uchar_or_schar, Splitting conjunctions, we get 2 subgoals:

char_binary.1:

{-1} range_char = range_schar
{-2} integer_pred(i′)
{1} range_char(i′) ≡ (min(range_char) ≤ i′ ∧ i′ ≤ max(range_char))

Replacing using formula -1, Using lemma schar_binary, This completes the proof of char_binary.1.

char_binary.2:

{-1} range_char = extend[int, nat, bool, false](range_uchar)
{-2} integer_pred(i′)
{1} range_char(i′) ≡ (min(range_char) ≤ i′ ∧ i′ ≤ max(range_char))

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

char_binary.2.1:

{-1} range_char = extend[int, nat, bool, false](range_uchar)
{-2} integer_pred(i′)
{-3} extend[int, nat, bool, false](range_uchar)(i′)
{1} i′ ≤ max(extend[int, nat, bool, false](range_uchar))

Adding type constraints for max(extend[int, nat, bool, FALSE](range_uchar)), Instantiating the top quantifier in -2 with the terms: (i!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of char_binary.2.1.

char_binary.2.2:

{-1} range_char = extend[int, nat, bool, false](range_uchar)
{-2} integer_pred(i′)
{-3} extend[int, nat, bool, false](range_uchar)(i′)
{1} min(extend[int, nat, bool, false](range_uchar)) ≤ i′

Adding type constraints for min(extend[int, nat, bool, FALSE](range_uchar)), Instantiating the top quantifier in -2 with the terms: (i!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of char_binary.2.2.

char_binary.2.3:

{-1} range_char = extend[int, nat, bool, false](range_uchar)
{-2} integer_pred(i′)
{-3} min(extend[int, nat, bool, false](range_uchar)) ≤ i′
{-4} i′ ≤ max(extend[int, nat, bool, false](range_uchar))
{1} extend[int, nat, bool, false](range_uchar)(i′)

Adding type constraints for max(extend[int, nat, bool, FALSE](range_uchar)), Adding type constraints for min(extend[int, nat, bool, FALSE](range_uchar)), Using lemma binary_range_uchar, we get 2 subgoals:

char_binary.2.3.1:

{-1} range_uchar(i′) ≡ i′ ≤ max(range_uchar)

{-2} extend[int, nat, bool, false]

(range_uchar)(min(extend[int, nat, bool, false](range_uchar)))

{-3} ∀ (x: int):

extend[int, nat, bool, false](range_uchar)(x) ⊃ min(extend[int, nat, bool, false](range_uchar)) ≤ x

{-4} extend[int, nat, bool, false]

(range_uchar)(max(extend[int, nat, bool, false](range_uchar)))

{-5} ∀ (x: int):

extend[int, nat, bool, false](range_uchar)(x) ⊃ x ≤ max(extend[int, nat, bool, false](range_uchar))

{-6} range_char = extend[int, nat, bool, false](range_uchar)
{-7} integer_pred(i′)
{-8} min(extend[int, nat, bool, false](range_uchar)) ≤ i′
{-9} i′ ≤ max(extend[int, nat, bool, false](range_uchar))
{1} extend[int, nat, bool, false](range_uchar)(i′)

Using lemma binary_range_uchar,

we get 2 subgoals:

char_binary.2.3.1.1:

{-1} range_uchar(max(extend[int, nat, bool, false](range_uchar))) ≡

max(extend[int, nat, bool, false](range_uchar)) ≤ max(range_uchar)

{-2} range_uchar(i′) ≡ i′ ≤ max(range_uchar)

{-3} extend[int, nat, bool, false]

(range_uchar)(min(extend[int, nat, bool, false](range_uchar)))

{-4} ∀ (x: int):

extend[int, nat, bool, false](range_uchar)(x) ⊃ min(extend[int, nat, bool, false](range_uchar)) ≤ x

{-5} extend[int, nat, bool, false]

(range_uchar)(max(extend[int, nat, bool, false](range_uchar)))

{-6} ∀ (x: int):

extend[int, nat, bool, false](range_uchar)(x) ⊃ x ≤ max(extend[int, nat, bool, false](range_uchar))

{-7} range_char = extend[int, nat, bool, false](range_uchar)
{-8} integer_pred(i′)
{-9} min(extend[int, nat, bool, false](range_uchar)) ≤ i′
{-10} i′ ≤ max(extend[int, nat, bool, false](range_uchar))
{1} extend[int, nat, bool, false](range_uchar)(i′)

Expanding the definition of extend,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of char_binary.2.3.1.1.

char_binary.2.3.1.2:

{-1} range_uchar(i′) ≡ i′ ≤ max(range_uchar)

{-2} extend[int, nat, bool, false]

(range_uchar)(min(extend[int, nat, bool, false](range_uchar)))

{-3} ∀ (x: int):

extend[int, nat, bool, false](range_uchar)(x) ⊃ min(extend[int, nat, bool, false](range_uchar)) ≤ x

{-4} extend[int, nat, bool, false]

(range_uchar)(max(extend[int, nat, bool, false](range_uchar)))

{-5} ∀ (x: int):

extend[int, nat, bool, false](range_uchar)(x) ⊃ x ≤ max(extend[int, nat, bool, false](range_uchar))

{-6} range_char = extend[int, nat, bool, false](range_uchar)
{-7} integer_pred(i′)
{-8} min(extend[int, nat, bool, false](range_uchar)) ≤ i′
{-9} i′ ≤ max(extend[int, nat, bool, false](range_uchar))

{1} max[int, restrict[[real, real], [int, int], boolean](≤)]

(extend[int, nat, bool, false](range_uchar)) ≥ 0

{2} extend[int, nat, bool, false](range_uchar)(i′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of char_binary.2.3.1.2.

char_binary.2.3.2:

{-1} extend[int, nat, bool, false]

(range_uchar)(min(extend[int, nat, bool, false](range_uchar)))

{-2} ∀ (x: int):

extend[int, nat, bool, false](range_uchar)(x) ⊃ min(extend[int, nat, bool, false](range_uchar)) ≤ x

{-3} extend[int, nat, bool, false]

(range_uchar)(max(extend[int, nat, bool, false](range_uchar)))

{-4} ∀ (x: int):

extend[int, nat, bool, false](range_uchar)(x) ⊃ x ≤ max(extend[int, nat, bool, false](range_uchar))

{-5} range_char = extend[int, nat, bool, false](range_uchar)
{-6} integer_pred(i′)
{-7} min(extend[int, nat, bool, false](range_uchar)) ≤ i′
{-8} i′ ≤ max(extend[int, nat, bool, false](range_uchar))
{1} i′ ≥ 0
{2} extend[int, nat, bool, false](range_uchar)(i′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of char_binary.2.3.2. Q.E.D.

C.50 Proofs for Cpp_class (types.pvs)

C.50.1 Cpp_class.uidt_class_TCC1

Terse proof for uidt_class_TCC1.

C.51 Proofs for Cpp_const_volatile (types.pvs)

uidt_class_TCC1:

{1} ∃ (x:

[Cpp_Subtype(class?) → {uidt: (uninterpreted_data_type?) | size(uidt) > 0}]): true

Instantiating the top quantifier in 1 with the terms: (λ (c: Cpp_Subtype(class?)): choose({uidt: (uninterpreted_data_type?) | size(uidt) > 0})),

we get 2 subgoals:

uidt_class_TCC1.1:

{1} true

which is trivially true. This completes the proof of uidt_class_TCC1.1.

uidt_class_TCC1.2:

{1} ∀ (c: Cpp_Subtype(class?)):

nonempty?[(uninterpreted_data_type?)] ({uidt: (uninterpreted_data_type?) | size(uidt) > 0})

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in -3 with the terms: ((# size := 1, valid? := LAMBDA (l: list[Byte],

a: Address): FALSE #)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_class_TCC1.2. Q.E.D.

C.51 Proofs for Cpp_const_volatile (types.pvs)

C.51.1 Cpp_const_volatile.dt_volatile_TCC1

Terse proof for dt_volatile_TCC1.
dt_volatile_TCC1:

{1} ∃ (x: [(interpreted_data_type?[Data]) → (interpreted_data_type?[Data])]): true

Instantiating the top quantifier in 1 with the terms: (λ (idt: (interpreted_data_type?[Data])): idt), which is trivially true. This completes the proof of dt_volatile_TCC1. Q.E.D.

C.52 Proofs for Cpp_double (types.pvs)

C.52.1 Cpp_double.dt_double_TCC1

Terse proof for dt_double_TCC1.
dt_double_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_double)])): true

Rewriting using dt_double_exists, matching in *, This completes the proof of dt_double_TCC1. Q.E.D.

C.53 Proofs for Cpp_enum (types.pvs)

C.53.1 Cpp_enum.valid_range?_TCC1

Terse proof for valid_range?_TCC1.
valid_range?_TCC1:

{1} ∀ (e: Cpp_Subtype(enum?), r: non_empty_finite_set[int]):

array?(e) ∨ pointer?(e) ∨ reference?(e) ∨ bitfield?(e) ∨ enum?(e) ∨ pointer_to_member?(e) ∨ const?(e) ∨ volatile?(e)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of valid_range?_TCC1. Q.E.D.

C.53.2 Cpp_enum.valid_range?_TCC2

Terse proof for valid_range?_TCC2.
valid_range?_TCC2:

{1} ∀ (e: Cpp_Subtype(enum?), r: non_empty_finite_set[int]): non_bool_integral?(typ(e))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Instantiating quantified variables, Expanding the definition of subterm, Expanding the definition of enum_underlying_integral?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of valid_range?_TCC2. Q.E.D.

C.53.3 Cpp_enum.range_enum_TCC1

Terse proof for range_enum_TCC1.
range_enum_TCC1:

{1} ∃ (x: [e: Cpp_Subtype(enum?) → (valid_range?(e))]): true

Instantiating the top quantifier in 1 with the terms: (λ (e: Cpp_Subtype(enum?)): range_integral(typ(e))),

we get 3 subgoals:

range_enum_TCC1.1:

{1} true

C.53 Proofs for Cpp_enum (types.pvs)

which is trivially true. This completes the proof of range_enum_TCC1.1.

range_enum_TCC1.2:

{1} ∀ (e: Cpp_Subtype(enum?)): valid_range?(e)(range_integral(typ(e)))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Instantiating quantified variables, Expanding the definition of subterm, Applying disjunctive simplification to flatten sequent, Keeping (-18 -19 1) and hiding *, Expanding the definition of enum_underlying_integral?, Expanding the definition of enum_constants?, Expanding the definition of valid_range?, Rewriting using subset_reflexive, matching in *, This completes the proof of range_enum_TCC1.2.

range_enum_TCC1.3:

{1} ∀ (e: Cpp_Subtype(enum?)): non_bool_integral?(typ(e))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Instantiating quantified variables, Expanding the definition of subterm, Applying disjunctive simplification to flatten sequent, Keeping (-18 1) and hiding *, Expanding the definition of enum_underlying_integral?, which is trivially true. This completes the proof of range_enum_TCC1.3. Q.E.D.

C.53.4 Cpp_enum.dt_enum_TCC1

Terse proof for dt_enum_TCC1.

dt_enum_TCC1:

{1} ∃ (x_{1}: [e: Cpp_Subtype(enum?) → (pod_data_type?[((range_enum(e)))])]): true

Instantiating the top quantifier in 1 with the terms: (λ (e: Cpp_Subtype(enum?)): choose(pod_data_type?[((range_enum(e)))])),

we get 2 subgoals:

dt_enum_TCC1.1:

{1} true

which is trivially true. This completes the proof of dt_enum_TCC1.1.

dt_enum_TCC1.2:

{1} ∀ (e: Cpp_Subtype(enum?)):

nonempty?[Interpreted_data_type[((range_enum(e)))]] (pod_data_type?[((range_enum(e)))])

Repeatedly Skolemizing and flattening, Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Using lemma dt_enum_exists, Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of dt_enum_TCC1.2. Q.E.D.

C.53.5 Cpp_enum.value_bitmask_enum_TCC1

Terse proof for value_bitmask_enum_TCC1.
value_bitmask_enum_TCC1:

{1} ∃ (x_{1}:

[e: Cpp_Subtype(enum?) →

{l: list[Byte] | length[Byte](l) = size(uidt(dt_enum(e)))}]):

true

Instantiating the top quantifier in 1 with the terms: (λ (e: Cpp_Subtype(enum?)): choose({l: list[Byte] | length[Byte](l) = size(uidt(dt_enum(e)))})),

we get 2 subgoals:

value_bitmask_enum_TCC1.1:

{1} true

which is trivially true.

This completes the proof of value_bitmask_enum_TCC1.1.
value_bitmask_enum_TCC1.2:

{1} ∀ (e: Cpp_Subtype(enum?)): nonempty?[list[Byte]]

({l: list[Byte] | length[Byte](l) = size(uidt(dt_enum(e)))})

Repeatedly Skolemizing and flattening, Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Using lemma list_all_length[Byte], Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -5 with the terms: (l!1), which is trivially true.

This completes the proof of value_bitmask_enum_TCC1.2.

Q.E.D.

C.54 Proofs for Cpp_float (types.pvs)

C.53.6 Cpp_enum.enum_size_TCC1

Terse proof for enum_size_TCC1.
enum_size_TCC1:

{1} ∀ (e: Cpp_Subtype(enum?)):

array?(e) ∨ pointer?(e) ∨ reference?(e) ∨ bitfield?(e) ∨ enum?(e) ∨ pointer_to_member?(e) ∨ const?(e) ∨ volatile?(e)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of enum_size_TCC1. Q.E.D.

C.53.7 Cpp_enum.enum_size_TCC2

Terse proof for enum_size_TCC2.
enum_size_TCC2:

{1} ∀ (e: Cpp_Subtype(enum?)): non_bool_integral?(typ(e))

Repeatedly Skolemizing and flattening, Expanding the definition of Cpp_Type?, Instantiating quantified variables, Expanding the definition of subterm, Applying disjunctive simplification to flatten sequent, Keeping (-18 -27 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of enum_size_TCC2. Q.E.D.

C.54 Proofs for Cpp_float (types.pvs)

C.54.1 Cpp_float.range_float_TCC1

Terse proof for range_float_TCC1.
range_float_TCC1:

{1} ∃ (x: non_empty_finite_set[extended_real]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: extended_real): n = 0), we get 2 subgoals:

range_float_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_float_TCC1.1.

range_float_TCC1.2:

{1} is_finite[extended_real](λ (n: extended_real): n = 0) ∧ ¬ empty?[extended_real](λ (n: extended_real): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: extended_real):

n = 0)): 0), which is trivially true. This completes the proof of range_float_TCC1.2. Q.E.D.

C.54.2 Cpp_float.dt_float_TCC1

Terse proof for dt_float_TCC1.

dt_float_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_float)])): true

Rewriting using dt_float_exists, matching in *, This completes the proof of dt_float_TCC1. Q.E.D.

C.55 Proofs for Cpp_function (types.pvs)

C.55.1 Cpp_function.uidt_function_TCC1

Terse proof for uidt_function_TCC1.
uidt_function_TCC1:

{1} ∀ (f: Cpp_Subtype(function?)):

uninterpreted_data_type?((#size := 0, valid? := λ (l: list[Byte], a: Address): false#))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_function_TCC1. Q.E.D.

C.55.2 Cpp_function.dt_vtable_TCC1

Terse proof for dt_vtable_TCC1.
dt_vtable_TCC1:

{1} ∃ (x_{1}:

[c: Cpp_Subtype(class?) →

(interpreted_data_type?[((singleton[Vtable](vtable(c))))])]):

true

Instantiating the top quantifier in 1 with the terms: (λ (c: Cpp_Subtype(class?)): choose(interpreted_data_type?[((singleton[Vtable](vtable(c))))])),

we get 2 subgoals:

C.56 Proofs for Cpp_int (types.pvs)

dt_vtable_TCC1.1:

{1} true

which is trivially true. This completes the proof of dt_vtable_TCC1.1.

dt_vtable_TCC1.2:

{1} ∀ (c: Cpp_Subtype(class?)):

nonempty?[Interpreted_data_type[((singleton[Vtable](vtable(c))))]] (interpreted_data_type?[((singleton[Vtable](vtable(c))))])

Repeatedly Skolemizing and flattening, Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Using lemma vtable_idt_exists, Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of dt_vtable_TCC1.2. Q.E.D.

C.56 Proofs for Cpp_int (types.pvs)

C.56.1 Cpp_int.range_int_TCC1

Terse proof for range_int_TCC1.
range_int_TCC1:

{1} ∃ (x: non_empty_finite_set[int]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: int): n = 0), we get 2 subgoals:

range_int_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_int_TCC1.1.

range_int_TCC1.2:

{1} is_finite[int](λ (n: int): n = 0) ∧ ¬ empty?[int](λ (n: int): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: int): n = 0)):

0), which is trivially true. This completes the proof of range_int_TCC1.2. Q.E.D.

C.56.2 Cpp_int.dt_int_TCC1

Terse proof for dt_int_TCC1.

dt_int_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_int)])): true

Rewriting using dt_int_exists, matching in *, This completes the proof of dt_int_TCC1. Q.E.D.

C.56.3 Cpp_int.value_bitmask_int_TCC1

Terse proof for value_bitmask_int_TCC1.
value_bitmask_int_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_int))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of value_bitmask_int_TCC1. Q.E.D.

C.57 Proofs for Cpp_long (types.pvs)

C.57.1 Cpp_long.range_long_TCC1

Terse proof for range_long_TCC1.
range_long_TCC1:

{1} ∃ (x: non_empty_finite_set[int]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: int): n = 0), we get 2 subgoals:

range_long_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_long_TCC1.1.

range_long_TCC1.2:

{1} is_finite[int](λ (n: int): n = 0) ∧ ¬ empty?[int](λ (n: int): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: int): n = 0)):

0), which is trivially true. This completes the proof of range_long_TCC1.2. Q.E.D.

C.58 Proofs for Cpp_longdouble (types.pvs)

C.57.2 Cpp_long.dt_long_TCC1

Terse proof for dt_long_TCC1.

dt_long_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_long)])): true

Rewriting using dt_long_exists, matching in *, This completes the proof of dt_long_TCC1. Q.E.D.

C.57.3 Cpp_long.value_bitmask_long_TCC1

Terse proof for value_bitmask_long_TCC1.
value_bitmask_long_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_long))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of value_bitmask_long_TCC1. Q.E.D.

C.58 Proofs for Cpp_longdouble (types.pvs)

C.58.1 Cpp_longdouble.dt_longdouble_TCC1

Terse proof for dt_longdouble_TCC1.
dt_longdouble_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_longdouble)])): true

Rewriting using dt_longdouble_exists, matching in *, This completes the proof of dt_longdouble_TCC1. Q.E.D.

C.59 Proofs for Cpp_longlong (types.pvs)

C.59.1 Cpp_longlong.range_longlong_TCC1

Terse proof for range_longlong_TCC1.
range_longlong_TCC1:

{1} ∃ (x: non_empty_finite_set[int]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: int): n = 0), we get 2 subgoals:

range_longlong_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_longlong_TCC1.1.

range_longlong_TCC1.2:

{1} is_finite[int](λ (n: int): n = 0) ∧ ¬ empty?[int](λ (n: int): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: int): n = 0)):

0), which is trivially true. This completes the proof of range_longlong_TCC1.2. Q.E.D.

C.59.2 Cpp_longlong.dt_longlong_TCC1

Terse proof for dt_longlong_TCC1.
dt_longlong_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_longlong)])): true

Rewriting using dt_longlong_exists, matching in *, This completes the proof of dt_longlong_TCC1. Q.E.D.

C.59.3 Cpp_longlong.value_bitmask_longlong_TCC1

Terse proof for value_bitmask_longlong_TCC1.
value_bitmask_longlong_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_longlong))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of value_bitmask_longlong_TCC1.

Q.E.D.

C.60 Proofs for Cpp_pointer (types.pvs)

C.60.1 Cpp_pointer.dt_pointer_TCC1

Terse proof for dt_pointer_TCC1.
dt_pointer_TCC1:

{1} ∃ (x_{1}: [p: Cpp_Subtype(pointer?) → (pod_data_type?[((range_pointer(p)))])]):

true

Using lemma dt_pointer_exists, Instantiating the top quantifier in 1 with the terms: (LAMBDA (p: Cpp_Subtype(pointer?)):

choose(pod_data_type?[((range_pointer(p)))])), we get 2 subgoals:

C.60 Proofs for Cpp_pointer (types.pvs)

dt_pointer_TCC1.1:

{-1} ∀ (p: Cpp_Subtype(pointer?)):

∃ (dt: (pod_data_type?[((range_pointer(p)))])): true

{1} true

which is trivially true. This completes the proof of dt_pointer_TCC1.1.

dt_pointer_TCC1.2:

{-1} ∀ (p: Cpp_Subtype(pointer?)):

∃ (dt: (pod_data_type?[((range_pointer(p)))])): true {1} ∀ (p: Cpp_Subtype(pointer?)):

nonempty?[Interpreted_data_type[((range_pointer(p)))]] (pod_data_type?[((range_pointer(p)))])

Repeatedly Skolemizing and flattening, Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Instantiating quantified variables, Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of dt_pointer_TCC1.2. Q.E.D.

C.60.2 Cpp_pointer.pointers_to_layout_compatible_range_TCC1

Terse proof for pointers_to_layout_compatible_range_TCC1.
pointers_to_layout_compatible_range_TCC1:

{1} ∀ (p_{1}, p_{2}: Cpp_Subtype(pointer?)): array?(p_{1}) ∨ pointer?(p_{1}) ∨ reference?(p_{1}) ∨ bitfield?(p_{1}) ∨ enum?(p_{1}) ∨ pointer_to_member?(p_{1}) ∨ const?(p_{1}) ∨ volatile?(p_{1})

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pointers_to_layout_compatible_range_TCC1.

Q.E.D.

C.60.3 Cpp_pointer.pointers_to_layout_compatible_range_TCC2

Terse proof for pointers_to_layout_compatible_range_TCC2.
pointers_to_layout_compatible_range_TCC2:

{1} ∀ (p_{1}, p_{2}: Cpp_Subtype(pointer?)): Cpp_Type?(typ(p_{1}))

Repeatedly Skolemizing and flattening, Keeping (-1 1) and hiding *, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pointers_to_layout_compatible_range_TCC2.

Q.E.D.

C.60.4 Cpp_pointer.pointers_to_layout_compatible_range_TCC3

Terse proof for pointers_to_layout_compatible_range_TCC3.
pointers_to_layout_compatible_range_TCC3:

{1} ∀ (p_{1}, p_{2}: Cpp_Subtype(pointer?)): array?(p_{2}) ∨ pointer?(p_{2}) ∨ reference?(p_{2}) ∨ bitfield?(p_{2}) ∨ enum?(p_{2}) ∨ pointer_to_member?(p_{2}) ∨ const?(p_{2}) ∨ volatile?(p_{2})

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pointers_to_layout_compatible_range_TCC3.

Q.E.D.

C.60.5 Cpp_pointer.pointers_to_layout_compatible_range_TCC4

Terse proof for pointers_to_layout_compatible_range_TCC4.
pointers_to_layout_compatible_range_TCC4:

{1} ∀ (p_{1}, p_{2}: Cpp_Subtype(pointer?)): Cpp_Type?(typ(p_{2}))

Repeatedly Skolemizing and flattening, Keeping (-3 1) and hiding *, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of subterm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pointers_to_layout_compatible_range_TCC4.

Q.E.D.

C.60.6 Cpp_pointer.pointers_to_layout_compatible_dt_TCC1

Terse proof for pointers_to_layout_compatible_dt_TCC1.
pointers_to_layout_compatible_dt_TCC1:

{1} ∀ (p_{1}, p_{2}: Cpp_Subtype(pointer?)):

layout_compatible?(typ(p_{1}), typ(p_{2})) ⊃ (∀ (x: lift[Pointer_Base_Type]): range_pointer(p_{2})(x) ≡ range_pointer(p_{1})(x))

Repeatedly Skolemizing and flattening, Using lemma pointers_to_layout_compatible_range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pointers_to_layout_compatible_dt_TCC1.

Q.E.D.

C.60.7 Cpp_pointer.void_pointer_char_pointer_dt_TCC1

Terse proof for void_pointer_char_pointer_dt_TCC1.
void_pointer_char_pointer_dt_TCC1:

{1} ∀ (p_{1}, p_{2}: Cpp_Subtype(pointer?)):

void?(typ(p_{1})) ∧ char?(typ(p_{2})) ⊃ (∀ (x: lift[Pointer_Base_Type]): range_pointer(p_{2})(x) ≡ range_pointer(p_{1})(x))

Repeatedly Skolemizing and flattening, Using lemma void_pointer_char_pointer_range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of void_pointer_char_pointer_dt_TCC1.

Q.E.D.

C.60.8 Cpp_pointer.add_TCC1

Terse proof for add_TCC1.

add_TCC1:

{1} ∃ (x:

[ptyp: Cpp_Subtype(cv(pointer?)) →

[[(range_pointer(cv_base(ptyp))), int] → (range_pointer(cv_base(ptyp)))]]):

true

Instantiating the top quantifier in 1 with the terms: (λ (p: Cpp_Subtype(cv(pointer?))): λ (y: (range_pointer(cv_base(p))), z: int): y),

which is trivially true. This completes the proof of add_TCC1. Q.E.D.

C.60.9 Cpp_pointer.add_spec2_TCC1

Terse proof for add_spec2_TCC1.
add_spec2_TCC1:

{1} ∀ (i: int, ptyp: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(ptyp)))): not_null?(ptyp)(ptr_val) ⊃ up?[Memory_Address](address_of(ptyp)(add(ptyp)(ptr_val, i)))

Repeatedly Skolemizing and flattening, Using lemma add_spec, Using lemma address_of_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of add_spec2_TCC1. Q.E.D.

C.60.10 Cpp_pointer.add_spec2_TCC2

Terse proof for add_spec2_TCC2.

add_spec2_TCC2:

{1} ∀ (ptyp: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(ptyp)))): not_null?(ptyp)(ptr_val) ⊃ up?[Memory_Address](address_of(ptyp)(ptr_val))

Repeatedly Skolemizing and flattening, Using lemma address_of_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of add_spec2_TCC2. Q.E.D.

C.60.11 Cpp_pointer.add_simplification

Terse proof for add_simplification.
add_simplification:

{1} ∀ (ptyp: Cpp_Subtype(cv(pointer?)), ptr_val: (range_pointer(cv_base(ptyp))),

i, j: int): address_of(ptyp)(add(ptyp)(add(ptyp)(ptr_val, i), j)) = address_of(ptyp)(add(ptyp)(ptr_val, i + j))

Repeatedly Skolemizing and flattening, Case splitting on not_null?(ptyp!1)(ptr_val!1), we get 2 subgoals:

add_simplification.1:

{-1} not_null?(ptyp′)(ptr_val′)
{-2} Cpp_Type?(ptyp′)
{-3} cv(pointer?)(ptyp′)
{-4} range_pointer(cv_base(ptyp′))(ptr_val′)
{-5} integer_pred(i′)
{-6} integer_pred(j′)

{1} address_of(ptyp′)(add(ptyp′)(add(ptyp′)(ptr_val′, i′), j′)) = address_of(ptyp′)(add(ptyp′)(ptr_val′, i′ + j′))

Using lemma add_spec, Using lemma add_spec, Using lemma add_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma add_spec2, Using lemma add_spec2, Using lemma add_spec2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -5, Case splitting on down(address_of(ptyp!1)(ptr_val!1)) + i!1 + j!1 = down(address_of(ptyp!1)(ptr_val!1))

+ (i!1 + j!1), we get 2 subgoals:

add_simplification.1.1:

{-1} down(address_of(ptyp′)(ptr_val′)) + i′ + j′ =

down(address_of(ptyp′)(ptr_val′)) + (i′ + j′)

{-2} not_null?(ptyp′)(ptr_val′)

{-3} down(address_of(ptyp′)(add(ptyp′)(ptr_val′, i′ + j′))) =

down(address_of(ptyp′)(ptr_val′)) + i′ + j′

{-4} not_null?(ptyp′)(add(ptyp′)(ptr_val′, i′))

{-5} down(address_of(ptyp′)(add(ptyp′)(add(ptyp′)(ptr_val′, i′), j′))) =

down(address_of(ptyp′)(ptr_val′)) + i′ + j′ {-6} down(address_of(ptyp′)(add(ptyp′)(ptr_val′, i′))) =

down(address_of(ptyp′)(ptr_val′)) + i′

{-7} not_null?(ptyp′)(add(ptyp′)(ptr_val′, i′ + j′))
{-8} not_null?(ptyp′)(add(ptyp′)(add(ptyp′)(ptr_val′, i′), j′))
{-9} Cpp_Type?(ptyp′)
{-10} cv(pointer?)(ptyp′)
{-11} range_pointer(cv_base(ptyp′))(ptr_val′)
{-12} integer_pred(i′)
{-13} integer_pred(j′)

{1} address_of(ptyp′)(add(ptyp′)(add(ptyp′)(ptr_val′, i′), j′)) = address_of(ptyp′)(add(ptyp′)(ptr_val′, i′ + j′))

Replacing using formula -1, Replacing using formula -3, Keeping (-5 -7 -8 1) and hiding *, Using lemma address_of_spec, Using lemma address_of_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3), Rewriting using lift_up_extensionality, matching in *, This completes the proof of add_simplification.1.1.

add_simplification.1.2:

{-1} not_null?(ptyp′)(ptr_val′)

{-2} down(address_of(ptyp′)(add(ptyp′)(ptr_val′, i′ + j′))) =

down(address_of(ptyp′)(ptr_val′)) + i′ + j′

{-3} not_null?(ptyp′)(add(ptyp′)(ptr_val′, i′))

{-4} down(address_of(ptyp′)(add(ptyp′)(add(ptyp′)(ptr_val′, i′), j′))) =

down(address_of(ptyp′)(ptr_val′)) + i′ + j′ {-5} down(address_of(ptyp′)(add(ptyp′)(ptr_val′, i′))) =

down(address_of(ptyp′)(ptr_val′)) + i′

{-6} not_null?(ptyp′)(add(ptyp′)(ptr_val′, i′ + j′))
{-7} not_null?(ptyp′)(add(ptyp′)(add(ptyp′)(ptr_val′, i′), j′))
{-8} Cpp_Type?(ptyp′)
{-9} cv(pointer?)(ptyp′)
{-10} range_pointer(cv_base(ptyp′))(ptr_val′)
{-11} integer_pred(i′)
{-12} integer_pred(j′)

{1} down(address_of(ptyp′)(ptr_val′)) + i′ + j′ =

down(address_of(ptyp′)(ptr_val′)) + (i′ + j′) {2} address_of(ptyp′)(add(ptyp′)(add(ptyp′)(ptr_val′, i′), j′)) =

address_of(ptyp′)(add(ptyp′)(ptr_val′, i′ + j′))

Keeping (1) and hiding *, Expanding the definition of +, which is trivially true. This completes the proof of add_simplification.1.2.

add_simplification.2:

{-1} Cpp_Type?(ptyp′)
{-2} cv(pointer?)(ptyp′)
{-3} range_pointer(cv_base(ptyp′))(ptr_val′)
{-4} integer_pred(i′)
{-5} integer_pred(j′)
{1} not_null?(ptyp′)(ptr_val′)

{2} address_of(ptyp′)(add(ptyp′)(add(ptyp′)(ptr_val′, i′), j′)) = address_of(ptyp′)(add(ptyp′)(ptr_val′, i′ + j′))

Using lemma add_spec, Using lemma add_spec, Using lemma add_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of not_null?, Using lemma address_of_spec2, Using lemma address_of_spec2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of add_simplification.2. Q.E.D.

C.60.12 Cpp_pointer.void_pointer_other_pointer_value_TCC1

Terse proof for void_pointer_other_pointer_value_TCC1.
void_pointer_other_pointer_value_TCC1:

{1} ∀ (p_{1}, p_{2}: Cpp_Subtype(cv(pointer?)), ptr_val1: (range_pointer(cv_base(p_{1})))): array?(cv_base(p_{1})) ∨ pointer?(cv_base(p_{1})) ∨ reference?(cv_base(p_{1})) ∨ bitfield?(cv_base(p_{1})) ∨ enum?(cv_base(p_{1})) ∨ pointer_to_member?(cv_base(p_{1})) ∨ const?(cv_base(p_{1})) ∨ volatile?(cv_base(p_{1}))

Repeatedly Skolemizing and flattening, Keeping (-2 2) and hiding *, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of void_pointer_other_pointer_value_TCC1.

Q.E.D.

C.60.13 Cpp_pointer.void_pointer_other_pointer_value_TCC2

Terse proof for void_pointer_other_pointer_value_TCC2.

C.61 Proofs for Cpp_pointer_to_member (types.pvs)

void_pointer_other_pointer_value_TCC2:

{1} ∀ (p_{1}, p_{2}: Cpp_Subtype(cv(pointer?)), ptr_val1: (range_pointer(cv_base(p_{1})))): void?(typ(cv_base(p_{1}))) ∧ not_null?(p_{1})(ptr_val1) ⊃ (∀ (ptr_val2: (range_pointer(cv_base(p_{2})))):

not_null?(p_{2})(ptr_val2) ⊃ up?[Memory_Address](address_of(p_{2})(ptr_val2)))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *,

This completes the proof of void_pointer_other_pointer_value_TCC2.

Q.E.D.

C.61 Proofs for Cpp_pointer_to_member (types.pvs)

C.61.1 Cpp_pointer_to_member.dt_ptm_TCC1

Terse proof for dt_ptm_TCC1.

dt_ptm_TCC1:

{1} ∃ (x_{1}:

[p: Cpp_Subtype(pointer_to_member?) →

(pod_data_type?[((range_ptm(p)))])]):

true

Instantiating the top quantifier in 1 with the terms: (λ (p: Cpp_Subtype(pointer_to_member?)): choose(pod_data_type?[((range_ptm(p)))])),

we get 2 subgoals:

dt_ptm_TCC1.1:

{1} true

which is trivially true. This completes the proof of dt_ptm_TCC1.1.

dt_ptm_TCC1.2:

{1} ∀ (p: Cpp_Subtype(pointer_to_member?)):

nonempty?[Interpreted_data_type[((range_ptm(p)))]] (pod_data_type?[((range_ptm(p)))])

Repeatedly Skolemizing and flattening, Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Using lemma dt_pointer_to_member_exists, Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of dt_ptm_TCC1.2. Q.E.D.

C.62 Proofs for Cpp_reference (types.pvs)

C.62.1 Cpp_reference.dt_reference_TCC1

Terse proof for dt_reference_TCC1.
dt_reference_TCC1:

{1} ∃ (x_{1}: [r: Cpp_Subtype(reference?) → (pod_data_type?[((alloc_range(r)))])]):

true

Using lemma dt_ref_exists, Instantiating the top quantifier in 1 with the terms: (LAMBDA (r: Cpp_Subtype(reference?)):

choose(pod_data_type?[((alloc_range(r)))])), we get 2 subgoals:

dt_reference_TCC1.1:

{-1} ∀ (r: Cpp_Subtype(reference?)):

∃ (dt: (pod_data_type?[((alloc_range(r)))])): true

{1} true

which is trivially true. This completes the proof of dt_reference_TCC1.1.

dt_reference_TCC1.2:

{-1} ∀ (r: Cpp_Subtype(reference?)):

∃ (dt: (pod_data_type?[((alloc_range(r)))])): true {1} ∀ (r: Cpp_Subtype(reference?)):

nonempty?[Interpreted_data_type[((alloc_range(r)))]] (pod_data_type?[((alloc_range(r)))])

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of nonempty?, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of member, which is trivially true. This completes the proof of dt_reference_TCC1.2. Q.E.D.

C.63 Proofs for Cpp_schar (types.pvs)

C.63.1 Cpp_schar.range_schar_TCC1

Terse proof for range_schar_TCC1.
range_schar_TCC1:

{1} ∃ (x: non_empty_finite_set[int]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: int): n = 0), we get 2 subgoals:

C.63 Proofs for Cpp_schar (types.pvs)

range_schar_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_schar_TCC1.1.

range_schar_TCC1.2:

{1} is_finite[int](λ (n: int): n = 0) ∧ ¬ empty?[int](λ (n: int): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: int): n = 0)):

0), which is trivially true. This completes the proof of range_schar_TCC1.2. Q.E.D.

C.63.2 Cpp_schar.dt_schar_TCC1

Terse proof for dt_schar_TCC1.

dt_schar_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_schar)])): true

Rewriting using dt_schar_exists, matching in *, This completes the proof of dt_schar_TCC1. Q.E.D.

C.63.3 Cpp_schar.schar_value_eq_uchar_value_TCC1

Terse proof for schar_value_eq_uchar_value_TCC1.
schar_value_eq_uchar_value_TCC1:

{1} ∀ (i: (range_schar)): i ≥ 0 ⊃ (range_uchar)(i)

Repeatedly Skolemizing and flattening, Rewriting using schar_nonneg_is_uchar, matching in *,

This completes the proof of schar_value_eq_uchar_value_TCC1.

Q.E.D.

C.63.4 Cpp_schar.value_bitmask_schar_TCC1

Terse proof for value_bitmask_schar_TCC1.
value_bitmask_schar_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_schar))}): true

Using lemma list_all_length[Byte], Instantiating the top quantifier in -1 with the terms: (size(uidt(dt_schar))), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of value_bitmask_schar_TCC1.

Q.E.D.

C.64 Proofs for Cpp_short (types.pvs)

C.64.1 Cpp_short.range_short_TCC1

Terse proof for range_short_TCC1.
range_short_TCC1:

{1} ∃ (x: non_empty_finite_set[int]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: int): n = 0), we get 2 subgoals:

range_short_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_short_TCC1.1.

range_short_TCC1.2:

{1} is_finite[int](λ (n: int): n = 0) ∧ ¬ empty?[int](λ (n: int): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: int): n = 0)):

0), which is trivially true. This completes the proof of range_short_TCC1.2. Q.E.D.

C.64.2 Cpp_short.dt_short_TCC1

Terse proof for dt_short_TCC1.

dt_short_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_short)])): true

Rewriting using dt_short_exists, matching in *, This completes the proof of dt_short_TCC1. Q.E.D.

C.64.3 Cpp_short.value_bitmask_short_TCC1

Terse proof for value_bitmask_short_TCC1.
value_bitmask_short_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_short))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting,

C.65 Proofs for Cpp_uchar (types.pvs)

This completes the proof of value_bitmask_short_TCC1.

Q.E.D.

C.65 Proofs for Cpp_uchar (types.pvs)

C.65.1 Cpp_uchar.range_uchar_TCC1

Terse proof for range_uchar_TCC1.
range_uchar_TCC1:

{1} ∃ (x: non_empty_finite_set[nat]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: nat): n = 0), we get 2 subgoals:

range_uchar_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_uchar_TCC1.1.

range_uchar_TCC1.2:

{1} is_finite[nat](λ (n: nat): n = 0) ∧ ¬ empty?[nat](λ (n: nat): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: nat): n = 0)):

0), which is trivially true. This completes the proof of range_uchar_TCC1.2. Q.E.D.

C.65.2 Cpp_uchar.dt_uchar_TCC1

Terse proof for dt_uchar_TCC1.

dt_uchar_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_uchar)])): true

Using lemma dt_uchar_exists, This completes the proof of dt_uchar_TCC1. Q.E.D.

C.65.3 Cpp_uchar.value_bitmask_uchar_TCC1

Terse proof for value_bitmask_uchar_TCC1.
value_bitmask_uchar_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_uchar))}): true

Using lemma list_all_length[Byte], Instantiating the top quantifier in -1 with the terms: (size(uidt(dt_uchar))), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of value_bitmask_uchar_TCC1.

Q.E.D.

C.66 Proofs for Cpp_uint (types.pvs)

C.66.1 Cpp_uint.range_uint_TCC1

Terse proof for range_uint_TCC1.
range_uint_TCC1:

{1} ∃ (x: non_empty_finite_set[nat]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: nat): n = 0), we get 2 subgoals:

range_uint_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_uint_TCC1.1.

range_uint_TCC1.2:

{1} is_finite[nat](λ (n: nat): n = 0) ∧ ¬ empty?[nat](λ (n: nat): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (p: (LAMBDA (n: nat): n = 0)):

0), which is trivially true. This completes the proof of range_uint_TCC1.2. Q.E.D.

C.66.2 Cpp_uint.dt_uint_TCC1

Terse proof for dt_uint_TCC1.

dt_uint_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_uint)])): true

Rewriting using dt_uint_exists, matching in *, This completes the proof of dt_uint_TCC1. Q.E.D.

C.66.3 Cpp_uint.uint_represenation_same_for_positive_int_TCC1

Terse proof for uint_represenation_same_for_positive_int_TCC1.
uint_represenation_same_for_positive_int_TCC1:

{1} ∀ (i: (range_int)): i ≥ 0 ⊃ (range_uint)(i)

C.67 Proofs for Cpp_ulong (types.pvs)

Repeatedly Skolemizing and flattening, Rewriting using uint_value_supset_int_value, matching in *,

This completes the proof of uint_represenation_same_for_positive_int_TCC1.

Q.E.D.

C.66.4 Cpp_uint.value_bitmask_uint_TCC1

Terse proof for value_bitmask_uint_TCC1.
value_bitmask_uint_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_uint))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of value_bitmask_uint_TCC1. Q.E.D.

C.67 Proofs for Cpp_ulong (types.pvs)

C.67.1 Cpp_ulong.range_ulong_TCC1

Terse proof for range_ulong_TCC1.
range_ulong_TCC1:

{1} ∃ (x: non_empty_finite_set[nat]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: nat): n = 0), we get 2 subgoals:

range_ulong_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_ulong_TCC1.1.

range_ulong_TCC1.2:

{1} is_finite[nat](λ (n: nat): n = 0) ∧ ¬ empty?[nat](λ (n: nat): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: nat): n = 0)):

0), which is trivially true. This completes the proof of range_ulong_TCC1.2. Q.E.D.

C.67.2 Cpp_ulong.dt_ulong_TCC1

Terse proof for dt_ulong_TCC1.

dt_ulong_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_ulong)])): true

Rewriting using dt_ulong_exists, matching in *, This completes the proof of dt_ulong_TCC1. Q.E.D.

C.67.3 Cpp_ulong.ulong_represenation_same_for_positive_long_TCC1

Terse proof for ulong_represenation_same_for_positive_long_TCC1.
ulong_represenation_same_for_positive_long_TCC1:

{1} ∀ (i: (range_long)): i ≥ 0 ⊃ (range_ulong)(i)

Repeatedly Skolemizing and flattening, Rewriting using ulong_value_supset_long_value, matching in *,

This completes the proof of ulong_represenation_same_for_positive_long_TCC1.

Q.E.D.

C.67.4 Cpp_ulong.value_bitmask_ulong_TCC1

Terse proof for value_bitmask_ulong_TCC1.
value_bitmask_ulong_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_ulong))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of value_bitmask_ulong_TCC1.

Q.E.D.

C.68 Proofs for Cpp_ulonglong (types.pvs)

C.68.1 Cpp_ulonglong.range_ulonglong_TCC1

Terse proof for range_ulonglong_TCC1.
range_ulonglong_TCC1:

{1} ∃ (x: non_empty_finite_set[nat]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: nat): n = 0), we get 2 subgoals:

range_ulonglong_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_ulonglong_TCC1.1.

C.68 Proofs for Cpp_ulonglong (types.pvs)

range_ulonglong_TCC1.2:

{1} is_finite[nat](λ (n: nat): n = 0) ∧ ¬ empty?[nat](λ (n: nat): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: nat): n = 0)):

0), which is trivially true. This completes the proof of range_ulonglong_TCC1.2. Q.E.D.

C.68.2 Cpp_ulonglong.dt_ulonglong_TCC1

Terse proof for dt_ulonglong_TCC1.
dt_ulonglong_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_ulonglong)])): true

Rewriting using dt_ulonglong_exists, matching in *, This completes the proof of dt_ulonglong_TCC1. Q.E.D.

C.68.3 Cpp_ulonglong.ulonglong_represenation_same_for_positive_longlong_TCC1

Terse proof for ulonglong_represenation_same_for_positive_longlong_TCC1.
ulonglong_represenation_same_for_positive_longlong_TCC1:

{1} ∀ (i: (range_longlong)): i ≥ 0 ⊃ (range_ulonglong)(i)

Repeatedly Skolemizing and flattening, Rewriting using ulonglong_value_supset_longlong_value, matching in *,

This completes the proof of ulonglong_represenation_same_for_positive_longlong_TCC1.

Q.E.D.

C.68.4 Cpp_ulonglong.value_bitmask_ulonglong_TCC1

Terse proof for value_bitmask_ulonglong_TCC1.
value_bitmask_ulonglong_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_ulonglong))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of value_bitmask_ulonglong_TCC1.

Q.E.D.

C.69 Proofs for Cpp_union (types.pvs)

C.69.1 Cpp_union.uidt_union_TCC1

Terse proof for uidt_union_TCC1.
uidt_union_TCC1:

{1} ∃ (x:

[Cpp_Subtype(union?) → {uidt: (uninterpreted_data_type?) | size(uidt) > 0}]): true

Instantiating the top quantifier in 1 with the terms: (λ (c: Cpp_Subtype(union?)): choose({uidt: (uninterpreted_data_type?) | size(uidt) > 0})),

we get 2 subgoals:

uidt_union_TCC1.1:

{1} true

which is trivially true. This completes the proof of uidt_union_TCC1.1.

uidt_union_TCC1.2:

{1} ∀ (c: Cpp_Subtype(union?)):

nonempty?[(uninterpreted_data_type?)] ({uidt: (uninterpreted_data_type?) | size(uidt) > 0})

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in -3 with the terms: ((# size := 1, valid? := LAMBDA (l: list[Byte],

a: Address): FALSE #)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uidt_union_TCC1.2. Q.E.D.

C.70 Proofs for Cpp_ushort (types.pvs)

C.70.1 Cpp_ushort.range_ushort_TCC1

Terse proof for range_ushort_TCC1.
range_ushort_TCC1:

{1} ∃ (x: non_empty_finite_set[nat]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: nat): n = 0), we get 2 subgoals:

range_ushort_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_ushort_TCC1.1.

C.70 Proofs for Cpp_ushort (types.pvs)

range_ushort_TCC1.2:

{1} is_finite[nat](λ (n: nat): n = 0) ∧ ¬ empty?[nat](λ (n: nat): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: nat): n = 0)):

0), which is trivially true. This completes the proof of range_ushort_TCC1.2. Q.E.D.

C.70.2 Cpp_ushort.dt_ushort_TCC1

Terse proof for dt_ushort_TCC1.
dt_ushort_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_ushort)])): true

Rewriting using dt_ushort_exists, matching in *, This completes the proof of dt_ushort_TCC1. Q.E.D.

C.70.3 Cpp_ushort.ushort_represenation_same_for_positive_short_TCC1

Terse proof for ushort_represenation_same_for_positive_short_TCC1.
ushort_represenation_same_for_positive_short_TCC1:

{1} ∀ (i: (range_short)): i ≥ 0 ⊃ (range_ushort)(i)

Repeatedly Skolemizing and flattening, Rewriting using ushort_value_supset_short_value, matching in *,

This completes the proof of ushort_represenation_same_for_positive_short_TCC1.

Q.E.D.

C.70.4 Cpp_ushort.value_bitmask_ushort_TCC1

Terse proof for value_bitmask_ushort_TCC1.
value_bitmask_ushort_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_ushort))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of value_bitmask_ushort_TCC1.

Q.E.D.

C.71 Proofs for Cpp_wchar_t (types.pvs)

C.71.1 Cpp_wchar_t.range_wchar_t_TCC1

Terse proof for range_wchar_t_TCC1.
range_wchar_t_TCC1:

{1} ∃ (x: non_empty_finite_set[int]): true

Instantiating the top quantifier in 1 with the terms: (λ (n: int): n = 0), we get 2 subgoals:

range_wchar_t_TCC1.1:

{1} true

which is trivially true. This completes the proof of range_wchar_t_TCC1.1.

range_wchar_t_TCC1.2:

{1} is_finite[int](λ (n: int): n = 0) ∧ ¬ empty?[int](λ (n: int): n = 0)

Trying repeated skolemization, instantiation, and if-lifting, Instantiating the top quantifier in 1 with the terms: (1 LAMBDA (P: (LAMBDA (n: int): n = 0)):

0), which is trivially true. This completes the proof of range_wchar_t_TCC1.2. Q.E.D.

C.71.2 Cpp_wchar_t.dt_wchar_t_TCC1

Terse proof for dt_wchar_t_TCC1.
dt_wchar_t_TCC1:

{1} ∃ (x_{1}: (pod_data_type?[(range_wchar_t)])): true

Rewriting using dt_wchar_t_exists, matching in *, This completes the proof of dt_wchar_t_TCC1. Q.E.D.

C.71.3 Cpp_wchar_t.value_bitmask_wchar_t_TCC1

Terse proof for value_bitmask_wchar_t_TCC1.
value_bitmask_wchar_t_TCC1:

{1} ∃ (x_{1}: {l: list[Byte] | length[Byte](l) = size(uidt(dt_wchar_t))}): true

Using lemma list_all_length[Byte], Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of value_bitmask_wchar_t_TCC1.

Q.E.D.

C.72 Proofs for Datatype_Model (datatype_model.pvs)

C.72 Proofs for Datatype_Model (datatype_model.pvs)

C.72.1 Datatype_Model.uidt_1_TCC1

Terse proof for uidt_1_TCC1.

uidt_1_TCC1:

{1} uninterpreted_data_type?((#size := 1,

valid? := λ (bl: list[Byte], a: Ad-

dress): bl = (:0:)#))

Trying repeated skolemization, instantiation, and if-lifting, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_1_TCC1. Q.E.D.

C.72.2 Datatype_Model.pod_1_TCC1

Terse proof for pod_1_TCC1.

pod_1_TCC1:

{1} 0 < max_byte

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_1_TCC1. Q.E.D.

C.72.3 Datatype_Model.pod_1_TCC2

Terse proof for pod_1_TCC2.

pod_1_TCC2:

{1} every[real] (λ (x: real): rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) ((::))

Trying repeated skolemization, instantiation, and if-lifting, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_1_TCC2. Q.E.D.

C.72.4 Datatype_Model.pod_1_TCC3

Terse proof for pod_1_TCC3.

pod_1_TCC3:

{1} ∀ (f: [[Unit, Address] → [list[Byte] → bool]]):

(f = (λ (d: Unit, a: Address): zero_mask?(size(uidt_1)))) ⊃ (∀ (x_{1}: [Unit, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Expanding the definition of singleton?, which is trivially true. This completes the proof of pod_1_TCC3. Q.E.D.

C.72.5 Datatype_Model.pod_1_TCC4

Terse proof for pod_1_TCC4.

pod_1_TCC4:

{1} pod_data_type?[Unit]

((#uidt := uidt_1, to_byte := λ (d: Unit, a: Address): (:0:), to_mask

:= λ (f: [[Unit, Address] → [list[Byte] → bool]]):

λ (x_{1}: [Unit, Address]): singleton_elt[list[Byte]](f(x_{1})) (λ (d: Unit, a: Address): zero_mask?(size(uidt_1))),

from_byte

:= λ (bl: list[Byte], a: Address):

if bl = (:0:) then up[Unit](unit) else bottom[Unit] endif#))

Expanding the definition of pod_data_type?, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_1_TCC4. Q.E.D.

C.72.6 Datatype_Model.uidt_2_TCC1

Terse proof for uidt_2_TCC1.

uidt_2_TCC1:

{1} uninterpreted_data_type?((#size := 1,

valid? := λ (bl: list[Byte], a: Ad-

dress): bl = (:1:)#))

Trying repeated skolemization, instantiation, and if-lifting, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_2_TCC1. Q.E.D.

C.72.7 Datatype_Model.pod_2_TCC1

Terse proof for pod_2_TCC1.

pod_2_TCC1:

{1} 1 < max_byte

C.73 Proofs for Datatype_Model_2 (datatype_model.pvs)

Trying repeated skolemization, instantiation, and if-lifting, Applying less_than_max_byte Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_2_TCC1. Q.E.D.

C.72.8 Datatype_Model.pod_2_TCC2

Terse proof for pod_2_TCC2.

pod_2_TCC2:

{1} ∀ (f: [[Unit, Address] → [list[Byte] → bool]]):

(f = (λ (d: Unit, a: Address): zero_mask?(size(uidt_2)))) ⊃ (∀ (x_{1}: [Unit, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Expanding the definition of singleton?, which is trivially true. This completes the proof of pod_2_TCC2. Q.E.D.

C.72.9 Datatype_Model.pod_2_TCC3

Terse proof for pod_2_TCC3.

pod_2_TCC3:

{1} pod_data_type?[Unit]

((#uidt := uidt_2, to_byte := λ (d: Unit, a: Address): (:1:), to_mask

:= λ (f: [[Unit, Address] → [list[Byte] → bool]]):

λ (x_{1}: [Unit, Address]): singleton_elt[list[Byte]](f(x_{1})) (λ (d: Unit, a: Address): zero_mask?(size(uidt_2))),

from_byte

:= λ (bl: list[Byte], a: Address):

if bl = (:1:) then up[Unit](unit) else bottom[Unit] endif#))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_2_TCC3. Q.E.D.

C.73 Proofs for Datatype_Model_2 (datatype_model.pvs)

C.73.1 Datatype_Model_2.uidt_bool_TCC1

Terse proof for uidt_bool_TCC1.

uidt_bool_TCC1:

{1} uninterpreted_data_type?((#size := 2,

valid?

:= λ (bl: list[Byte], a: Address): bl = (:0, 0:) ∨ bl = (:0, 1:)#))

Trying repeated skolemization, instantiation, and if-lifting, we get 2 subgoals:

uidt_bool_TCC1.1:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < expt(2, bits_per_byte))

((:0, 0:))

{-2} l′ = (:0, 0:)
{1} length((:0, 0:)) = 2

Expanding the definition of length, Expanding the definition of length, Expanding the definition of length, which is trivially true. This completes the proof of uidt_bool_TCC1.1.

uidt_bool_TCC1.2:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < expt(2, bits_per_byte))

((:0, 1:))

{-2} l′ = (:0, 1:)
{1} length((:0, 1:)) = 2

Expanding the definition of length, Expanding the definition of length, Expanding the definition of length, which is trivially true. This completes the proof of uidt_bool_TCC1.2. Q.E.D.

C.73.2 Datatype_Model_2.pod_bool_TCC1

Terse proof for pod_bool_TCC1.

pod_bool_TCC1:

{1} ∀ (d: bool): d ⊃ 0 < max_byte

Applying less_than_max_byte Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_bool_TCC1. Q.E.D.

C.73.3 Datatype_Model_2.pod_bool_TCC2

Terse proof for pod_bool_TCC2.

pod_bool_TCC2:

{1} ∀ (d: bool): d ⊃ every[real] (λ (x: real): rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) ((:1:))

Trying repeated skolemization, instantiation, and if-lifting, Applying less_than_max_byte Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_bool_TCC2. Q.E.D.

C.73.4 Datatype_Model_2.pod_bool_TCC3

Terse proof for pod_bool_TCC3.

pod_bool_TCC3:

{1} ∀ (d: bool): ¬ d ⊃ 0 < max_byte

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_bool_TCC3. Q.E.D.

C.73.5 Datatype_Model_2.pod_bool_TCC4

Terse proof for pod_bool_TCC4.

pod_bool_TCC4:

{1} ∀ (d: bool): ¬ d ⊃ every[real] (λ (x: real): rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) ((:0:))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_bool_TCC4. Q.E.D.

C.73.6 Datatype_Model_2.pod_bool_TCC5

Terse proof for pod_bool_TCC5.

pod_bool_TCC5:

{1} ∀ (f: [[bool, Address] → [list[Byte] → bool]]):

(f = (λ (d: bool, a: Address): zero_mask?(size(uidt_bool)))) ⊃ (∀ (x_{1}: [bool, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pod_bool_TCC5. Q.E.D.

C.73.7 Datatype_Model_2.pod_bool_TCC6

Terse proof for pod_bool_TCC6.

pod_bool_TCC6:

{1} pod_data_type?[bool] ((#uidt := uidt_bool, to_byte := λ (d: bool, a: Address): if d then (:0, 1:) else (:0, 0:) en- dif, to_mask := λ (f: [[bool, Address] → [list[Byte] → bool]]): λ (x_{1}: [bool, Address]): singleton_elt[list[Byte]](f(x_{1})) (λ (d: bool, a: Address): zero_mask?(size(uidt_bool))), from_byte := λ (bl: list[Byte], a: Address): if bl = (:0, 1:) then up[boolean](true) else if bl = (:0, 0:) then up[boolean](false) else bot- tom[boolean] endif endif#))

Trying repeated skolemization, instantiation, and if-lifting, Using lemma min_bits_per_byte, Using lemma bits_per_byte_minimum, Using lemma pos_expt_gt, Case splitting on 1 < expt(2, bits_per_byte), we get 2 subgoals:

pod_bool_TCC6.1:

{-1} 1 < expt(2, bits_per_byte)
{-2} bits_per_byte < 2 ˆ bits_per_byte
{-3} bits_per_byte ≥ min_bits_per_byte
{-4} min_bits_per_byte = 8
{-5} (:0, 0:) = (:0, 1:)
{1} d′

Applying decompose-equality, Applying decompose-equality, This completes the proof of pod_bool_TCC6.1.

pod_bool_TCC6.2:

{-1} bits_per_byte < 2 ˆ bits_per_byte
{-2} bits_per_byte ≥ min_bits_per_byte
{-3} min_bits_per_byte = 8
{-4} (:0, 0:) = (:0, 1:)
{1} 1 < expt(2, bits_per_byte)
{2} d′

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_bool_TCC6.2. Q.E.D.

C.73.8 Datatype_Model_2.uidt_Byte_TCC1

Terse proof for uidt_Byte_TCC1.
uidt_Byte_TCC1:

{1} ∀ (bl: list[Byte]): length(bl) = 2 ⊃ cons?[Byte](bl)

Trying repeated skolemization, instantiation, and if-lifting, Expanding the definition of length, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_Byte_TCC1. Q.E.D.

C.73.9 Datatype_Model_2.uidt_Byte_TCC2

Terse proof for uidt_Byte_TCC2.
uidt_Byte_TCC2:

{1} uninterpreted_data_type?((#size := 2, valid? := λ (bl: list[Byte], a: Address): length[Byte](bl) = 2 ∧ car[Byte](bl) = 1#))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of uidt_Byte_TCC2. Q.E.D.

C.73.10 Datatype_Model_2.pod_Byte_TCC1

Terse proof for pod_Byte_TCC1.

pod_Byte_TCC1:

{1} ∀ (bl: list[Byte]): length(bl) = 2 ∧ car(bl) = 1 ⊃ cons?[Byte](cdr[Byte](bl))

Trying repeated skolemization, instantiation, and if-lifting, Expanding the definition of length, Expanding the definition of length, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_Byte_TCC1.

Q.E.D.

C.73.11 Datatype_Model_2.pod_Byte_TCC2

Terse proof for pod_Byte_TCC2.

pod_Byte_TCC2:

{1} 1 < max_byte

Trying repeated skolemization, instantiation, and if-lifting, Applying less_than_max_byte Expanding the definition of max_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_Byte_TCC2. Q.E.D.

C.73.12 Datatype_Model_2.pod_Byte_TCC3

Terse proof for pod_Byte_TCC3.

pod_Byte_TCC3:

{1} ∀ (d: Byte): every[real] (λ (x: real): rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) ((:d:))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of every, which is trivially true. This completes the proof of pod_Byte_TCC3. Q.E.D.

C.73.13 Datatype_Model_2.pod_Byte_TCC4

Terse proof for pod_Byte_TCC4.

pod_Byte_TCC4:

{1} ∀ (f: [[Byte, Address] → [list[Byte] → bool]]):

(f = (λ (d: Byte, a: Address): zero_mask?(size(uidt_Byte)))) ⊃ (∀ (x_{1}: [Byte, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pod_Byte_TCC4. Q.E.D.

C.74 Proofs for DeclarationStatements1 (statements.pvs)

C.73.14 Datatype_Model_2.pod_Byte_TCC5

Terse proof for pod_Byte_TCC5.

  pod_Byte_TCC5:

{1} pod_data_type?[Byte]

((#uidt := uidt_Byte, to_byte := λ (d: Byte, a: Address): (:1, d:), to_mask

:= λ (f: [[Byte, Address] → [list[Byte] → bool]]):

λ (x_{1}: [Byte, Address]): singleton_elt[list[Byte]](f(x_{1}))

(λ (d: Byte, a: Address): zero_mask?(size(uidt_Byte))),

from_byte

:= λ (bl: list[Byte], a: Address):

if length[Byte](bl) = 2 ∧ car[Byte](bl) = 1 then up[Byte](car[Byte](cdr[Byte](bl)))

else bottom[Byte]

endif#))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_Byte_TCC5. Q.E.D.

C.74 Proofs for DeclarationStatements1 (statements.pvs)

This theory contains no provable formal statements.

C.75 Proofs for DeclarationStatements2 (statements.pvs)

This theory contains no provable formal statements.

C.76 Proofs for Device_Memory (device_memory.pvs)

This theory contains no provable formal statements.

C.77 Proofs for EqualityExpressions (expressions.pvs)

This theory contains no provable formal statements.

C.78 Proofs for Error_Code_Types (result.pvs)

This theory contains no provable formal statements.

C.79 Proofs for Even_More_List_Props (vfiasco-prelude.pvs)

C.79.1 Even_More_List_Props.every_extend

Terse proof for every_extend.

every_extend:

{1} ∀ (l: list[S], P: PRED[T ]):

every(λ (t: T): P (t))(l) ⊃ every(λ (s: S): P (s))(l)

Inducting on l on formula 1, we get 2 subgoals:

every_extend.1:

{1} ∀ (P: PRED[T ]):

every(λ (t: T): P (t))(null) ⊃ every(λ (s: S): P (s))(null)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of every_extend.1.

every_extend.2:

{1} ∀ (cons1_var: S, cons2_var: list[S]):

(∀ (P: PRED[T ]):

every(λ (t: T): P (t))(cons2_var) ⊃ every(λ (s: S): P (s))(cons2_var))

⊃

(∀ (P: PRED[T ]):

every(λ (t: T): P (t))(cons(cons1_var, cons2_var)) ⊃ every(λ (s: S): P (s))(cons(cons1_var, cons2_var)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of every_extend.2. Q.E.D.

C.80 Proofs for Exception_type (result.pvs)

This theory contains no provable formal statements.

C.81 Proofs for Exception_type_adt (Exception_type_adt.pvs)

This theory contains no provable formal statements.

C.82 Proofs for Exception_type_adt_reduce (Exception_type_adt.pvs)

C.82 Proofs for Exception_type_adt_reduce (Exception_type_adt.pvs)

This theory contains no provable formal statements.

C.83 Proofs for Expand_State (device_memory.pvs)

C.83.1 Expand_State.em_transformers_ok

Terse proof for em_transformers_ok.
em_transformers_ok:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperResult[State]]]): transformers_ok?(states, transformers) ⊃ transformers_ok?(em_lift(states), em_lift(transformers))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of em_transformers_ok. Q.E.D.

C.83.2 Expand_State.em_transformer_invariant

Terse proof for em_transformer_invariant.
em_transformer_invariant:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperResult[State]]]): transformer_invariant?(states, transformers) ⊃ transformer_invariant?(em_lift(states), em_lift(transformers))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of em_transformer_invariant.

Q.E.D.

C.83.3 Expand_State.em_lift_singleton

Terse proof for em_lift_singleton.
em_lift_singleton:

{1} ∀ (q: [State → SuperResult[State]]):

singleton(em_lift(q)) = em_lift(singleton(q))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of em_lift_singleton. Q.E.D.

C.84 Proofs for Expand_State2 (device_memory.pvs)

C.84.1 Expand_State2.em_lift_expr_2_super

Terse proof for em_lift_expr_2_super.
em_lift_expr_2_super:

{1} ∀ (stf: [State → ExprResult[State, Data]]):

expr_2_super(em_lift(stf)) = em_lift(expr_2_super(stf))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of em_lift_expr_2_super. Q.E.D.

C.85 Proofs for Expand_State3 (device_memory.pvs)

C.85.1 Expand_State3.em_memory_read_transformers

Terse proof for em_memory_read_transformers.
em_memory_read_transformers:

{1} ∀ (addresses: PRED[Address], em_pm: Memory_struct[Expand_state[State, T ]],

pm: Memory_struct[State]): (em_pm`memory_read =

(λ (a: Address): em_lift[State, T, Byte](pm`memory_read(a)))) ⊃ memory_read_transformers(em_pm, addresses) = em_lift(memory_read_transformers(pm, addresses))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Expanding the definition of memory_read_transformers, Replacing using formula -1, Hiding formulas: -1, Expanding the definition of em_lift, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

em_memory_read_transformers.1:

{-1} ∃ (a: Address): addresses′(a) ∧ x′ = expr_2_super(em_lift[State, T, Byte](pm′`memory_read(a))) ; {1} ∃ (p: (λ (q: [State → SuperResult[State]]): ∃ (a: Address): addresses′(a) ∧ q = expr_2_super(memory_read(pm′)(a)))): x′ = em_lift(p)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (expr_2_super(pm!1‘memory_read(a!1))), we get 2 subgoals:

C.85 Proofs for Expand_State3 (device_memory.pvs)

em_memory_read_transformers.1.1:

{-1} addresses′(a′)
{-2} x′ = expr_2_super(em_lift[State, T, Byte](pm′`memory_read(a′)))
{1} x′ = em_lift(expr_2_super(pm′`memory_read(a′)))

Rewriting using em_lift_expr_2_super[State, T, Byte], matching in *,

This completes the proof of em_memory_read_transformers.1.1.
em_memory_read_transformers.1.2:

{-1} addresses′(a′)
{-2} x′ = expr_2_super(em_lift[State, T, Byte](pm′`memory_read(a′)))
{1} ∃ (a: Address):

addresses′(a) ∧ expr_2_super[State, Byte](pm′`memory_read(a′)) = expr_2_super[State, Byte](memory_read(pm′)(a))

Instantiating quantified variables,

This completes the proof of em_memory_read_transformers.1.2.
em_memory_read_transformers.2:

{-1} ∃ (p: (λ (q: [State → SuperResult[State]]): ∃ (a: Address): addresses′(a) ∧ q = expr_2_super(memory_read(pm′)(a)))): x′ = em_lift(p) ; {1} ∃ (a: Address): addresses′(a) ∧ x′ = expr_2_super(em_lift[State, T, Byte](pm′`memory_read(a)))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Rewriting using em_lift_expr_2_super[State, T, Byte], matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of em_memory_read_transformers.2.

Q.E.D.

C.85.2 Expand_State3.em_memory_write_transformers

Terse proof for em_memory_write_transformers.
em_memory_write_transformers:

{1} ∀ (addresses: PRED[Address], em_pm: Memory_struct[Expand_state[State, T ]], pm: Memory_struct[State]): (em_pm`memory_write = (λ (a: Address, b: Byte): em_lift[State, T, Unit](pm`memory_write(a, b)))) ⊃ memory_write_transformers(em_pm, addresses) = em_lift(memory_write_transformers(pm, addresses))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Expanding the definition of memory_write_transformers, Replacing using formula -1, Hiding formulas: -1, Expanding the definition of em_lift, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

em_memory_write_transformers.1:

{-1} ∃ (a: Address, b: Byte): addresses′(a) ∧ x′ = expr_2_super(em_lift[State, T, Unit](pm′`memory_write(a, b)))

{1} ∃ (p:

(λ (q: [State → SuperResult[State]]): ∃ (a: Address, b: Byte):

addresses′(a) ∧ q = expr_2_super(memory_write(pm′)(a, b)))):

x′ = em_lift(p)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (expr_2_super(pm!1‘memory_write(a!1, b!1))), we get 2 subgoals:

em_memory_write_transformers.1.1:

{-1} b′ < max_byte
{-2} addresses′(a′)
{-3} x′ = expr_2_super(em_lift[State, T, Unit](pm′`memory_write(a′, b′)))
{1} x′ = em_lift(expr_2_super(pm′`memory_write(a′, b′)))

Rewriting using em_lift_expr_2_super, matching in *,

This completes the proof of em_memory_write_transformers.1.1.
em_memory_write_transformers.1.2:

{-1} b′ < max_byte
{-2} addresses′(a′)
{-3} x′ = expr_2_super(em_lift[State, T, Unit](pm′`memory_write(a′, b′)))

{1} ∃ (a: Address, b: Byte): addresses′(a) ∧ expr_2_super[State, Unit](pm′`memory_write(a′, b′)) = expr_2_super[State, Unit](memory_write(pm′)(a, b))

Instantiating quantified variables,

This completes the proof of em_memory_write_transformers.1.2.
em_memory_write_transformers.2:

{-1} ∃ (p:

(λ (q: [State → SuperResult[State]]): ∃ (a: Address, b: Byte):

addresses′(a) ∧ q = expr_2_super(memory_write(pm′)(a, b)))):

x′ = em_lift(p) {1} ∃ (a: Address, b: Byte): addresses′(a) ∧ x′ = expr_2_super(em_lift[State, T, Unit](pm′`memory_write(a, b)))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Rewriting using em_lift_expr_2_super, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of em_memory_write_transformers.2.

Q.E.D.

C.85.3 Expand_State3.em_unchanged_memory_invariant

Terse proof for em_unchanged_memory_invariant.
em_unchanged_memory_invariant:

{1} ∀ (addresses: PRED[Address], em_pm: Memory_struct[Expand_state[State, T ]], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]]):

(em_pm`memory_read =

(λ (a: Address): em_lift[State, T, Byte](pm`memory_read(a)))) ∧ unchanged_memory_invariant?(pm, states, transformers, addresses) ⊃ unchanged_memory_invariant?(em_pm, em_lift(states), em_lift(transformers), ad-

dresses)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of em_unchanged_memory_invariant.

Q.E.D.

C.85.4 Expand_State3.em_changed_memory_invariant

Terse proof for em_changed_memory_invariant.
em_changed_memory_invariant:

{1} ∀ (addresses: PRED[Address], em_pm: Memory_struct[Expand_state[State, T ]], pm: Memory_struct[State], states: PRED[State]): (em_pm`memory_read = (λ (a: Address): em_lift[State, T, Byte](pm`memory_read(a)))) ∧ (em_pm`memory_write = (λ (a: Address, b: Byte): em_lift[State, T, Unit](pm`memory_write(a, b)))) ∧ changed_memory_invariant?(pm, states, addresses) ⊃ changed_memory_invariant?(em_pm, em_lift(states), addresses)

Expanding the definition of changed_memory_invariant?, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

em_changed_memory_invariant.1:

{-1} (em_pm′`memory_read =

(λ (a: Address): em_lift[State, T, Byte](pm′`memory_read(a))))

{-2} (em_pm′`memory_write =

(λ (a: Address, b: Byte): em_lift[State, T, Unit](pm′`memory_write(a, b))))

{-3} transformer_invariant?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, memory_write_transformers(pm′, addresses′))

{-5} ∀ (s: State, a: Address, b: Byte):

states′(s) ∧

addresses′(a) ∧

OK?(memory_write(pm′)(a, b)(s)) ∧ OK?(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) ⊃ data(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) = b

{1} ∀ (s: Expand_state[State, T ], a: Address, b: Byte):

em_lift(states′)(s) ∧ addresses′(a) ∧ OK?(memory_write(em_pm′)(a, b)(s)) ∧ OK?(memory_read(em_pm′)(a)(state(memory_write(em_pm′)(a, b)(s)))) ⊃ data(memory_read(em_pm′)(a)(state(memory_write(em_pm′)(a, b)(s)))) = b

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of em_changed_memory_invariant.1.
em_changed_memory_invariant.2:

{-1} (em_pm′`memory_read =

(λ (a: Address): em_lift[State, T, Byte](pm′`memory_read(a))))

{-2} (em_pm′`memory_write =

(λ (a: Address, b: Byte): em_lift[State, T, Unit](pm′`memory_write(a, b))))

{-3} transformer_invariant?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, memory_write_transformers(pm′, addresses′))

{-5} ∀ (s: State, a: Address, b: Byte):

states′(s) ∧

addresses′(a) ∧

OK?(memory_write(pm′)(a, b)(s)) ∧ OK?(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) ⊃ data(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) = b

{1} transformer_invariant?(em_lift(states′), memory_write_transformers(em_pm′, addresses′))

Keeping (-2 -4 1) and hiding *,

Using lemma em_memory_write_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Replacing using formula -2,

Rewriting using em_transformer_invariant, matching in *,

This completes the proof of em_changed_memory_invariant.2.

em_changed_memory_invariant.3:

{-1} (em_pm′`memory_read =

(λ (a: Address): em_lift[State, T, Byte](pm′`memory_read(a))))

{-2} (em_pm′`memory_write =

(λ (a: Address, b: Byte): em_lift[State, T, Unit](pm′`memory_write(a, b))))

{-3} transformer_invariant?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, memory_write_transformers(pm′, addresses′))

{-5} ∀ (s: State, a: Address, b: Byte):

states′(s) ∧ addresses′(a) ∧ OK?(memory_write(pm′)(a, b)(s)) ∧ OK?(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) ⊃ data(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) = b

{1} transformer_invariant?(em_lift(states′), memory_read_transformers(em_pm′, addresses′))

Keeping (-1 -3 1) and hiding *, Using lemma em_memory_read_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Rewriting using em_transformer_invariant, matching in *,

This completes the proof of em_changed_memory_invariant.3.

Q.E.D.

C.85.5 Expand_State3.em_const_unchanged_memory_invariant_TCC1

Terse proof for em_const_unchanged_memory_invariant_TCC1.
em_const_unchanged_memory_invariant_TCC1:

{1} ∀ (em_pm: Memory_struct[Expand_state[State, T ]], pm: Memory_struct[State], q: [Expand_state[State, T ] → SuperResult[Expand_state[State, T ]]]): (em_pm`memory_read = (λ (a: Address): em_lift[State, T, Byte](pm`memory_read(a)))) ⊃ (∀ (s: Expand_state[State, T ]): has_next_state(q(s)) ⊃ OK?[Expand_state[State, T ]](q(s)) ∨ abnormal?[Expand_state[State, T ]](q(s)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of em_const_unchanged_memory_invariant_TCC1.

Q.E.D.

C.85.6 Expand_State3.em_const_unchanged_memory_invariant

Terse proof for em_const_unchanged_memory_invariant.

em_const_unchanged_memory_invariant:

{1} ∀ (addresses: PRED[Address], em_pm: Memory_struct[Expand_state[State, T ]], pm: Memory_struct[State], states: PRED[State], q: [Expand_state[State, T ] → SuperResult[Expand_state[State, T ]]]): (em_pm`memory_read = (λ (a: Address): em_lift[State, T, Byte](pm`memory_read(a)))) ∧ (∀ (s: Expand_state[State, T ]): has_next_state(q(s)) ⊃ state(q(s))`state = s`state) ⊃ unchanged_memory_invariant?(em_pm, em_lift(states), singleton(q), addresses)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of em_const_unchanged_memory_invariant.

Q.E.D.

C.85.7 Expand_State3.em_side_effect_content_unchanged

Terse proof for em_side_effect_content_unchanged.
em_side_effect_content_unchanged:

{1} ∀ (addresses: PRED[Address], se_transformer:

[[Address, list[Byte], bool] → [State → ExprResult[State, list[Byte]]]], states: PRED[State]):

side_effect_content_unchanged(addresses, states, se_transformer) ⊃ side_effect_content_unchanged(addresses, em_lift(states),

λ (a: Address, bl: list[Byte], cp: bool):

em_lift[State, T, list[Byte]] (se_transformer(a, bl, cp)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of em_side_effect_content_unchanged.

Q.E.D.

C.86 Proofs for ExprResult (result.pvs)

This theory contains no provable formal statements.

C.87 Proofs for ExprResult_adt (ExprResult_adt.pvs)

This theory contains no provable formal statements.

C.88 Proofs for ExprResult_adt_map (ExprResult_adt.pvs)

This theory contains no provable formal statements.

C.89 Proofs for ExprResult_adt_reduce (ExprResult_adt.pvs)

C.89 Proofs for ExprResult_adt_reduce (ExprResult_adt.pvs)

This theory contains no provable formal statements.

C.90 Proofs for ExpressionStatements (statements.pvs)

This theory contains no provable formal statements.

C.91 Proofs for Expression_Composition_Rewrites (state-transformer.pvs)

C.91.1 Expression_Composition_Rewrites.comp_eval_if_ok_fexpr

Terse proof for comp_eval_if_ok_fexpr.
comp_eval_if_ok_fexpr:

{1} ∀ (expr: [State → ExprResult[State, Data1]],

fexpr: [Data1 → [State → ExprResult[State, Data2]]], s: State): OK?(expr(s)) ⊃ (expr ## fexpr)(s) = (expr ## fexpr(data(expr(s))))(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of comp_eval_if_ok_fexpr. Q.E.D.

C.92 Proofs for Expressions (expressions.pvs)

This theory contains no provable formal statements.

C.93 Proofs for Expt_Lemmas (vfiasco-prelude.pvs)

C.93.1 Expt_Lemmas.both_sides_expt_gt1_le

Terse proof for both_sides_expt_gt1_le.
both_sides_expt_gt1_le:

{1} ∀ (gt1x: {r: posreal | r > 1}, m, n: nat):

m ≤ n ≡ expt(gt1x, m) ≤ expt(gt1x, n)

Repeatedly Skolemizing and flattening, Using lemma both_sides_expt_gt1_le_aux, Expanding the definition of expt, Using lemma both_sides_times_pos_le2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of both_sides_expt_gt1_le. Q.E.D.

C.93.2 Expt_Lemmas.expt_plus

Terse proof for expt_plus.

expt_plus:

{1} ∀ (n0x: nzreal, m, n: nat):

expt(n0x, m) × expt(n0x, n) = expt(n0x, m + n)

Repeatedly Skolemizing and flattening, Using lemma expt_plus_aux, Simplifying, rewriting, and recording with decision procedures, This completes the proof of expt_plus. Q.E.D.

C.94 Proofs for Extended_Real (vfiasco-prelude.pvs)

C.94.1 Extended_Real.number_field_extended

Terse proof for number_field_extended.
number_field_extended:

{1} ∀ (x: number_field): extended_real?(x)

Repeatedly Skolemizing and flattening, Rewriting using extended_real_superset_of_number_fields, matching in *, This completes the proof of number_field_extended. Q.E.D.

C.94.2 Extended_Real.er_plus_TCC1

Terse proof for er_plus_TCC1.

er_plus_TCC1:

{1} ∃ (x_{1}: [[extended_real, extended_real] → extended_real]): true

Instantiating the top quantifier in 1 with the terms: (λ (x, y: extended_real): x), which is trivially true. This completes the proof of er_plus_TCC1. Q.E.D.

C.94.3 Extended_Real.er_neg_TCC1

Terse proof for er_neg_TCC1.

er_neg_TCC1:

{1} ∃ (x_{1}: [extended_real → extended_real]): true

Instantiating the top quantifier in 1 with the terms: (λ (x: extended_real): x), which is trivially true. This completes the proof of er_neg_TCC1. Q.E.D.

C.94 Proofs for Extended_Real (vfiasco-prelude.pvs)

C.94.4 Extended_Real.er_plus_number_field

Terse proof for er_plus_number_field.
er_plus_number_field:

{1} ∀ (a, b: number_field): number_field_pred(er_plus(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_plus_ax, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of er_plus_number_field. Q.E.D.

C.94.5 Extended_Real.er_minus_number_field

Terse proof for er_minus_number_field.
er_minus_number_field:

{1} ∀ (a, b: number_field): number_field_pred(er_minus(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_minus_ax, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of er_minus_number_field. Q.E.D.

C.94.6 Extended_Real.er_times_number_field

Terse proof for er_times_number_field.
er_times_number_field:

{1} ∀ (a, b: number_field): number_field_pred(er_times(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_times_ax, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of er_times_number_field. Q.E.D.

C.94.7 Extended_Real.er_div_number_field

Terse proof for er_div_number_field.
er_div_number_field:

{1} ∀ (a: number_field, b: nznum): number_field_pred(er_div(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_div_ax, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of er_div_number_field. Q.E.D.

C.94.8 Extended_Real.er_neg_number_field

Terse proof for er_neg_number_field.
er_neg_number_field:

{1} ∀ (a: number_field): number_field_pred(er_neg(a))

Repeatedly Skolemizing and flattening, Rewriting using er_neg_ax, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of er_neg_number_field. Q.E.D.

C.94.9 Extended_Real.er_plus_real

Terse proof for er_plus_real.

er_plus_real:

{1} ∀ (a, b: real): real_pred(er_plus(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_plus_ax, matching in *, Rewriting using closed_plus, matching in *, This completes the proof of er_plus_real. Q.E.D.

C.94.10 Extended_Real.er_minus_real

Terse proof for er_minus_real.

er_minus_real:

{1} ∀ (a, b: real): real_pred(er_minus(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_minus_ax, matching in *, Rewriting using closed_minus, matching in *, This completes the proof of er_minus_real. Q.E.D.

C.94.11 Extended_Real.er_times_real

Terse proof for er_times_real.

er_times_real:

{1} ∀ (a, b: real): real_pred(er_times(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_times_ax, matching in *, Rewriting using closed_times, matching in *, This completes the proof of er_times_real. Q.E.D.

C.94 Proofs for Extended_Real (vfiasco-prelude.pvs)

C.94.12 Extended_Real.er_div_real

Terse proof for er_div_real.

er_div_real:

{1} ∀ (a: real, b: nzreal): real_pred(er_div(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_div_ax, matching in *, Rewriting using closed_divides, matching in *, This completes the proof of er_div_real. Q.E.D.

C.94.13 Extended_Real.er_neg_real

Terse proof for er_neg_real.

er_neg_real:

{1} ∀ (a: real): real_pred(er_neg(a))

Repeatedly Skolemizing and flattening, Rewriting using er_neg_ax, matching in *, Rewriting using closed_neg, matching in *, This completes the proof of er_neg_real. Q.E.D.

C.94.14 Extended_Real.er_plus_rational

Terse proof for er_plus_rational.
er_plus_rational:

{1} ∀ (a, b: rational): rational_pred(er_plus(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_plus_ax, matching in *, Rewriting using closed_plus, matching in *, This completes the proof of er_plus_rational. Q.E.D.

C.94.15 Extended_Real.er_minus_rational

Terse proof for er_minus_rational.
er_minus_rational:

{1} ∀ (a, b: rational): rational_pred(er_minus(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_minus_ax, matching in *, Rewriting using closed_minus, matching in *, This completes the proof of er_minus_rational. Q.E.D.

C.94.16 Extended_Real.er_times_rational

Terse proof for er_times_rational.
er_times_rational:

{1} ∀ (a, b: rational): rational_pred(er_times(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_times_ax, matching in *, Rewriting using closed_times, matching in *, This completes the proof of er_times_rational. Q.E.D.

C.94.17 Extended_Real.er_div_rational

Terse proof for er_div_rational.
er_div_rational:

{1} ∀ (a: rational, b: nzrat): rational_pred(er_div(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_div_ax, matching in *, Rewriting using closed_divides, matching in *, This completes the proof of er_div_rational. Q.E.D.

C.94.18 Extended_Real.er_neg_rational

Terse proof for er_neg_rational.
er_neg_rational:

{1} ∀ (a: rational): rational_pred(er_neg(a))

Repeatedly Skolemizing and flattening, Rewriting using er_neg_ax, matching in *, Rewriting using closed_neg, matching in *, This completes the proof of er_neg_rational. Q.E.D.

C.94.19 Extended_Real.er_plus_integer

Terse proof for er_plus_integer.
er_plus_integer:

{1} ∀ (a, b: int): integer_pred(er_plus(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_plus_ax, matching in *, Rewriting using closed_plus, matching in *, This completes the proof of er_plus_integer. Q.E.D.

C.95 Proofs for Finite_Set_Reduce (vfiasco-prelude.pvs)

C.94.20 Extended_Real.er_minus_integer

Terse proof for er_minus_integer.
er_minus_integer:

{1} ∀ (a, b: int): integer_pred(er_minus(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_minus_ax, matching in *, Rewriting using closed_minus, matching in *, This completes the proof of er_minus_integer. Q.E.D.

C.94.21 Extended_Real.er_times_integer

Terse proof for er_times_integer.
er_times_integer:

{1} ∀ (a, b: int): integer_pred(er_times(a, b))

Repeatedly Skolemizing and flattening, Rewriting using er_times_ax, matching in *, Rewriting using closed_times, matching in *, This completes the proof of er_times_integer. Q.E.D.

C.94.22 Extended_Real.er_neg_integer

Terse proof for er_neg_integer.
er_neg_integer:

{1} ∀ (a: int): integer_pred(er_neg(a))

Repeatedly Skolemizing and flattening, Rewriting using er_neg_ax, matching in *, Rewriting using closed_neg, matching in *, This completes the proof of er_neg_integer. Q.E.D.

C.95 Proofs for Finite_Set_Reduce (vfiasco-prelude.pvs)

C.95.1 Finite_Set_Reduce.list_of_finite_set_TCC1

Terse proof for list_of_finite_set_TCC1.
list_of_finite_set_TCC1:

{1} ∀ (S: finite_set[T ]): ¬ empty?(S) ⊃ nonempty?[T ](S)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of list_of_finite_set_TCC1. Q.E.D.

C.95.2 Finite_Set_Reduce.list_of_finite_set_TCC2

Terse proof for list_of_finite_set_TCC2.
list_of_finite_set_TCC2:

{1} ∀ (S: finite_set[T ]): ¬ empty?(S) ⊃ card[T ](rest[T ](S)) < card[T ](S)

Repeatedly Skolemizing and flattening, Rewriting using card_rest, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of list_of_finite_set_TCC2. Q.E.D.

C.95.3 Finite_Set_Reduce.length_list_of_finite_set

Terse proof for length_list_of_finite_set.
length_list_of_finite_set:

{1} ∀ (S: finite_set[T ]): length(list_of_finite_set(S)) = card(S)

Case splitting on ∀ (i: nat, S: finite_set[T ]): i = card(S) ⊃ length(list_of_finite_set(S)) = card(S), we get 2 subgoals:

length_list_of_finite_set.1:

{-1} ∀ (i: nat, S: finite_set[T ]):

i = card(S) ⊃ length(list_of_finite_set(S)) = card(S)

{1} ∀ (S: finite_set[T ]): length(list_of_finite_set(S)) = card(S)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: card(S′), S′,

This completes the proof of length_list_of_finite_set.1.
length_list_of_finite_set.2:

{1} ∀ (i: nat, S: finite_set[T ]):

i = card(S) ⊃ length(list_of_finite_set(S)) = card(S)

{2} ∀ (S: finite_set[T ]): length(list_of_finite_set(S)) = card(S)

Hiding formulas: 2, Inducting on i on formula 1, we get 2 subgoals:

length_list_of_finite_set.2.1:

{1} ∀ (S: finite_set[T ]): 0 = card(S) ⊃ length(list_of_finite_set(S)) = card(S)

Repeatedly Skolemizing and flattening, Using lemma card_empty?[T ], Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of length_list_of_finite_set.2.1.

length_list_of_finite_set.2.2:

{1} ∀ j:
(∀ (S: finite_set[T ]):

j = card(S) ⊃ length(list_of_finite_set(S)) = card(S)) ⊃ (∀ (S: finite_set[T ]):

j + 1 = card(S) ⊃ length(list_of_finite_set(S)) = card(S))

Repeatedly Skolemizing and flattening, Using lemma card_empty?[T ], Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of list_of_finite_set, Expanding the definition of length, Instantiating quantified variables, Rewriting using card_rest, matching in *, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of length_list_of_finite_set.2.2.

Q.E.D.

C.95.4 Finite_Set_Reduce.member_list_of_finite_set

Terse proof for member_list_of_finite_set.
member_list_of_finite_set:

{1} ∀ (S: finite_set[T ], x: T): (x ∈ S) = member(x, list_of_finite_set(S))

Case splitting on ∀ (S: finite_set[T ], k: nat, x: T): k = card(S) ⊃ (member(x, S) = member(x, list_of_finite_set(S))),

we get 2 subgoals:

member_list_of_finite_set.1:

{-1} ∀ (S: finite_set[T ], k: nat, x: T):

k = card(S) ⊃ ((x ∈ S) = member(x, list_of_finite_set(S)))

{1} ∀ (S: finite_set[T ], x: T): (x ∈ S) = member(x, list_of_finite_set(S))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables,

This completes the proof of member_list_of_finite_set.1.
member_list_of_finite_set.2:

{1} ∀ (S: finite_set[T ], k: nat, x: T):

k = card(S) ⊃ ((x ∈ S) = member(x, list_of_finite_set(S)))

{2} ∀ (S: finite_set[T ], x: T): (x ∈ S) = member(x, list_of_finite_set(S))

Hiding formulas: 2, Inducting on k on formula 1, we get 2 subgoals:

member_list_of_finite_set.2.1:

{1} ∀ (S: finite_set[T ], x: T):

0 = card(S) ⊃ ((x ∈ S) = member(x, list_of_finite_set(S)))

Repeatedly Skolemizing and flattening, Using lemma card_empty?[T ], Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of member_list_of_finite_set.2.1.
member_list_of_finite_set.2.2:

{1} ∀ j:
(∀ (S: finite_set[T ], x: T):

j = card(S) ⊃ ((x ∈ S) = member(x, list_of_finite_set(S)))) ⊃ (∀ (S: finite_set[T ], x: T):

j + 1 = card(S) ⊃ ((x ∈ S) = member(x, list_of_finite_set(S))))

Repeatedly Skolemizing and flattening, Using lemma card_empty?[T ], Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of list_of_finite_set, Expanding the definition of member, Case splitting on x!1 = choose(S!1), we get 2 subgoals:

member_list_of_finite_set.2.2.1:

{-1} x′ = choose(S′)
{-2} is_finite[T ](S′)
{-3} j′ ≥ 0
{-4} ∀ (S: finite_set[T ], x: T):

j′ = card(S) ⊃ ((x ∈ S) = member(x, list_of_finite_set(S)))

{-5} 1 + j′ = card(S′)
{1} empty?(S′)
{2} ((x′ ∈ S′) = (x′ = choose(S′) ∨ member(x′, list_of_finite_set(rest(S′)))))

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of member, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of member_list_of_finite_set.2.2.1.
member_list_of_finite_set.2.2.2:

{-1} is_finite[T ](S′)
{-2} j′ ≥ 0
{-3} ∀ (S: finite_set[T ], x: T):

j′ = card(S) ⊃ ((x ∈ S) = member(x, list_of_finite_set(S)))

{-4} 1 + j′ = card(S′)
{1} x′ = choose(S′)
{2} empty?(S′)
{3} ((x′ ∈ S′) = (x′ = choose(S′) ∨ member(x′, list_of_finite_set(rest(S′)))))

Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -3 with the terms: rest(S′), x′, Installing automatic rewrites from: card_rest Simplifying, rewriting, and recording with decision procedures, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

member_list_of_finite_set.2.2.2.1:

{-1} is_finite[T ](S′)
{-2} j′ ≥ 0
{-3} (x′ ∈ rest(S′))
{-4} member(x′, list_of_finite_set(rest(S′)))
{-5} 1 + j′ = card(S′)
{1} x′ = choose(S′)
{2} empty?(S′)
{3} (x′ ∈ S′)

Using lemma rest_member, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of member_list_of_finite_set.2.2.2.1.
member_list_of_finite_set.2.2.2.2:

{-1} is_finite[T ](S′)
{-2} j′ ≥ 0
{-3} 1 + j′ = card(S′)
{-4} (x′ ∈ S′)
{1} x′ = choose(S′)
{2} empty?(S′)
{3} (x′ ∈ rest(S′))
{4} member(x′, list_of_finite_set(rest(S′)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of member_list_of_finite_set.2.2.2.2.

Q.E.D.

C.95.5 Finite_Set_Reduce.unique_member_list_of_finite_set

Terse proof for unique_member_list_of_finite_set.
unique_member_list_of_finite_set:

{1} ∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

Case splitting on ∀ (S: finite_set[T ], k: nat, i, j: below(length(list_of_finite_set(S)))): k = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j,

we get 2 subgoals:

unique_member_list_of_finite_set.1:

{-1} ∀ (S: finite_set[T ], k: nat, i, j: below(length(list_of_finite_set(S)))): k = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

{1} ∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -4 with the terms: S′, card(S′), i′, j′, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unique_member_list_of_finite_set.1.
unique_member_list_of_finite_set.2:

{1} ∀ (S: finite_set[T ], k: nat, i, j: below(length(list_of_finite_set(S)))): k = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

{2} ∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

Hiding formulas: 2, Inducting on k on formula 1, we get 2 subgoals:

unique_member_list_of_finite_set.2.1:

{1} ∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): 0 = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

Repeatedly Skolemizing and flattening, Using lemma card_empty?[T ], Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unique_member_list_of_finite_set.2.1.
unique_member_list_of_finite_set.2.2:

{1} ∀ (j_1: nat):

(∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))):

j_1 = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j)

⊃

(∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): j_1+ 1 = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j)

Repeatedly Skolemizing and flattening, Using lemma card_empty?[T ], Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of list_of_finite_set, Case splitting on i!1 = 0, we get 2 subgoals:

unique_member_list_of_finite_set.2.2.1:

{-1} i′ = 0
{-2} is_finite[T ](S′)
{-3} i′ < length(list_of_finite_set(S′))
{-4} j′′ < length(list_of_finite_set(S′))
{-5} j′ ≥ 0

{-6} ∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): j′ = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

{-7} 1 + j′ = card(S′)

{-8} nth(cons(choose(S′), list_of_finite_set(rest(S′))), i′) =

nth(cons(choose(S′), list_of_finite_set(rest(S′))), j′′)

{1} empty?(S′)
{2} i′ = j′′

Expanding the definition of nth, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -6, Using lemma member_list_of_finite_set, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unique_member_list_of_finite_set.2.2.1.1:

{-1} (choose(S′) ∈ rest(S′))
{-2} member(choose(S′), list_of_finite_set(rest(S′)))
{-3} i′ = 0
{-4} is_finite[T ](S′)
{-5} i′ < length(list_of_finite_set(S′))
{-6} j′′ < length(list_of_finite_set(S′))
{-7} j′ ≥ 0
{-8} 1 + j′ = card(S′)
{-9} choose(S′) = nth(list_of_finite_set(rest(S′)), j′′ − 1)
{1} empty?(S′)
{2} i′ = j′′

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unique_member_list_of_finite_set.2.2.1.1.
unique_member_list_of_finite_set.2.2.1.2:

{-1} i′ = 0
{-2} is_finite[T ](S′)
{-3} i′ < length(list_of_finite_set(S′))
{-4} j′′ < length(list_of_finite_set(S′))
{-5} j′ ≥ 0
{-6} 1 + j′ = card(S′)
{-7} choose(S′) = nth(list_of_finite_set(rest(S′)), j′′ − 1)
{1} (choose(S′) ∈ rest(S′))
{2} member(choose(S′), list_of_finite_set(rest(S′)))
{3} empty?(S′)
{4} i′ = j′′

Hiding formulas: 1, Using lemma nth_member[T ], Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unique_member_list_of_finite_set.2.2.1.2.
unique_member_list_of_finite_set.2.2.2:

{-1} is_finite[T ](S′)
{-2} i′ < length(list_of_finite_set(S′))
{-3} j′′ < length(list_of_finite_set(S′))
{-4} j′ ≥ 0

{-5} ∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): j′ = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

{-6} 1 + j′ = card(S′)

{-7} nth(cons(choose(S′), list_of_finite_set(rest(S′))), i′) =

nth(cons(choose(S′), list_of_finite_set(rest(S′))), j′′)

{1} i′ = 0
{2} empty?(S′)
{3} i′ = j′′

Case splitting on j!2 = 0, we get 2 subgoals:

unique_member_list_of_finite_set.2.2.2.1:

{-1} j′′ = 0
{-2} is_finite[T ](S′)
{-3} i′ < length(list_of_finite_set(S′))
{-4} j′′ < length(list_of_finite_set(S′))
{-5} j′ ≥ 0

{-6} ∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): j′ = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

{-7} 1 + j′ = card(S′)

{-8} nth(cons(choose(S′), list_of_finite_set(rest(S′))), i′) =

nth(cons(choose(S′), list_of_finite_set(rest(S′))), j′′)

{1} i′ = 0
{2} empty?(S′)
{3} i′ = j′′

Hiding formulas: -6, Expanding the definition of nth, Simplifying, rewriting, and recording with decision procedures, Using lemma member_list_of_finite_set, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unique_member_list_of_finite_set.2.2.2.1.1:

{-1} (choose(S′) ∈ rest(S′))
{-2} member(choose(S′), list_of_finite_set(rest(S′)))
{-3} j′′ = 0
{-4} is_finite[T ](S′)
{-5} i′ < length(list_of_finite_set(S′))
{-6} j′′ < length(list_of_finite_set(S′))
{-7} j′ ≥ 0
{-8} 1 + j′ = card(S′)
{-9} nth(list_of_finite_set(rest(S′)), i′ − 1) = choose(S′)
{1} i′ = 0
{2} empty?(S′)
{3} i′ = j′′

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unique_member_list_of_finite_set.2.2.2.1.1.
unique_member_list_of_finite_set.2.2.2.1.2:

{-1} j′′ = 0
{-2} is_finite[T ](S′)
{-3} i′ < length(list_of_finite_set(S′))
{-4} j′′ < length(list_of_finite_set(S′))
{-5} j′ ≥ 0
{-6} 1 + j′ = card(S′)
{-7} nth(list_of_finite_set(rest(S′)), i′ − 1) = choose(S′)
{1} (choose(S′) ∈ rest(S′))
{2} member(choose(S′), list_of_finite_set(rest(S′)))
{3} i′ = 0
{4} empty?(S′)
{5} i′ = j′′

Hiding formulas: 1, Using lemma nth_member[T ], Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables,

This completes the proof of unique_member_list_of_finite_set.2.2.2.1.2.
unique_member_list_of_finite_set.2.2.2.2:

{-1} is_finite[T ](S′)
{-2} i′ < length(list_of_finite_set(S′))
{-3} j′′ < length(list_of_finite_set(S′))
{-4} j′ ≥ 0

{-5} ∀ (S: finite_set[T ], i, j: below(length(list_of_finite_set(S)))): j′ = card(S) ∧ nth(list_of_finite_set(S), i) = nth(list_of_finite_set(S), j) ⊃ i = j

{-6} 1 + j′ = card(S′)

{-7} nth(cons(choose(S′), list_of_finite_set(rest(S′))), i′) =

nth(cons(choose(S′), list_of_finite_set(rest(S′))), j′′)

{1} j′′ = 0
{2} i′ = 0
{3} empty?(S′)
{4} i′ = j′′

Expanding the definition of nth, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -5 with the terms: rest(S′), i′ − 1, j′′ − 1, Rewriting using card_rest, matching in *, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unique_member_list_of_finite_set.2.2.2.2.

Q.E.D.

C.96 Proofs for General (constants.pvs)

C.96.1 General.Byte_TCC1

Terse proof for Byte_TCC1.

Byte_TCC1:

{1} 0 < max_byte

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Byte_TCC1. Q.E.D.

C.96.2 General.less_than_max_byte

Terse proof for less_than_max_byte.
less_than_max_byte:

{1} ∀ (n: nat): n < expt(2, 8) ⊃ n < max_byte

Repeatedly Skolemizing and flattening, Expanding the definition of max_byte, Applying bits_per_byte_minimum Expanding the definition of min_bits_per_byte, Applying both_sides_expt_gt1_le Instantiating the top quantifier in -1 with the terms: 2, 8, bits_per_byte, Simplifying, rewriting, and recording with decision procedures, This completes the proof of less_than_max_byte. Q.E.D.

C.97 Proofs for Graph (graph.pvs)

C.97.1 Graph.path?_TCC1

Terse proof for path?_TCC1.

path?_TCC1:

{1} ∀ (g: graph_type, l: (path_list?[T ])): (∀ (i: below(length(l))): g`nodes(nth(l, i))) ⊃ (∀ (i_{1}: below(length[T ](l) − 1)): i_{1} < length[T ](l))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of path?_TCC1.

C.97 Proofs for Graph (graph.pvs)

Q.E.D.

C.97.2 Graph.path?_TCC2

Terse proof for path?_TCC2.

path?_TCC2:

{1} ∀ (g: graph_type, l: (path_list?[T ])):

(∀ (i: below(length(l))): g`nodes(nth(l, i))) ⊃ (∀ (i_{1}: below(length[T ](l) − 1)): g`nodes(nth[T ](l, i_{1})))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of path?_TCC2. Q.E.D.

C.97.3 Graph.path?_TCC3

Terse proof for path?_TCC3.

path?_TCC3:

{1} ∀ (g: graph_type, l: (path_list?[T ])):

(∀ (i: below(length(l))): g`nodes(nth(l, i))) ⊃ (∀ (i_{1}: below(length[T ](l) − 1)): i_{1} + 1 < length[T ](l))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of path?_TCC3. Q.E.D.

C.97.4 Graph.path?_TCC4

Terse proof for path?_TCC4.

path?_TCC4:

{1} ∀ (g: graph_type, l: (path_list?[T ])):

(∀ (i: below(length(l))): g`nodes(nth(l, i))) ⊃ (∀ (i_{1}: below(length[T ](l) − 1)): g`nodes(nth[T ](l, i_{1} + 1)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of path?_TCC4. Q.E.D.

C.97.5 Graph.nodes_path_start

Terse proof for nodes_path_start.
nodes_path_start:

{1} ∀ (g: graph_type, p: (path?(g))): g`nodes(path_start(p))

Repeatedly Skolemizing and flattening, Expanding the definition of path_list?, Expanding the definition of path_start, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -2 with the terms: 0, we get 2 subgoals:

nodes_path_start.1:

{-1} length(p′) ≥ 1
{-2} g′`nodes(nth(p′, 0))
{-3} ∀ (i: below(length(p′) − 1)): g′`edges(nth(p′, i), nth(p′, 1 + i))
{1} g′`nodes(car(p′))

Expanding the definition of nth, which is trivially true. This completes the proof of nodes_path_start.1.

nodes_path_start.2:

{-1} length(p′) ≥ 1
{-2} ∀ (i: below(length(p′) − 1)): g′`edges(nth(p′, i), nth(p′, 1 + i))
{1} 0 < length[T ](p′)
{2} g′`nodes(car(p′))

Simplifying, rewriting, and recording with decision procedures, This completes the proof of nodes_path_start.2. Q.E.D.

C.97.6 Graph.nodes_path_end

Terse proof for nodes_path_end.
nodes_path_end:

{1} ∀ (g: graph_type, p: (path?(g))): g`nodes(path_end(p))

Repeatedly Skolemizing and flattening, Expanding the definition of path_list?, Expanding the definition of path_end, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nodes_path_end. Q.E.D.

C.97.7 Graph.path_head_TCC1

Terse proof for path_head_TCC1.
path_head_TCC1:

{1} ∀ (g: graph_type, p: (path?(g)), n: upto(length[T ](p))): n ≥ 1 ⊃ path_list?[T ](head[T ](p, n))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of path_head_TCC1. Q.E.D.

C.97.8 Graph.path_head

Terse proof for path_head.

path_head:

{1} ∀ (g: graph_type, p: (path?(g)), n: upto(length(p))): n ≥ 1 ⊃ path?(g)(head(p, n))

Repeatedly Skolemizing and flattening, Expanding the definition of path?, Installing automatic rewrites from: length_head length_tail nth_head nth_tail Applying propositional simplification, we get 2 subgoals:

path_head.1:

{-1} path_list?[T ](p′)
{-2} ∀ (i: below(length(p′))): g′`nodes(nth(p′, i))
{-3} ∀ (i: below(length(p′) − 1)): g′`edges(nth(p′, i), nth(p′, 1 + i))
{-4} n′ ≤ length(p′)
{-5} n′ ≥ 1
{1} ∀ (i: below(length(head(p′, n′)))): g′`nodes(nth(head(p′, n′), i))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, This completes the proof of path_head.1.

path_head.2:

{-1} path_list?[T ](p′)
{-2} ∀ (i: below(length(p′))): g′`nodes(nth(p′, i))
{-3} ∀ (i: below(length(p′) − 1)): g′`edges(nth(p′, i), nth(p′, 1 + i))
{-4} n′ ≤ length(p′)
{-5} n′ ≥ 1
{1} ∀ (i: below(length(head(p′, n′)) − 1)):

g′`edges(nth(head(p′, n′), i), nth(head(p′, n′), 1 + i))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, This completes the proof of path_head.2. Q.E.D.

C.97.9 Graph.path_tail_TCC1

Terse proof for path_tail_TCC1.
path_tail_TCC1:

{1} ∀ (g: graph_type, p: (path?(g)), n: upto(length[T ](p))): length(p) − n ≥ 1 ⊃ path_list?[T ](tail[T ](p, n))

Repeatedly Skolemizing and flattening, Expanding the definition of path_list?, Rewriting using length_tail, matching in *, This completes the proof of path_tail_TCC1.

Q.E.D.

C.97.10 Graph.path_tail

Terse proof for path_tail.

path_tail:

{1} ∀ (g: graph_type, p: (path?(g)), n: upto(length(p))): length(p) − n ≥ 1 ⊃ path?(g)(tail(p, n))

Repeatedly Skolemizing and flattening, Expanding the definition of path?, Installing automatic rewrites from: length_head length_tail nth_head nth_tail Applying propositional simplification, we get 2 subgoals:

path_tail.1:

{-1} path_list?[T ](p′)
{-2} ∀ (i: below(length(p′))): g′`nodes(nth(p′, i))
{-3} ∀ (i: below(length(p′) − 1)): g′`edges(nth(p′, i), nth(p′, 1 + i))
{-4} n′ ≤ length(p′)
{-5} length(p′) − n′ ≥ 1
{1} ∀ (i: below(length(tail(p′, n′)))): g′`nodes(nth(tail(p′, n′), i))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, This completes the proof of path_tail.1.

path_tail.2:

{-1} path_list?[T ](p′)
{-2} ∀ (i: below(length(p′))): g′`nodes(nth(p′, i))
{-3} ∀ (i: below(length(p′) − 1)): g′`edges(nth(p′, i), nth(p′, 1 + i))
{-4} n′ ≤ length(p′)
{-5} length(p′) − n′ ≥ 1
{1} ∀ (i: below(length(tail(p′, n′)) − 1)):

g′`edges(nth(tail(p′, n′), i), nth(tail(p′, n′), 1 + i))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_tail.2. Q.E.D.

C.97.11 Graph.path_cdr_TCC1

Terse proof for path_cdr_TCC1.

path_cdr_TCC1:

{1} ∀ (g: graph_type, p: (path?(g))): cons?[T ](p)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of path_cdr_TCC1.

Q.E.D.

C.97.12 Graph.path_cdr

Terse proof for path_cdr.

path_cdr:

{1} ∀ (g: graph_type, p: (path?(g))):

path_list?[T ](cdr(p)) ⊃ path?(g)(cdr(p))

Repeatedly Skolemizing and flattening, Expanding the definition of path_list?, Installing automatic rewrites from: length_cdr tail Simplifying, rewriting, and recording with decision procedures, Using lemma path_tail, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cdr. Q.E.D.

C.97.13 Graph.path_concat_path

Terse proof for path_concat_path.
path_concat_path:

{1} ∀ (g: graph_type, p_{1}, p_{2}: (path?(g))):

concatable?(p_{1}, p_{2}) ⊃ path?(g)(concat_path(p_{1}, p_{2}))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_list? path? nth_append_left nth_append_right

length_append length_cdr length_concat_path concat_path Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Applying propositional simplification, we get 2 subgoals:

path_concat_path.1:

{-1} length(p′_{1}) ≥ 1
{-2} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))
{-3} ∀ (i: below(length(p′_{1}) − 1)):
g′`edges(nth(p′_{1}, i), nth(p′_{1}, 1 + i))
{-4} length(p′_{2}) ≥ 1
{-5} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))
{-6} ∀ (i: below(length(p′_{2}) − 1)):
g′`edges(nth(p′_{2}, i), nth(p′_{2}, 1 + i))
{-7} concatable?(p′_{1}, p′_{2})
{1} ∀ (i: below(length(append(p′_{1}, cdr(p′_{2}))))):
g′`nodes(nth(append(p′_{1}, cdr(p′_{2})), i))

Hiding formulas: -3, -6, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Case splitting on i!1 < length(p1!1), we get 2 subgoals:

path_concat_path.1.1:

{-1} i′ < length(p′_{1})
{-2} i′ < length(p′_{1}) + length(p′_{2}) − 1
{-3} length(p′_{1}) ≥ 1
{-4} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))
{-5} length(p′_{2}) ≥ 1
{-6} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))
{-7} concatable?(p′_{1}, p′_{2})
{1} g′`nodes(nth(append(p′_{1}, cdr(p′_{2})), i′))

Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, This completes the proof of path_concat_path.1.1.

path_concat_path.1.2:

{-1} i′ < length(p′_{1}) + length(p′_{2}) − 1
{-2} length(p′_{1}) ≥ 1
{-3} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))
{-4} length(p′_{2}) ≥ 1
{-5} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))
{-6} concatable?(p′_{1}, p′_{2})
{1} i′ < length(p′_{1})
{2} g′`nodes(nth(append(p′_{1}, cdr(p′_{2})), i′))

Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -5 with the terms: i′ − length(p′_{1}) + 1, Expanding the definition of nth, which is trivially true. This completes the proof of path_concat_path.1.2.

path_concat_path.2:

{-1} length(p′_{1}) ≥ 1
{-2} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))

{-3} ∀ (i: below(length(p′_{1}) − 1)):

g′`edges(nth(p′_{1}, i), nth(p′_{1}, 1 + i))

{-4} length(p′_{2}) ≥ 1
{-5} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))

{-6} ∀ (i: below(length(p′_{2}) − 1)):

g′`edges(nth(p′_{2}, i), nth(p′_{2}, 1 + i))

{-7} concatable?(p′_{1}, p′_{2})

{1} ∀ (i: below(length(append(p′_{1}, cdr(p′_{2}))) − 1)):

g′`edges (nth(append(p′_{1}, cdr(p′_{2})), i), nth(append(p′_{1}, cdr(p′_{2})), 1 + i))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Case splitting on 1 + i!1 < length(p1!1), we get 2 subgoals:

path_concat_path.2.1:

{-1} 1 + i′ < length(p′_{1})
{-2} i′ < length(p′_{1}) + length(p′_{2}) − 2
{-3} length(p′_{1}) ≥ 1
{-4} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))

{-5} ∀ (i: below(length(p′_{1}) − 1)):

g′`edges(nth(p′_{1}, i), nth(p′_{1}, 1 + i))

{-6} length(p′_{2}) ≥ 1
{-7} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))

{-8} ∀ (i: below(length(p′_{2}) − 1)):

g′`edges(nth(p′_{2}, i), nth(p′_{2}, 1 + i))

{-9} concatable?(p′_{1}, p′_{2})

{1} g′`edges (nth(append(p′_{1}, cdr(p′_{2})), i′), nth(append(p′_{1}, cdr(p′_{2})), 1 + i′))

Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, This completes the proof of path_concat_path.2.1.

path_concat_path.2.2:

{-1} i′ < length(p′_{1}) + length(p′_{2}) − 2
{-2} length(p′_{1}) ≥ 1
{-3} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))

{-4} ∀ (i: below(length(p′_{1}) − 1)):

g′`edges(nth(p′_{1}, i), nth(p′_{1}, 1 + i))

{-5} length(p′_{2}) ≥ 1
{-6} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))

{-7} ∀ (i: below(length(p′_{2}) − 1)):

g′`edges(nth(p′_{2}, i), nth(p′_{2}, 1 + i))

{-8} concatable?(p′_{1}, p′_{2})
{1} 1 + i′ < length(p′_{1})

{2} g′`edges (nth(append(p′_{1}, cdr(p′_{2})), i′), nth(append(p′_{1}, cdr(p′_{2})), 1 + i′))

Case splitting on 1 + i!1 = length(p1!1), we get 2 subgoals:

path_concat_path.2.2.1:

{-1} 1 + i′ = length(p′_{1})
{-2} i′ < length(p′_{1}) + length(p′_{2}) − 2
{-3} length(p′_{1}) ≥ 1
{-4} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))

{-5} ∀ (i: below(length(p′_{1}) − 1)):

g′`edges(nth(p′_{1}, i), nth(p′_{1}, 1 + i))

{-6} length(p′_{2}) ≥ 1
{-7} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))

{-8} ∀ (i: below(length(p′_{2}) − 1)):

g′`edges(nth(p′_{2}, i), nth(p′_{2}, 1 + i))

{-9} concatable?(p′_{1}, p′_{2})
{1} 1 + i′ < length(p′_{1})

{2} g′`edges (nth(append(p′_{1}, cdr(p′_{2})), i′), nth(append(p′_{1}, cdr(p′_{2})), 1 + i′))

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of concatable?, Expanding the definition of path_end, Expanding the definition of path_start, Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -9, Instantiating the top quantifier in -8 with the terms: 0, Expanding the definition of nth, which is trivially true. This completes the proof of path_concat_path.2.2.1.

path_concat_path.2.2.2:

{-1} i′ < length(p′_{1}) + length(p′_{2}) − 2
{-2} length(p′_{1}) ≥ 1
{-3} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))
{-4} ∀ (i: below(length(p′_{1}) − 1)):
g′`edges(nth(p′_{1}, i), nth(p′_{1}, 1 + i))
{-5} length(p′_{2}) ≥ 1
{-6} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))
{-7} ∀ (i: below(length(p′_{2}) − 1)):
g′`edges(nth(p′_{2}, i), nth(p′_{2}, 1 + i))
{-8} concatable?(p′_{1}, p′_{2})
{1} 1 + i′ = length(p′_{1})
{2} 1 + i′ < length(p′_{1})
{3} g′`edges

(nth(append(p′_{1}, cdr(p′_{2})), i′), nth(append(p′_{1}, cdr(p′_{2})), 1 + i′))

Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -7 with the terms: i′ − length(p′_{1}) + 1, Expanding the definition of nth, which is trivially true. This completes the proof of path_concat_path.2.2.2. Q.E.D.

C.97.14 Graph.trans_closure_char_graph

Terse proof for trans_closure_char_graph.
trans_closure_char_graph:

{1} ∀ (g: graph_type, x, y: (g`nodes)):

transitive_closure(g`edges)(x, y) ≡ (∃ (l: (path?(g))):

length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y)

Repeatedly Skolemizing and flattening, Using lemma trans_closure_char, Installing automatic rewrites from: length_stable nth_stable Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

trans_closure_char_graph.1:

{-1} transitive_closure(g′`edges)(x′, y′)
{-2} ∃ (l: list[(g′`nodes)]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)):

g′`edges(nth(l, i), nth(l, 1 + i)))

{-3} g′`nodes(x′)
{-4} g′`nodes(y′)
{1} ∃ (l: (path?(g′))): length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′

Keeping (-2 1) and hiding *, Repeatedly Skolemizing and flattening, Using lemma every_nth[T ], Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: path? path_list? Instantiating quantified variables, we get 2 subgoals:

trans_closure_char_graph.1.1:

{-1} ∀ (i: below(length(l′))): g′`nodes(nth(l′, i))
{-2} every(g′`nodes)(l′)
{-3} length[T ](l′) ≥ 2
{-4} path_start(l′) = x′
{-5} path_end(l′) = y′
{-6} ∀ (i: below(length(l′) − 1)): g′`edges(nth(l′, i), nth(l′, 1 + i))
{1} length(l′) ≥ 2 ∧ path_start(l′) = x′ ∧ path_end(l′) = y′

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of path_start, Expanding the definition of path_end, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char_graph.1.1.
trans_closure_char_graph.1.2:

{-1} ∀ (i: below(length(l′))): g′`nodes(nth(l′, i))
{-2} every(g′`nodes)(l′)
{-3} length[T ](l′) ≥ 2
{-4} path_start(l′) = x′
{-5} path_end(l′) = y′
{-6} ∀ (i: below(length(l′) − 1)): g′`edges(nth(l′, i), nth(l′, 1 + i))

{1} (∀ (i: below(length(l′))): g′`nodes(nth(l′, i))) ∧

(∀ (i: below(length(l′) − 1)): g′`edges(nth(l′, i), nth(l′, 1 + i)))

Applying propositional simplification, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -7 with the terms: i′, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char_graph.1.2.

trans_closure_char_graph.2:

{-1} g′`nodes(x′)
{-2} g′`nodes(y′)
{-3} ∃ (l: (path?(g′))): length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′
{1} transitive_closure(g′`edges)(x′, y′)
{2} ∃ (l: list[(g′`nodes)]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)):

g′`edges(nth(l, i), nth(l, 1 + i)))

Keeping (-3 2) and hiding *, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path? path_list? Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Expanding the definition of path_start, Expanding the definition of path_end, Using lemma every_nth[T ], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -5 with the terms: i′, we get 2 subgoals:

trans_closure_char_graph.2.1:

{-1} i′ < length(l′) − 1
{-2} every(g′`nodes)(l′)
{-3} ∀ (i: below(length(l′))): g′`nodes(nth(l′, i))
{-4} length(l′) ≥ 1
{-5} g′`edges(nth(l′, i′), nth(l′, 1 + i′))
{-6} car(l′) = x′
{-7} length(l′) ≥ 2
{-8} nth(l′, length(l′) − 1) = y′
{1} g′`edges(nth(l′, i′), nth(l′, 1 + i′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char_graph.2.1.
trans_closure_char_graph.2.2:

{-1} i′ < length(l′) − 1
{-2} every(g′`nodes)(l′)
{-3} ∀ (i: below(length(l′))): g′`nodes(nth(l′, i))
{-4} length(l′) ≥ 1
{-5} car(l′) = x′
{-6} length(l′) ≥ 2
{-7} nth(l′, length(l′) − 1) = y′
{1} i′ < length[T ](l′) − 1
{2} g′`edges(nth(l′, i′), nth(l′, 1 + i′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char_graph.2.2.

Q.E.D.

C.97.15 Graph.path_cycle_free

Terse proof for path_cycle_free.
path_cycle_free:

{1} ∀ (g: graph_type):

cycle_free?(g) ≡ (∀ (l: (path?(g)), i_{1}, i_{2}: below(length(l))):

nth(l, i_{1}) = nth(l, i_{2}) ⊃ i_{1} = i_{2})

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: car_tail car_head nth_tail nth_head length_head length_tail

path_list? path_head path_tail path_start path_end Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

path_cycle_free.1:

{-1} cycle_free?(g′)
{1} ∀ (l: (path?(g′)), i_{1}, i_{2}: below(length(l))):
nth(l, i_{1}) = nth(l, i_{2}) ⊃ i_{1} = i_{2}

Repeatedly Skolemizing and flattening, Expanding the definition of cycle_free?, Instantiating the top quantifier in -5 with the terms: nth(l′, i′_{1}), Applying propositional simplification, we get 2 subgoals:

path_cycle_free.1.1:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} i′_{1} < length(l′)
{-4} i′_{2} < length(l′)
{-5} nth(l′, i′_{1}) = nth(l′, i′_{2})
{1} transitive_closure(g′`edges)(nth(l′, i′_{1}), nth(l′, i′_{1}))
{2} i′_{1} = i′_{2}

Rewriting using trans_closure_char_graph, matching in *, Case splitting on i1!1 < i2!1, we get 2 subgoals:

path_cycle_free.1.1.1:

{-1} i′_{1} < i′_{2}
{-2} path_list?[T ](l′)
{-3} path?(g′)(l′)
{-4} i′_{1} < length(l′)
{-5} i′_{2} < length(l′)
{-6} nth(l′, i′_{1}) = nth(l′, i′_{2})
{1} ∃ (l: (path?(g′))):
length(l) ≥ 2 ∧
car(l) = nth(l′, i′_{1}) ∧ nth(l, length(l) − 1) = nth(l′, i′_{1})
{2} i′_{1} = i′_{2}

Instantiating the top quantifier in 1 with the terms: tail(head(l′, i′_{2} + 1), i′_{1}),

C Proof scripts

we get 3 subgoals:

path_cycle_free.1.1.1.1:

{-1} i′_{1} < i′_{2}
{-2} path_list?[T ](l′)
{-3} path?(g′)(l′)
{-4} i′_{1} < length(l′)
{-5} i′_{2} < length(l′)
{-6} nth(l′, i′_{1}) = nth(l′, i′_{2})

{1} length(tail(head(l′, i′_{2} + 1), i′_{1})) ≥ 2 ∧ car(tail(head(l′, i′_{2} + 1), i′_{1})) = nth(l′, i′_{1}) ∧

nth(tail(head(l′, i′_{2} + 1), i′_{1}),
length(tail(head(l′, i′_{2} + 1), i′_{1})) − 1)
= nth(l′, i′_{1})
{2} i′_{1} = i′_{2}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.1.1.1.1.

path_cycle_free.1.1.1.2:

{-1} i′_{1} < i′_{2}
{-2} path_list?[T ](l′)
{-3} path?(g′)(l′)
{-4} i′_{1} < length(l′)
{-5} i′_{2} < length(l′)
{-6} nth(l′, i′_{1}) = nth(l′, i′_{2})

{1} length(tail[T ](head[T ](l′, 1 + i′_{2}), i′_{1})) ≥ 1 ∧

path?(g′)(tail[T ](head[T ](l′, 1 + i′_{2}), i′_{1}))

{2} i′_{1} = i′_{2}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.1.1.1.2.

path_cycle_free.1.1.1.3:

{-1} i′_{1} < i′_{2}
{-2} path_list?[T ](l′)
{-3} path?(g′)(l′)
{-4} i′_{1} < length(l′)
{-5} i′_{2} < length(l′)
{-6} nth(l′, i′_{1}) = nth(l′, i′_{2})
{1} i′_{1} ≤ 1 + i′_{2}
{2} i′_{1} = i′_{2}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.1.1.1.3.

path_cycle_free.1.1.2:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} i′_{1} < length(l′)
{-4} i′_{2} < length(l′)
{-5} nth(l′, i′_{1}) = nth(l′, i′_{2})
{1} i′_{1} < i′_{2}

{2} ∃ (l: (path?(g′))):

length(l) ≥ 2 ∧

car(l) = nth(l′, i′_{1}) ∧ nth(l, length(l) − 1) = nth(l′, i′_{1})

{3} i′_{1} = i′_{2}

Instantiating the top quantifier in 2 with the terms: tail(head(l′, i′_{1} + 1), i′_{2}), we get 3 subgoals:

path_cycle_free.1.1.2.1:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} i′_{1} < length(l′)
{-4} i′_{2} < length(l′)
{-5} nth(l′, i′_{1}) = nth(l′, i′_{2})
{1} i′_{1} < i′_{2}

{2} length(tail(head(l′, i′_{1} + 1), i′_{2})) ≥ 2 ∧ car(tail(head(l′, i′_{1} + 1), i′_{2})) = nth(l′, i′_{1}) ∧

nth(tail(head(l′, i′_{1} + 1), i′_{2}),
length(tail(head(l′, i′_{1} + 1), i′_{2})) − 1)
= nth(l′, i′_{1})
{3} i′_{1} = i′_{2}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.1.1.2.1.

path_cycle_free.1.1.2.2:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} i′_{1} < length(l′)
{-4} i′_{2} < length(l′)
{-5} nth(l′, i′_{1}) = nth(l′, i′_{2})

{1} length(tail[T ](head[T ](l′, 1 + i′_{1}), i′_{2})) ≥ 1 ∧

path?(g′)(tail[T ](head[T ](l′, 1 + i′_{1}), i′_{2}))

{2} i′_{1} < i′_{2}
{3} i′_{1} = i′_{2}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.1.1.2.2.

path_cycle_free.1.1.2.3:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} i′_{1} < length(l′)
{-4} i′_{2} < length(l′)
{-5} nth(l′, i′_{1}) = nth(l′, i′_{2})
{1} i′_{2} ≤ 1 + i′_{1}
{2} i′_{1} < i′_{2}
{3} i′_{1} = i′_{2}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.1.1.2.3.

path_cycle_free.1.2:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} i′_{1} < length(l′)
{-4} i′_{2} < length(l′)
{-5} nth(l′, i′_{1}) = nth(l′, i′_{2})
{1} g′`nodes(nth(l′, i′_{1}))
{2} i′_{1} = i′_{2}

Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, This completes the proof of path_cycle_free.1.2.

path_cycle_free.2:

{-1} ∀ (l: (path?(g′)), i_{1}, i_{2}: below(length(l))):
nth(l, i_{1}) = nth(l, i_{2}) ⊃ i_{1} = i_{2}
{1} cycle_free?(g′)

Expanding the definition of cycle_free?, Repeatedly Skolemizing and flattening, Rewriting using trans_closure_char_graph, matching in *, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -7 with the terms: l′, 0, length(l′) − 1, we get 3 subgoals:

path_cycle_free.2.1:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} g′`nodes(x′)
{-4} length(l′) ≥ 2
{-5} car(l′) = x′
{-6} nth(l′, length(l′) − 1) = x′
{-7} nth(l′, 0) = nth(l′, length(l′) − 1) ⊃ 0 = length(l′) − 1

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of nth, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.2.1.

path_cycle_free.2.2:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} g′`nodes(x′)
{-4} length(l′) ≥ 2
{-5} car(l′) = x′
{-6} nth(l′, length(l′) − 1) = x′
{1} length[T ](l′) − 1 ≥ 0

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.2.2.

path_cycle_free.2.3:

{-1} path_list?[T ](l′)
{-2} path?(g′)(l′)
{-3} g′`nodes(x′)
{-4} length(l′) ≥ 2
{-5} car(l′) = x′
{-6} nth(l′, length(l′) − 1) = x′
{1} 0 < length[T ](l′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_cycle_free.2.3. Q.E.D.

C.97.16 Graph.different_nodes_on_edge

Terse proof for different_nodes_on_edge.
different_nodes_on_edge:

{1} ∀ (g: graph_type, x, y: (g`nodes)): cycle_free?(g) ∧ g`edges(x, y) ⊃ ¬ x = y

Repeatedly Skolemizing and flattening, Using lemma path_cycle_free, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: nth length path_list? path? Instantiating the top quantifier in -1 with the terms: (:x′, y′:), 0, 1, we get 2 subgoals:

different_nodes_on_edge.1:

{-1} nth((:x′, y′:), 0) = nth((:x′, y′:), 1) ⊃ 0 = 1
{-2} g′`nodes(x′)
{-3} g′`nodes(y′)
{-4} cycle_free?(g′)
{-5} g′`edges(x′, y′)
{-6} x′ = y′

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of different_nodes_on_edge.1.
different_nodes_on_edge.2:

{-1} g′`nodes(x′)
{-2} g′`nodes(y′)
{-3} cycle_free?(g′)
{-4} g′`edges(x′, y′)
{-5} x′ = y′

{1} (∀ (i: below(length((:x′, y′:)))): g′`nodes(nth((:x′, y′:), i))) ∧

(∀ (i: below(length((:x′, y′:)) − 1)):
g′`edges(nth((:x′, y′:), i), nth((:y′:), i)))

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement,

Case splitting on i!1 = 0, we get 2 subgoals:

different_nodes_on_edge.2.1:

{-1} i′ = 0
{-2} i′ < 2
{-3} g′`nodes(y′)
{-4} cycle_free?(g′)
{-5} g′`edges(y′, y′)
{-6} x′ = y′
{1} g′`nodes(nth((:y′, y′:), i′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of different_nodes_on_edge.2.1.
different_nodes_on_edge.2.2:

{-1} i′ < 2
{-2} g′`nodes(y′)
{-3} cycle_free?(g′)
{-4} g′`edges(y′, y′)
{-5} x′ = y′
{1} i′ = 0
{2} g′`nodes(nth((:y′, y′:), i′))

Case splitting on i!1 = 1, we get 2 subgoals:

different_nodes_on_edge.2.2.1:

{-1} i′ = 1
{-2} i′ < 2
{-3} g′`nodes(y′)
{-4} cycle_free?(g′)
{-5} g′`edges(y′, y′)
{-6} x′ = y′
{1} i′ = 0
{2} g′`nodes(nth((:y′, y′:), i′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of different_nodes_on_edge.2.2.1.
different_nodes_on_edge.2.2.2:

{-1} i′ < 2
{-2} g′`nodes(y′)
{-3} cycle_free?(g′)
{-4} g′`edges(y′, y′)
{-5} x′ = y′
{1} i′ = 1
{2} i′ = 0
{3} g′`nodes(nth((:y′, y′:), i′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of different_nodes_on_edge.2.2.2.

Q.E.D.

C.97.17 Graph.tree_path

Terse proof for tree_path.

tree_path:

{1} ∀ (g: graph_type, p_{1}, p_{2}: (path?(g))):

tree?(g) ∧ path_end(p_{1}) = path_end(p_{2}) ∧ length(p_{1}) = length(p_{2}) ⊃ p_{1} = p_{2}

For the top quantifier in 1, we introduce Skolem constants: (g′ ), Inducting on p1 on formula 1 using induction scheme path_list_induction[T ], we get 3 subgoals:

tree_path.1:

{1} path?(g′)(p′_{1})
{2} ∀ (p_{2}: (path?(g′))):

tree?(g′) ∧ path_end(p′_{1}) = path_end(p_{2}) ∧ length(p′_{1}) = length(p_{2}) ⊃ p′_{1} = p_{2}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of tree_path.1.

tree_path.2:

{1} ∀ (t: T):

path?(g′)(cons(t, null)) ⊃ (∀ (p_{2}: (path?(g′))): tree?(g′) ∧ path_end(cons(t, null)) = path_end(p_{2}) ∧ length(cons(t, null)) = length(p_{2}) ⊃ cons(t, null) = p_{2})

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: length path_end nth Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, Applying extensionality, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of tree_path.2.

tree_path.3:

{1} ∀ (t: T, tail: (path_list?)): (path?(g′)(tail) ⊃

(∀ (p_{2}: (path?(g′))): tree?(g′) ∧ path_end(tail) = path_end(p_{2}) ∧ length(tail) = length(p_{2}) ⊃ tail = p_{2}))

⊃

path?(g′)(cons(t, tail)) ⊃ (∀ (p_{2}: (path?(g′))): tree?(g′) ∧ path_end(cons(t, tail)) = path_end(p_{2}) ∧ length(cons(t, tail)) = length(p_{2}) ⊃ cons(t, tail) = p_{2})

Repeatedly Skolemizing and flattening, Using lemma path_cdr, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -5 with the terms: cdr(p′_{2}), we get 2 subgoals:

tree_path.3.1:

{-1} path?(g′)(tail′)
{-2} path_list?[T ](p′_{2})
{-3} path?(g′)(p′_{2})
{-4} path_list?(tail′)

{-5} path_end(tail′) = path_end(cdr(p′_{2})) ∧ length(tail′) = length(cdr(p′_{2})) ⊃

tail′ = cdr(p′_{2})

{-6} path?(g′)(cons(t′, tail′))
{-7} tree?(g′)
{-8} path_end(cons(t′, tail′)) = path_end(p′_{2})
{-9} length(tail′) = length(cdr(p′_{2}))
{1} null?(p′_{2})
{2} cons(t′, tail′) = p′_{2}

Expanding the definition of path_list?, Applying propositional simplification, we get 2 subgoals:

tree_path.3.1.1:

{-1} tail′ = cdr(p′_{2})
{-2} path?(g′)(tail′)
{-3} length(p′_{2}) ≥ 1
{-4} path?(g′)(p′_{2})
{-5} length(tail′) ≥ 1
{-6} path?(g′)(cons(t′, tail′))
{-7} tree?(g′)
{-8} path_end(cons(t′, tail′)) = path_end(p′_{2})
{-9} length(tail′) = length(cdr(p′_{2}))
{1} null?(p′_{2})
{2} cons(t′, tail′) = p′_{2}

Applying extensionality, Hiding formulas: -2, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -4 with the terms: 0, we get 2 subgoals:

tree_path.3.1.1.1:

{-1} tail′ = cdr(p′_{2})
{-2} length(p′_{2}) ≥ 1
{-3} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))
{-4} g′`edges(nth(p′_{2}, 0), nth(p′_{2}, 1 + 0))
{-5} length(tail′) ≥ 1
{-6} ∀ (i: below(length(cons(t′, tail′)))): g′`nodes(nth(cons(t′, tail′), i))

{-7} ∀ (i: below(length(cons(t′, tail′)) − 1)):

g′`edges(nth(cons(t′, tail′), i), nth(cons(t′, tail′), 1 + i))

{-8} tree?(g′)
{-9} path_end(cons(t′, tail′)) = path_end(p′_{2})
{-10} length(tail′) = length(cdr(p′_{2}))
{1} t′ = car(p′_{2})
{2} null?(p′_{2})

Instantiating the top quantifier in -7 with the terms: 0, we get 2 subgoals:

tree_path.3.1.1.1.1:

{-1} tail′ = cdr(p′_{2})
{-2} length(p′_{2}) ≥ 1
{-3} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))
{-4} g′`edges(nth(p′_{2}, 0), nth(p′_{2}, 1 + 0))
{-5} length(tail′) ≥ 1
{-6} ∀ (i: below(length(cons(t′, tail′)))): g′`nodes(nth(cons(t′, tail′), i))
{-7} g′`edges(nth(cons(t′, tail′), 0), nth(cons(t′, tail′), 1 + 0))
{-8} tree?(g′)
{-9} path_end(cons(t′, tail′)) = path_end(p′_{2})
{-10} length(tail′) = length(cdr(p′_{2}))
{1} t′ = car(p′_{2})
{2} null?(p′_{2})

Installing automatic rewrites from: nth Simplifying, rewriting, and recording with decision procedures, Expanding the definition of tree?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -9 with the terms: t′, car(p′_{2}), car(tail′), Simplifying, rewriting, and recording with decision procedures, This completes the proof of tree_path.3.1.1.1.1.

tree_path.3.1.1.1.2:

{-1} tail′ = cdr(p′_{2})
{-2} length(p′_{2}) ≥ 1
{-3} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))
{-4} g′`edges(nth(p′_{2}, 0), nth(p′_{2}, 1 + 0))
{-5} length(tail′) ≥ 1
{-6} ∀ (i: below(length(cons(t′, tail′)))): g′`nodes(nth(cons(t′, tail′), i))
{-7} tree?(g′)
{-8} path_end(cons(t′, tail′)) = path_end(p′_{2})
{-9} length(tail′) = length(cdr(p′_{2}))
{1} 0 < length[T ](cons[T ](t′, tail′)) − 1
{2} t′ = car(p′_{2})
{3} null?(p′_{2})

Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of tree_path.3.1.1.1.2.

tree_path.3.1.1.2:

{-1} tail′ = cdr(p′_{2})
{-2} length(p′_{2}) ≥ 1
{-3} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))
{-4} length(tail′) ≥ 1
{-5} ∀ (i: below(length(cons(t′, tail′)))): g′`nodes(nth(cons(t′, tail′), i))

{-6} ∀ (i: below(length(cons(t′, tail′)) − 1)):

g′`edges(nth(cons(t′, tail′), i), nth(cons(t′, tail′), 1 + i))

{-7} tree?(g′)
{-8} path_end(cons(t′, tail′)) = path_end(p′_{2})
{-9} length(tail′) = length(cdr(p′_{2}))
{1} 0 < length[T ](p′_{2}) − 1
{2} t′ = car(p′_{2})
{3} null?(p′_{2})

Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of tree_path.3.1.1.2.

tree_path.3.1.2:

{-1} path?(g′)(tail′)
{-2} length(p′_{2}) ≥ 1
{-3} path?(g′)(p′_{2})
{-4} length(tail′) ≥ 1
{-5} path?(g′)(cons(t′, tail′))
{-6} tree?(g′)
{-7} path_end(cons(t′, tail′)) = path_end(p′_{2})
{-8} length(tail′) = length(cdr(p′_{2}))
{1} path_end(tail′) = path_end(cdr(p′_{2}))
{2} null?(p′_{2})
{3} cons(t′, tail′) = p′_{2}

Installing automatic rewrites from: path_end nth length Simplifying, rewriting, and recording with decision procedures, This completes the proof of tree_path.3.1.2.

tree_path.3.2:

{-1} path?(g′)(tail′)
{-2} path_list?[T ](p′_{2})
{-3} path?(g′)(p′_{2})
{-4} path_list?(tail′)
{-5} path?(g′)(cons(t′, tail′))
{-6} tree?(g′)
{-7} path_end(cons(t′, tail′)) = path_end(p′_{2})
{-8} length(tail′) = length(cdr(p′_{2}))
{1} path_list?[T ](cdr[T ](p′_{2})) ∧ path?(g′)(cdr[T ](p′_{2}))
{2} null?(p′_{2})
{3} cons(t′, tail′) = p′_{2}

Using lemma path_cdr, Expanding the definition of path_list?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of tree_path.3.2. Q.E.D.

C.97.18 Graph.root_path_TCC1

Terse proof for root_path_TCC1.
root_path_TCC1:

{1} ∀ (g: graph_type, n: (g`nodes), p: (path?(g))): (g`nodes)(path_start[T ](p))

Repeatedly Skolemizing and flattening, Rewriting using nodes_path_start, matching in *, This completes the proof of root_path_TCC1. Q.E.D.

C.97.19 Graph.path_length_bound_TCC1

Terse proof for path_length_bound_TCC1.
path_length_bound_TCC1:

{1} ∀ (g: graph_type):

cycle_free?(g) ∧ finite?(g) ⊃ (∀ (p: (path?(g))): is_finite[T ](g`nodes))

Repeatedly Skolemizing and flattening, Expanding the definition of finite?, which is trivially true. This completes the proof of path_length_bound_TCC1. Q.E.D.

C.97.20 Graph.path_length_bound

Terse proof for path_length_bound.
path_length_bound:

{1} ∀ (g: graph_type):

finite?(g) ∧ cycle_free?(g) ⊃

(∀ (p: (path?(g))): length(p) ≤ card(g`nodes))

Repeatedly Skolemizing and flattening, Using lemma list_pred_card[T ], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

path_length_bound.1:

{-1} ∃ (n_{1}, n_{2}: below(length(p′))): ¬ n_{1} = n_{2} ∧ nth(p′, n_{1}) = nth(p′, n_{2})
{-2} path_list?[T ](p′)
{-3} path?(g′)(p′)
{-4} finite?(g′)
{-5} cycle_free?(g′)
{1} length(p′) ≤ card(g′`nodes)

Repeatedly Skolemizing and flattening, Using lemma path_cycle_free, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_length_bound.1.

path_length_bound.2:

{-1} path_list?[T ](p′)
{-2} path?(g′)(p′)
{-3} finite?(g′)
{-4} cycle_free?(g′)
{1} every(g′`nodes)(p′)
{2} length(p′) ≤ card(g′`nodes)

Rewriting using every_nth, matching in *, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, This completes the proof of path_length_bound.2.

path_length_bound.3:

{-1} path_list?[T ](p′)
{-2} path?(g′)(p′)
{-3} finite?(g′)
{-4} cycle_free?(g′)
{1} is_finite(g′`nodes)
{2} length(p′) ≤ card(g′`nodes)

Expanding the definition of finite?, which is trivially true. This completes the proof of path_length_bound.3. Q.E.D.

C.97.21 Graph.non_root_path

Terse proof for non_root_path.

non_root_path:

{1} ∀ (g: graph_type, n: (g`nodes)): roots(g)(n) ∨ (∃ (p: (path?(g))): length(p) = 2 ∧ path_end(p) = n)

Repeatedly Skolemizing and flattening, Expanding the definition of roots, Repeatedly Skolemizing and flattening, Case splitting on length[T]((: x!1, n!1 :)) = 2, we get 2 subgoals:

non_root_path.1:

{-1} length[T ]((:x′, n′:)) = 2
{-2} g′`nodes(x′)
{-3} g′`nodes(n′)
{-4} g′`edges(x′, n′)
{1} ∃ (p: (path?(g′))): length(p) = 2 ∧ path_end(p) = n′

Instantiating the top quantifier in 1 with the terms: (:x′, n′:), we get 2 subgoals:

non_root_path.1.1:

{-1} length[T ]((:x′, n′:)) = 2
{-2} g′`nodes(x′)
{-3} g′`nodes(n′)
{-4} g′`edges(x′, n′)
{1} length((:x′, n′:)) = 2 ∧ path_end((:x′, n′:)) = n′

Simplifying, rewriting, and recording with decision procedures, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of non_root_path.1.1.

non_root_path.1.2:

{-1} length[T ]((:x′, n′:)) = 2
{-2} g′`nodes(x′)
{-3} g′`nodes(n′)
{-4} g′`edges(x′, n′)
{1} path_list?[T ]((:x′, n′:)) ∧ path?(g′)((:x′, n′:))

Expanding the definition of path_list?, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of path?, Applying propositional simplification, we get 2 subgoals:

non_root_path.1.2.1:

{-1} length[T ]((:x′, n′:)) = 2
{-2} g′`nodes(x′)
{-3} g′`nodes(n′)
{-4} g′`edges(x′, n′)
{1} ∀ (i: below(length((:x′, n′:)))): g′`nodes(nth((:x′, n′:), i))

Repeatedly Skolemizing and flattening, Case splitting on i!1 = 0, we get 2 subgoals:

non_root_path.1.2.1.1:

{-1} i′ = 0
{-2} i′ < length((:x′, n′:))
{-3} length[T ]((:x′, n′:)) = 2
{-4} g′`nodes(x′)
{-5} g′`nodes(n′)
{-6} g′`edges(x′, n′)
{1} g′`nodes(nth((:x′, n′:), i′))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of non_root_path.1.2.1.1.

non_root_path.1.2.1.2:

{-1} i′ < length((:x′, n′:))
{-2} length[T ]((:x′, n′:)) = 2
{-3} g′`nodes(x′)
{-4} g′`nodes(n′)
{-5} g′`edges(x′, n′)
{1} i′ = 0
{2} g′`nodes(nth((:x′, n′:), i′))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of non_root_path.1.2.1.2.

non_root_path.1.2.2:

{-1} length[T ]((:x′, n′:)) = 2
{-2} g′`nodes(x′)
{-3} g′`nodes(n′)
{-4} g′`edges(x′, n′)
{1} ∀ (i: below(length((:x′, n′:)) − 1)):

g′`edges(nth((:x′, n′:), i), nth((:x′, n′:), 1 + i))

Repeatedly Skolemizing and flattening, Expanding the definition of nth, Expanding the definition of nth, which is trivially true. This completes the proof of non_root_path.1.2.2.

non_root_path.2:

{-1} g′`nodes(x′)
{-2} g′`nodes(n′)
{-3} g′`edges(x′, n′)
{1} length[T ]((:x′, n′:)) = 2
{2} ∃ (p: (path?(g′))): length(p) = 2 ∧ path_end(p) = n′

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of non_root_path.2. Q.E.D.

C.97.22 Graph.non_root_path_extend_TCC1

Terse proof for non_root_path_extend_TCC1.
non_root_path_extend_TCC1:

{1} ∀ (g: graph_type, p: (path?(g))): (g`nodes)(path_start[T ](p))

Repeatedly Skolemizing and flattening, Rewriting using nodes_path_start, matching in *,

This completes the proof of non_root_path_extend_TCC1.

Q.E.D.

C.97.23 Graph.non_root_path_extend

Terse proof for non_root_path_extend.

non_root_path_extend:

{1} ∀ (g: graph_type, p: (path?(g))): roots(g)(path_start(p)) ∨ (∃ (q: (path?(g))):

length(q) = length(p) + 1 ∧ path_end(q) = path_end(p))

Repeatedly Skolemizing and flattening, Using lemma non_root_path, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_concat_path length_concat_path concatable? Instantiating the top quantifier in 2 with the terms: concat_path(p′′, p′), we get 2 subgoals:

non_root_path_extend.1:

{-1} path_list?[T ](p′′)
{-2} path?(g′)(p′′)
{-3} length(p′′) = 2
{-4} path_end(p′′) = path_start(p′)
{-5} path_list?[T ](p′)
{-6} path?(g′)(p′)
{1} roots(g′)(path_start(p′))

{2} length(concat_path(p′′, p′)) = 1 + length(p′) ∧ path_end(concat_path(p′′, p′)) = path_end(p′)

Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: path_end path_start nth_append_right nth_append_left con-

cat_path length_append length_cdr path_list? length Simplifying, rewriting, and recording with decision procedures, Case splitting on length(p!1) = 1, we get 2 subgoals:

non_root_path_extend.1.1:

{-1} length(p′) = 1
{-2} path_list?[T ](p′′)
{-3} path?(g′)(p′′)
{-4} length(p′′) = 2
{-5} nth(p′′, length(p′′) − 1) = car(p′)
{-6} length(p′) ≥ 1
{-7} path?(g′)(p′)
{1} roots(g′)(car(p′))
{2} nth(append(p′′, cdr(p′)), length(p′) + length(p′′) − 2) =
nth(p′, length(p′) − 1)

Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: nth Simplifying, rewriting, and recording with decision procedures,

This completes the proof of non_root_path_extend.1.1.

non_root_path_extend.1.2:

{-1} path_list?[T ](p′′)
{-2} path?(g′)(p′′)
{-3} length(p′′) = 2
{-4} nth(p′′, length(p′′) − 1) = car(p′)
{-5} length(p′) ≥ 1
{-6} path?(g′)(p′)
{1} length(p′) = 1
{2} roots(g′)(car(p′))

{3} nth(append(p′′, cdr(p′)), length(p′) + length(p′′) − 2) =

nth(p′, length(p′) − 1)

Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: nth Simplifying, rewriting, and recording with decision procedures,

This completes the proof of non_root_path_extend.1.2.
non_root_path_extend.2:

{-1} path_list?[T ](p′′)
{-2} path?(g′)(p′′)
{-3} length(p′′) = 2
{-4} path_end(p′′) = path_start(p′)
{-5} path_list?[T ](p′)
{-6} path?(g′)(p′)
{1} path?(g′)(concat_path[T ](p′′, p′))
{2} roots(g′)(path_start(p′))

Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, This completes the proof of non_root_path_extend.2. Q.E.D.

C.97.24 Graph.tree_path_to_root

Terse proof for tree_path_to_root.
tree_path_to_root:

{1} ∀ (g: graph_type):

finite_tree?(g) ⊃ (∀ (n: (g`nodes)): ∃ (p: (path?(g))): root_path(g, n)(p))

Repeatedly Skolemizing and flattening, Expanding the definition of finite_tree?, Applying disjunctive simplification to flatten sequent, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of finite?, Simplifying, rewriting, and recording with decision procedures, Letting max_len name min(LAMBDA (i: nat): EXISTS (q: (path?(g!1))): path_end(q) = n!1 AND

i = card(g!1‘nodes) - length(q)), we get 2 subgoals:

C.97 Proofs for Graph (graph.pvs)

tree_path_to_root.1:

{-1} min(λ (i: nat):

∃ (q: (path?(g′))):

path_end(q) = n′ ∧ i = card(g′‘nodes) − length(q))

= max_len

{-2} g′`nodes(n′)
{-3} is_finite(g′`nodes)
{-4} tree?(g′)
{1} ∃ (p: (path?(g′))): root_path(g′, n′)(p)

Rewriting using min_def, matching in *, Letting rp name choose(LAMBDA (p: (path?(g!1))): path_end(p) = n!1 AND length(p) =

card(g!1‘nodes) - max_len), we get 2 subgoals:

tree_path_to_root.1.1:

{-1} choose(λ (p: (path?(g′))):

path_end(p) = n′ ∧ length(p) = card(g′‘nodes) − max_len)

= rp {-2} minimum?(max_len,

λ (i: nat):

∃ (q: (path?(g′))):

path_end(q) = n′ ∧ i = card(g′‘nodes) − length(q))

{-3} g′`nodes(n′)
{-4} is_finite(g′`nodes)
{-5} tree?(g′)
{1} ∃ (p: (path?(g′))): root_path(g′, n′)(p)

Instantiating the top quantifier in 1 with the terms: rp, Expanding the definition of root_path, Simplifying, rewriting, and recording with decision procedures, Adding type constraints for rp, Hiding formulas: -1, -3, Using lemma non_root_path_extend, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Using lemma path_length_bound, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

tree_path_to_root.1.1.1:

{-1} ∀ (p: (path?(g′))): length(p) ≤ card(g′`nodes)
{-2} path_list?[T ](q′)
{-3} path?(g′)(q′)
{-4} length(q′) = 1 + length(rp)
{-5} path_end(q′) = path_end(rp)
{-6} path?(g′)(rp)
{-7} length(rp) = card(g′‘nodes) − max_len

{-8} choose(λ (p: (path?(g′))):

path_end(p) = n′ ∧ length(p) = card(g′‘nodes) − max_len)

= rp {-9} minimum?(max_len,

λ (i: nat):

∃ (q: (path?(g′))):

path_end(q) = n′ ∧ i = card(g′‘nodes) − length(q))

{-10} g′`nodes(n′)
{-11} is_finite(g′`nodes)
{-12} tree?(g′)
{1} roots(g′)(path_start(rp))

Instantiating quantified variables, Expanding the definition of minimum?, Applying disjunctive simplification to flatten sequent, Hiding formulas: -8, -9, Instantiating the top quantifier in -8 with the terms: card(g′‘nodes) − length(q′), we get 2 subgoals:

tree_path_to_root.1.1.1.1:

{-1} length(q′) ≤ card(g′`nodes)
{-2} path_list?[T ](q′)
{-3} path?(g′)(q′)
{-4} length(q′) = 1 + length(rp)
{-5} path_end(q′) = path_end(rp)
{-6} path?(g′)(rp)
{-7} length(rp) = card(g′‘nodes) − max_len

{-8} (∃ (q: (path?(g′))):

path_end(q) = n′ ∧ card(g′‘nodes) − length(q′) = card(g′‘nodes) − length(q))

⊃ max_len ≤ card(g′‘nodes) − length(q′)

{-9} g′`nodes(n′)
{-10} is_finite(g′`nodes)
{-11} tree?(g′)
{1} roots(g′)(path_start(rp))

Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of tree_path_to_root.1.1.1.1.

tree_path_to_root.1.1.1.2:

{-1} length(q′) ≤ card(g′`nodes)
{-2} path_list?[T ](q′)
{-3} path?(g′)(q′)
{-4} length(q′) = 1 + length(rp)
{-5} path_end(q′) = path_end(rp)
{-6} path?(g′)(rp)
{-7} length(rp) = card(g′‘nodes) − max_len
{-8} g′`nodes(n′)
{-9} is_finite(g′`nodes)
{-10} tree?(g′)
{1} card[T ](g′‘nodes) − length[T ](q′) ≥ 0
{2} roots(g′)(path_start(rp))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of tree_path_to_root.1.1.1.2.
tree_path_to_root.1.1.2:

{-1} path_list?[T ](q′)
{-2} path?(g′)(q′)
{-3} length(q′) = 1 + length(rp)
{-4} path_end(q′) = path_end(rp)
{-5} path?(g′)(rp)
{-6} length(rp) = card(g′‘nodes) − max_len

{-7} choose(λ (p: (path?(g′))):

path_end(p) = n′ ∧ length(p) = card(g′‘nodes) − max_len)

= rp {-8} minimum?(max_len,

λ (i: nat):

∃ (q: (path?(g′))):

path_end(q) = n′ ∧ i = card(g′‘nodes) − length(q))

{-9} g′`nodes(n′)
{-10} is_finite(g′`nodes)
{-11} tree?(g′)
{1} cycle_free?(g′)
{2} roots(g′)(path_start(rp))

Expanding the definition of tree?, which is trivially true. This completes the proof of tree_path_to_root.1.1.2.

tree_path_to_root.1.2:

{-1} minimum?(max_len,

λ (i: nat):

∃ (q: (path?(g′))):

path_end(q) = n′ ∧ i = card(g′‘nodes) − length(q))

{-2} g′`nodes(n′)
{-3} is_finite(g′`nodes)
{-4} tree?(g′)

{1} nonempty?[(path?(g′))]

(λ (p: (path?(g′))): path_end[T ](p) = n′ ∧ length[T ](p) = card[T ](g′‘nodes) − max_len)

{2} ∃ (p: (path?(g′))): root_path(g′, n′)(p)

Expanding the definition of minimum?, Applying disjunctive simplification to flatten sequent, Hiding formulas: -2, 2, Expanding the definition(s) of (nonempty? empty? member), Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of tree_path_to_root.1.2.

tree_path_to_root.2:

{-1} g′`nodes(n′)
{-2} is_finite(g′`nodes)
{-3} tree?(g′)

{1} nonempty?[nat]

(λ (i: nat):

∃ (q: (path?(g′))):
path_end[T ](q) = n′ ∧ i = card[T ](g′‘nodes) − length[T ](q))
{2} ∃ (p: (path?(g′))): root_path(g′, n′)(p)

Hiding formulas: 2, Installing automatic rewrites from: nonempty? empty? member path_end nth length path_list?

path?

Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -1 with the terms: card(g′‘nodes) − 1, we get 2 subgoals:

tree_path_to_root.2.1:

{-1} g′`nodes(n′)
{-2} is_finite(g′`nodes)
{-3} tree?(g′)
{1} ∃ (q: (path?(g′))):
nth(q, length(q) − 1) = n′ ∧

card(g′‘nodes) − 1 = card[T ](g′‘nodes) − length[T ](q)

Instantiating the top quantifier in 1 with the terms: (:n′:), we get 2 subgoals:

tree_path_to_root.2.1.1:

{-1} g′`nodes(n′)
{-2} is_finite(g′`nodes)
{-3} tree?(g′)
{1} nth((:n′:), length((:n′:)) − 1) = n′ ∧

card(g′‘nodes) − 1 = card[T ](g′‘nodes) − length[T ]((:n′:))

Simplifying, rewriting, and recording with decision procedures, This completes the proof of tree_path_to_root.2.1.1.

tree_path_to_root.2.1.2:

{-1} g′`nodes(n′)
{-2} is_finite(g′`nodes)
{-3} tree?(g′)

{1} (∀ (i: below(length((:n′:)))): g′`nodes(nth((:n′:), i))) ∧

(∀ (i: below(length((:n′:)) − 1)):

g′`edges(nth((:n′:), i), nth((::), i)))

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement,

This completes the proof of tree_path_to_root.2.1.2.

tree_path_to_root.2.2:

{-1} g′`nodes(n′)
{-2} is_finite(g′`nodes)
{-3} tree?(g′)
{1} card[T ](g′‘nodes) − 1 ≥ 0

Using lemma card_singleton[T ], Using lemma card_subset, Simplifying, rewriting, and recording with decision procedures, Using lemma singleton_subset[T ], Simplifying, rewriting, and recording with decision procedures, This completes the proof of tree_path_to_root.2.2. Q.E.D.

C.97.25 Graph.tree_unique_path_to_root

Terse proof for tree_unique_path_to_root.
tree_unique_path_to_root:

{1} ∀ (g: graph_type, n: (g`nodes), p_{1}, p_{2}: (path?(g))):
tree?(g) ∧ root_path(g, n)(p_{1}) ∧ root_path(g, n)(p_{2}) ⊃ p_{1} = p_{2}

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_list? length_tail car_tail cons_tail root_path Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on length(p1!1) < length(p2!1), we get 2 subgoals:

tree_unique_path_to_root.1:

{-1} length(p′_{1}) < length(p′_{2})
{-2} g′`nodes(n′)
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} tree?(g′)
{-8} roots(g′)(path_start(p′_{1}))
{-9} path_end(p′_{1}) = n′
{-10} roots(g′)(path_start(p′_{2}))
{-11} path_end(p′_{2}) = n′
{1} p′_{1} = p′_{2}

Using lemma path_tail, we get 2 subgoals:

C Proof scripts

tree_unique_path_to_root.1.1:

{-1} length(p′_{2}) − length(p′_{2}) − length(p′_{1}) ≥ 1 ⊃

path?(g′)(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))

{-2} length(p′_{1}) < length(p′_{2})
{-3} g′`nodes(n′)
{-4} length(p′_{1}) ≥ 1
{-5} path?(g′)(p′_{1})
{-6} length(p′_{2}) ≥ 1
{-7} path?(g′)(p′_{2})
{-8} tree?(g′)
{-9} roots(g′)(path_start(p′_{1}))
{-10} path_end(p′_{1}) = n′
{-11} roots(g′)(path_start(p′_{2}))
{-12} path_end(p′_{2}) = n′
{1} p′_{1} = p′_{2}

Simplifying, rewriting, and recording with decision procedures, Using lemma tree_path, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

tree_unique_path_to_root.1.1.1:

{-1} tree?(g′)
{-2} p′_{1} = tail(p′_{2}, length(p′_{2}) − length(p′_{1}))
{-3} path?(g′)(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{-4} length(p′_{1}) < length(p′_{2})
{-5} g′`nodes(n′)
{-6} length(p′_{1}) ≥ 1
{-7} path?(g′)(p′_{1})
{-8} length(p′_{2}) ≥ 1
{-9} path?(g′)(p′_{2})
{-10} roots(g′)(path_start(p′_{1}))
{-11} path_end(p′_{1}) = n′
{-12} roots(g′)(path_start(p′_{2}))
{-13} path_end(p′_{2}) = n′
{1} p′_{1} = p′_{2}

Expanding the definition of roots, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -11 with the terms: nth(p′_{2}, length(p′_{2}) − length(p′_{1}) − 1), we get 2 subgoals:

tree_unique_path_to_root.1.1.1.1:

{-1} tree?(g′)
{-2} p′_{1} = tail(p′_{2}, length(p′_{2}) − length(p′_{1}))
{-3} path?(g′)(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{-4} length(p′_{1}) < length(p′_{2})
{-5} g′`nodes(n′)
{-6} length(p′_{1}) ≥ 1
{-7} path?(g′)(p′_{1})
{-8} length(p′_{2}) ≥ 1
{-9} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))

{-10} ∀ (i: below(length(p′_{2}) − 1)):

g′`edges(nth(p′_{2}, i), nth(p′_{2}, 1 + i))

{-11} path_end(p′_{1}) = n′
{-12} roots(g′)(path_start(p′_{2}))
{-13} path_end(p′_{2}) = n′
{1} g′`edges(nth(p′_{2}, length(p′_{2}) − length(p′_{1}) − 1), path_start(p′_{1}))
{2} p′_{1} = p′_{2}

Instantiating the top quantifier in -10 with the terms: length(p′_{2}) − length(p′_{1}) − 1, Expanding the definition of path_start, Case splitting on car(p1!1) = car(tail(p2!1, length(p2!1) - length(p1!1))), we get 2 subgoals:

tree_unique_path_to_root.1.1.1.1.1:

{-1} car(p′_{1}) = car(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{-2} tree?(g′)
{-3} p′_{1} = tail(p′_{2}, length(p′_{2}) − length(p′_{1}))
{-4} path?(g′)(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{-5} length(p′_{1}) < length(p′_{2})
{-6} g′`nodes(n′)
{-7} length(p′_{1}) ≥ 1
{-8} path?(g′)(p′_{1})
{-9} length(p′_{2}) ≥ 1
{-10} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))

{-11} g′`edges

(nth(p′_{2}, length(p′_{2}) − length(p′_{1}) − 1),

nth(p′_{2}, 1 + length(p′_{2}) − length(p′_{1}) − 1))
{-12} path_end(p′_{1}) = n′
{-13} roots(g′)(path_start(p′_{2}))
{-14} path_end(p′_{2}) = n′
{1} g′`edges(nth(p′_{2}, length(p′_{2}) − 1 − length(p′_{1})), car(p′_{1}))
{2} p′_{1} = p′_{2}

Replacing using formula -1, Hiding formulas: -1, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of tree_unique_path_to_root.1.1.1.1.1.

C Proof scripts

tree_unique_path_to_root.1.1.1.1.2:

{-1} tree?(g′)
{-2} p′_{1} = tail(p′_{2}, length(p′_{2}) − length(p′_{1}))
{-3} path?(g′)(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{-4} length(p′_{1}) < length(p′_{2})
{-5} g′`nodes(n′)
{-6} length(p′_{1}) ≥ 1
{-7} path?(g′)(p′_{1})
{-8} length(p′_{2}) ≥ 1
{-9} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))

{-10} g′`edges

(nth(p′_{2}, length(p′_{2}) − length(p′_{1}) − 1),

nth(p′_{2}, 1 + length(p′_{2}) − length(p′_{1}) − 1))
{-11} path_end(p′_{1}) = n′
{-12} roots(g′)(path_start(p′_{2}))
{-13} path_end(p′_{2}) = n′
{1} car(p′_{1}) = car(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{2} g′`edges(nth(p′_{2}, length(p′_{2}) − 1 − length(p′_{1})), car(p′_{1}))
{3} p′_{1} = p′_{2}

Replacing using formula -2, which is trivially true.

This completes the proof of tree_unique_path_to_root.1.1.1.1.2.
tree_unique_path_to_root.1.1.1.2:

{-1} tree?(g′)
{-2} p′_{1} = tail(p′_{2}, length(p′_{2}) − length(p′_{1}))
{-3} path?(g′)(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{-4} length(p′_{1}) < length(p′_{2})
{-5} g′`nodes(n′)
{-6} length(p′_{1}) ≥ 1
{-7} path?(g′)(p′_{1})
{-8} length(p′_{2}) ≥ 1
{-9} ∀ (i: below(length(p′_{2}))): g′`nodes(nth(p′_{2}, i))

{-10} ∀ (i: below(length(p′_{2}) − 1)):

g′`edges(nth(p′_{2}, i), nth(p′_{2}, 1 + i))

{-11} path_end(p′_{1}) = n′
{-12} roots(g′)(path_start(p′_{2}))
{-13} path_end(p′_{2}) = n′
{1} g′`nodes(nth[T ](p′_{2}, length[T ](p′_{2}) − 1 − length[T ](p′_{1})))
{2} p′_{1} = p′_{2}

Instantiating quantified variables,

This completes the proof of tree_unique_path_to_root.1.1.1.2.

tree_unique_path_to_root.1.1.2:

{-1} tree?(g′)
{-2} path?(g′)(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{-3} length(p′_{1}) < length(p′_{2})
{-4} g′`nodes(n′)
{-5} length(p′_{1}) ≥ 1
{-6} path?(g′)(p′_{1})
{-7} length(p′_{2}) ≥ 1
{-8} path?(g′)(p′_{2})
{-9} roots(g′)(path_start(p′_{1}))
{-10} path_end(p′_{1}) = n′
{-11} roots(g′)(path_start(p′_{2}))
{-12} path_end(p′_{2}) = n′
{1} path_end(p′_{1}) = path_end(tail(p′_{2}, length(p′_{2}) − length(p′_{1})))
{2} p′_{1} = p′_{2}

Installing automatic rewrites from: path_end nth_tail Simplifying, rewriting, and recording with decision procedures,

This completes the proof of tree_unique_path_to_root.1.1.2.
tree_unique_path_to_root.1.2:

{-1} length(p′_{1}) < length(p′_{2})
{-2} g′`nodes(n′)
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} tree?(g′)
{-8} roots(g′)(path_start(p′_{1}))
{-9} path_end(p′_{1}) = n′
{-10} roots(g′)(path_start(p′_{2}))
{-11} path_end(p′_{2}) = n′
{1} length[T ](p′_{2}) − length[T ](p′_{1}) ≥ 0
{2} p′_{1} = p′_{2}

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of tree_unique_path_to_root.1.2.
tree_unique_path_to_root.2:

{-1} g′`nodes(n′)
{-2} length(p′_{1}) ≥ 1
{-3} path?(g′)(p′_{1})
{-4} length(p′_{2}) ≥ 1
{-5} path?(g′)(p′_{2})
{-6} tree?(g′)
{-7} roots(g′)(path_start(p′_{1}))
{-8} path_end(p′_{1}) = n′
{-9} roots(g′)(path_start(p′_{2}))
{-10} path_end(p′_{2}) = n′
{1} length(p′_{1}) < length(p′_{2})
{2} p′_{1} = p′_{2}

Case splitting on length(p1!1) > length(p2!1), we get 2 subgoals:

C Proof scripts

tree_unique_path_to_root.2.1:

{-1} length(p′_{1}) > length(p′_{2})
{-2} g′`nodes(n′)
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} tree?(g′)
{-8} roots(g′)(path_start(p′_{1}))
{-9} path_end(p′_{1}) = n′
{-10} roots(g′)(path_start(p′_{2}))
{-11} path_end(p′_{2}) = n′
{1} length(p′_{1}) < length(p′_{2})
{2} p′_{1} = p′_{2}

Hiding formulas: 1, Using lemma path_tail, we get 2 subgoals:

tree_unique_path_to_root.2.1.1:

{-1} length(p′_{1}) − length(p′_{1}) − length(p′_{2}) ≥ 1 ⊃

path?(g′)(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))

{-2} length(p′_{1}) > length(p′_{2})
{-3} g′`nodes(n′)
{-4} length(p′_{1}) ≥ 1
{-5} path?(g′)(p′_{1})
{-6} length(p′_{2}) ≥ 1
{-7} path?(g′)(p′_{2})
{-8} tree?(g′)
{-9} roots(g′)(path_start(p′_{1}))
{-10} path_end(p′_{1}) = n′
{-11} roots(g′)(path_start(p′_{2}))
{-12} path_end(p′_{2}) = n′
{1} p′_{1} = p′_{2}

Simplifying, rewriting, and recording with decision procedures, Using lemma tree_path, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

tree_unique_path_to_root.2.1.1.1:

{-1} tree?(g′)
{-2} p′_{2} = tail(p′_{1}, length(p′_{1}) − length(p′_{2}))
{-3} path?(g′)(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{-4} length(p′_{1}) > length(p′_{2})
{-5} g′`nodes(n′)
{-6} length(p′_{1}) ≥ 1
{-7} path?(g′)(p′_{1})
{-8} length(p′_{2}) ≥ 1
{-9} path?(g′)(p′_{2})
{-10} roots(g′)(path_start(p′_{1}))
{-11} path_end(p′_{1}) = n′
{-12} roots(g′)(path_start(p′_{2}))
{-13} path_end(p′_{2}) = n′
{1} p′_{1} = p′_{2}

Expanding the definition of roots, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -13 with the terms: nth(p′_{1}, length(p′_{1}) − length(p′_{2}) − 1), we get 2 subgoals:

tree_unique_path_to_root.2.1.1.1.1:

{-1} tree?(g′)
{-2} p′_{2} = tail(p′_{1}, length(p′_{1}) − length(p′_{2}))
{-3} path?(g′)(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{-4} length(p′_{1}) > length(p′_{2})
{-5} g′`nodes(n′)
{-6} length(p′_{1}) ≥ 1
{-7} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))

{-8} ∀ (i: below(length(p′_{1}) − 1)):

g′`edges(nth(p′_{1}, i), nth(p′_{1}, 1 + i))

{-9} length(p′_{2}) ≥ 1
{-10} path?(g′)(p′_{2})
{-11} roots(g′)(path_start(p′_{1}))
{-12} path_end(p′_{1}) = n′
{-13} path_end(p′_{2}) = n′
{1} g′`edges(nth(p′_{1}, length(p′_{1}) − length(p′_{2}) − 1), path_start(p′_{2}))
{2} p′_{1} = p′_{2}

Instantiating the top quantifier in -8 with the terms: length(p′_{1}) − length(p′_{2}) − 1, Expanding the definition of path_start, Case splitting on car(p2!1) = car(tail(p1!1, length(p1!1) - length(p2!1))), we get 2 subgoals:

tree_unique_path_to_root.2.1.1.1.1.1:

{-1} car(p′_{2}) = car(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{-2} tree?(g′)
{-3} p′_{2} = tail(p′_{1}, length(p′_{1}) − length(p′_{2}))
{-4} path?(g′)(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{-5} length(p′_{1}) > length(p′_{2})
{-6} g′`nodes(n′)
{-7} length(p′_{1}) ≥ 1
{-8} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))

{-9} g′`edges

(nth(p′_{1}, length(p′_{1}) − length(p′_{2}) − 1),

nth(p′_{1}, 1 + length(p′_{1}) − length(p′_{2}) − 1))
{-10} length(p′_{2}) ≥ 1
{-11} path?(g′)(p′_{2})
{-12} roots(g′)(path_start(p′_{1}))
{-13} path_end(p′_{1}) = n′
{-14} path_end(p′_{2}) = n′
{1} g′`edges(nth(p′_{1}, length(p′_{1}) − 1 − length(p′_{2})), car(p′_{2}))
{2} p′_{1} = p′_{2}

Replacing using formula -1, Hiding formulas: -1, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of tree_unique_path_to_root.2.1.1.1.1.1.
tree_unique_path_to_root.2.1.1.1.1.2:

{-1} tree?(g′)
{-2} p′_{2} = tail(p′_{1}, length(p′_{1}) − length(p′_{2}))
{-3} path?(g′)(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{-4} length(p′_{1}) > length(p′_{2})
{-5} g′`nodes(n′)
{-6} length(p′_{1}) ≥ 1
{-7} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))

{-8} g′`edges

(nth(p′_{1}, length(p′_{1}) − length(p′_{2}) − 1),

nth(p′_{1}, 1 + length(p′_{1}) − length(p′_{2}) − 1))
{-9} length(p′_{2}) ≥ 1
{-10} path?(g′)(p′_{2})
{-11} roots(g′)(path_start(p′_{1}))
{-12} path_end(p′_{1}) = n′
{-13} path_end(p′_{2}) = n′
{1} car(p′_{2}) = car(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{2} g′`edges(nth(p′_{1}, length(p′_{1}) − 1 − length(p′_{2})), car(p′_{2}))
{3} p′_{1} = p′_{2}

Replacing using formula -2, which is trivially true.

This completes the proof of tree_unique_path_to_root.2.1.1.1.1.2.

C.97 Proofs for Graph (graph.pvs)

tree_unique_path_to_root.2.1.1.1.2:

{-1} tree?(g′)
{-2} p′_{2} = tail(p′_{1}, length(p′_{1}) − length(p′_{2}))
{-3} path?(g′)(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{-4} length(p′_{1}) > length(p′_{2})
{-5} g′`nodes(n′)
{-6} length(p′_{1}) ≥ 1
{-7} ∀ (i: below(length(p′_{1}))): g′`nodes(nth(p′_{1}, i))

{-8} ∀ (i: below(length(p′_{1}) − 1)):

g′`edges(nth(p′_{1}, i), nth(p′_{1}, 1 + i))

{-9} length(p′_{2}) ≥ 1
{-10} path?(g′)(p′_{2})
{-11} roots(g′)(path_start(p′_{1}))
{-12} path_end(p′_{1}) = n′
{-13} path_end(p′_{2}) = n′
{1} g′`nodes(nth[T ](p′_{1}, length[T ](p′_{1}) − 1 − length[T ](p′_{2})))
{2} p′_{1} = p′_{2}

Instantiating quantified variables,

This completes the proof of tree_unique_path_to_root.2.1.1.1.2.
tree_unique_path_to_root.2.1.1.2:

{-1} tree?(g′)
{-2} path?(g′)(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{-3} length(p′_{1}) > length(p′_{2})
{-4} g′`nodes(n′)
{-5} length(p′_{1}) ≥ 1
{-6} path?(g′)(p′_{1})
{-7} length(p′_{2}) ≥ 1
{-8} path?(g′)(p′_{2})
{-9} roots(g′)(path_start(p′_{1}))
{-10} path_end(p′_{1}) = n′
{-11} roots(g′)(path_start(p′_{2}))
{-12} path_end(p′_{2}) = n′
{1} path_end(p′_{2}) = path_end(tail(p′_{1}, length(p′_{1}) − length(p′_{2})))
{2} p′_{1} = p′_{2}

Installing automatic rewrites from: path_end nth_tail Simplifying, rewriting, and recording with decision procedures,

This completes the proof of tree_unique_path_to_root.2.1.1.2.

tree_unique_path_to_root.2.1.2:

{-1} length(p′_{1}) > length(p′_{2})
{-2} g′`nodes(n′)
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} tree?(g′)
{-8} roots(g′)(path_start(p′_{1}))
{-9} path_end(p′_{1}) = n′
{-10} roots(g′)(path_start(p′_{2}))
{-11} path_end(p′_{2}) = n′
{1} length[T ](p′_{1}) − length[T ](p′_{2}) ≥ 0
{2} p′_{1} = p′_{2}

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of tree_unique_path_to_root.2.1.2.
tree_unique_path_to_root.2.2:

{-1} g′`nodes(n′)
{-2} length(p′_{1}) ≥ 1
{-3} path?(g′)(p′_{1})
{-4} length(p′_{2}) ≥ 1
{-5} path?(g′)(p′_{2})
{-6} tree?(g′)
{-7} roots(g′)(path_start(p′_{1}))
{-8} path_end(p′_{1}) = n′
{-9} roots(g′)(path_start(p′_{2}))
{-10} path_end(p′_{2}) = n′
{1} length(p′_{1}) > length(p′_{2})
{2} length(p′_{1}) < length(p′_{2})
{3} p′_{1} = p′_{2}

Rewriting using tree_path, matching in *,

This completes the proof of tree_unique_path_to_root.2.2.

Q.E.D.

C.97.26 Graph.root_path_singleton

Terse proof for root_path_singleton.
root_path_singleton:

{1} ∀ (g: graph_type, n: (g`nodes)): finite_tree?(g) ⊃ singleton?(root_path(g, n))

Repeatedly Skolemizing and flattening, Expanding the definition of singleton?, Using lemma tree_path_to_root, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly Skolemizing and flattening, Using lemma tree_unique_path_to_root, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of finite_tree?, which is trivially true. This completes the proof of root_path_singleton. Q.E.D.

C.97.27 Graph.path_to_root_TCC1

Terse proof for path_to_root_TCC1.
path_to_root_TCC1:

{1} ∀ (g: (finite_tree?), n: (g`nodes)): singleton?[((path?(g)))](root_path(g, n))

Repeatedly Skolemizing and flattening, Rewriting using root_path_singleton, matching in *, This completes the proof of path_to_root_TCC1. Q.E.D.

C.97.28 Graph.path_factor_TCC1

Terse proof for path_factor_TCC1.
path_factor_TCC1:

{1} ∀ (g: graph_type, p_{1}, p_{2}: (path?(g))):

(path_start(p_{1}) = path_start(p_{2}) ∧

(∃ (n: nat):

n < length(p_{1}) ∧ n < length(p_{2}) ∧ ¬ nth(p_{1}, n) = nth(p_{2}, n))) ⊃ (∀ (q, p1t, p2t: (path?(g))):

p_{2} = concat_path(q, p2t) ∧ p_{1} = concat_path(q, p1t) ∧ length(p2t) ≥ 2 ∧ length(p1t) ≥ 2 ∧ concatable?(q, p2t) ∧ concatable?(q, p1t)

⊃ 0 < length[T ](p1t))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of path_factor_TCC1. Q.E.D.

C.97.29 Graph.path_factor_TCC2

Terse proof for path_factor_TCC2.

path_factor_TCC2:

{1} ∀ (g: graph_type, p_{1}, p_{2}: (path?(g))):

(path_start(p_{1}) = path_start(p_{2}) ∧

(∃ (n: nat):

n < length(p_{1}) ∧ n < length(p_{2}) ∧ ¬ nth(p_{1}, n) = nth(p_{2}, n))) ⊃ (∀ (q, p1t, p2t: (path?(g))):

p_{2} = concat_path(q, p2t) ∧ p_{1} = concat_path(q, p1t) ∧ length(p2t) ≥ 2 ∧ length(p1t) ≥ 2 ∧ concatable?(q, p2t) ∧ concatable?(q, p1t)

⊃ 0 < length[T ](p2t))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of path_factor_TCC2.

Q.E.D.

C.97.30 Graph.path_factor_TCC3

Terse proof for path_factor_TCC3.
path_factor_TCC3:

{1} ∀ (g: graph_type, p_{1}, p_{2}: (path?(g))):

(path_start(p_{1}) = path_start(p_{2}) ∧

(∃ (n: nat):

n < length(p_{1}) ∧ n < length(p_{2}) ∧ ¬ nth(p_{1}, n) = nth(p_{2}, n))) ⊃ (∀ (q, p1t, p2t: (path?(g))):

nth(p1t, 0) = nth(p2t, 0) ∧ p_{2} = concat_path(q, p2t) ∧ p_{1} = concat_path(q, p1t) ∧ length(p2t) ≥ 2 ∧ length(p1t) ≥ 2 ∧ concatable?(q, p2t) ∧ concatable?(q, p1t)

⊃ 1 < length[T ](p1t))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of path_factor_TCC3.

Q.E.D.

C.97.31 Graph.path_factor_TCC4

Terse proof for path_factor_TCC4.

path_factor_TCC4:

{1} ∀ (g: graph_type, p_{1}, p_{2}: (path?(g))):

(path_start(p_{1}) = path_start(p_{2}) ∧

(∃ (n: nat):

n < length(p_{1}) ∧ n < length(p_{2}) ∧ ¬ nth(p_{1}, n) = nth(p_{2}, n)))

⊃

(∀ (q, p1t, p2t: (path?(g))): nth(p1t, 0) = nth(p2t, 0) ∧ p_{2} = concat_path(q, p2t) ∧ p_{1} = concat_path(q, p1t) ∧ length(p2t) ≥ 2 ∧ length(p1t) ≥ 2 ∧ concatable?(q, p2t) ∧ concatable?(q, p1t)

⊃ 1 < length[T ](p2t))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of path_factor_TCC4.

Q.E.D.

C.97.32 Graph.path_factor

Terse proof for path_factor.

path_factor:

{1} ∀ (g: graph_type, p_{1}, p_{2}: (path?(g))):

(path_start(p_{1}) = path_start(p_{2}) ∧

(∃ (n: nat):

n < length(p_{1}) ∧ n < length(p_{2}) ∧ ¬ nth(p_{1}, n) = nth(p_{2}, n)))

⊃

(∃ (q, p1t, p2t: (path?(g))): concatable?(q, p1t) ∧ concatable?(q, p2t) ∧ length(p1t) ≥ 2 ∧ length(p2t) ≥ 2 ∧ p_{1} = concat_path(q, p1t) ∧ p_{2} = concat_path(q, p2t) ∧ nth(p1t, 0) = nth(p2t, 0) ∧ ¬ nth(p1t, 1) = nth(p2t, 1))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: concatable? concat_path head_tail path_list? length_head length_tail path_end path_start nth_tail car_tail cdr_tail path_tail path_head nth_head

Simplifying, rewriting, and recording with decision procedures,

Letting nd name min(LAMBDA (i: nat): i < length(p1!1) AND i < length(p2!1) AND NOT nth(p1!1,

i) = nth(p2!1, i)),

we get 2 subgoals:

path_factor.1:

{-1} min(λ (i: nat):
i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))

= nd {-2} n′ ≥ 0

{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} nth(p′_{1}, n′) = nth(p′_{2}, n′)
{2} ∃ (q, p1t, p2t: (path?(g′))):

nth(q, length(q) − 1) = car(p1t) ∧ nth(q, length(q) − 1) = car(p2t) ∧ length(p1t) ≥ 2 ∧ length(p2t) ≥ 2 ∧ p′_{1} = append(q, cdr(p1t)) ∧ p′_{2} = append(q, cdr(p2t)) ∧ nth(p1t, 0) = nth(p2t, 0) ∧ ¬ nth(p1t, 1) = nth(p2t, 1)

Rewriting using min_def, matching in *, Case splitting on nd = 0, we get 2 subgoals:

path_factor.1.1:

{-1} nd = 0

{-2} minimum?(nd,

λ (i: nat):

i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))

{-3} n′ ≥ 0
{-4} length(p′_{1}) ≥ 1
{-5} path?(g′)(p′_{1})
{-6} length(p′_{2}) ≥ 1
{-7} path?(g′)(p′_{2})
{-8} car(p′_{1}) = car(p′_{2})
{-9} n′ < length(p′_{1})
{-10} n′ < length(p′_{2})
{1} nth(p′_{1}, n′) = nth(p′_{2}, n′)

{2} ∃ (q, p1t, p2t: (path?(g′))): nth(q, length(q) − 1) = car(p1t) ∧ nth(q, length(q) − 1) = car(p2t) ∧ length(p1t) ≥ 2 ∧ length(p2t) ≥ 2 ∧ p′_{1} = append(q, cdr(p1t)) ∧ p′_{2} = append(q, cdr(p2t)) ∧ nth(p1t, 0) = nth(p2t, 0) ∧ ¬ nth(p1t, 1) = nth(p2t, 1)

Hiding formulas: -2, 2, Adding type constraints for nd, Installing automatic rewrites from: nth Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.1.

path_factor.1.2:

{-1} minimum?(nd,

λ (i: nat):

i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} nd = 0
{2} nth(p′_{1}, n′) = nth(p′_{2}, n′)

{3} ∃ (q, p1t, p2t: (path?(g′))):

nth(q, length(q) − 1) = car(p1t) ∧ nth(q, length(q) − 1) = car(p2t) ∧ length(p1t) ≥ 2 ∧ length(p2t) ≥ 2 ∧ p′_{1} = append(q, cdr(p1t)) ∧ p′_{2} = append(q, cdr(p2t)) ∧ nth(p1t, 0) = nth(p2t, 0) ∧ ¬ nth(p1t, 1) = nth(p2t, 1)

Instantiating the top quantifier in 3 with the terms: head(p′_{1}, nd), tail(p′_{1}, nd − 1), tail(p′_{2}, nd − 1), we get 6 subgoals:

path_factor.1.2.1:

{-1} minimum?(nd,

λ (i: nat):

i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} nd = 0
{2} nth(p′_{1}, n′) = nth(p′_{2}, n′)

{3} nth(head(p′_{1}, nd), length(head(p′_{1}, nd)) − 1) = car(tail(p′_{1}, nd − 1))

∧
nth(head(p′_{1}, nd), length(head(p′_{1}, nd)) − 1) =
car(tail(p′_{2}, nd − 1))
∧
length(tail(p′_{1}, nd − 1)) ≥ 2 ∧
length(tail(p′_{2}, nd − 1)) ≥ 2 ∧
p′_{1} = append(head(p′_{1}, nd), cdr(tail(p′_{1}, nd − 1))) ∧
p′_{2} = append(head(p′_{1}, nd), cdr(tail(p′_{2}, nd − 1))) ∧
nth(tail(p′_{1}, nd − 1), 0) = nth(tail(p′_{2}, nd − 1), 0) ∧
¬ nth(tail(p′_{1}, nd − 1), 1) = nth(tail(p′_{2}, nd − 1), 1)

C Proof scripts

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of minimum?, Applying propositional simplification, we get 3 subgoals:

path_factor.1.2.1.1:

{-1} ∀ (x: nat):

x < length(p′_{1}) ∧ x < length(p′_{2}) ∧ ¬ nth(p′_{1}, x) = nth(p′_{2}, x) ⊃ nd ≤ x

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} nth(p′_{1}, nd − 1) = nth(p′_{2}, nd − 1)
{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Instantiating the top quantifier in -1 with the terms: nd − 1, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.1.1.

path_factor.1.2.1.2:

{-1} ∀ (x: nat):

x < length(p′_{1}) ∧ x < length(p′_{2}) ∧ ¬ nth(p′_{1}, x) = nth(p′_{2}, x) ⊃ nd ≤ x

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} p′_{2} = append(head(p′_{1}, nd), tail(p′_{2}, nd))
{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Using lemma list_extensionality, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

C.97 Proofs for Graph (graph.pvs)

path_factor.1.2.1.2.1:

{-1} head(p′_{1}, nd) = head(p′_{2}, nd)
{-2} nd = nd

{-3} ∀ (i: below(length[T ](head(p′_{1}, nd)))):

nth(head(p′_{1}, nd), i) = nth(head(p′_{2}, nd), i)

{-4} ∀ (x: nat):

x < length(p′_{1}) ∧ x < length(p′_{2}) ∧ ¬ nth(p′_{1}, x) = nth(p′_{2}, x) ⊃ nd ≤ x

{-5} n′ ≥ 0
{-6} length(p′_{1}) ≥ 1
{-7} path?(g′)(p′_{1})
{-8} length(p′_{2}) ≥ 1
{-9} path?(g′)(p′_{2})
{-10} car(p′_{1}) = car(p′_{2})
{-11} n′ < length(p′_{1})
{-12} n′ < length(p′_{2})
{1} p′_{2} = append(head(p′_{1}, nd), tail(p′_{2}, nd))
{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.1.2.1.

path_factor.1.2.1.2.2:

{-1} ∀ (x: nat):

x < length(p′_{1}) ∧ x < length(p′_{2}) ∧ ¬ nth(p′_{1}, x) = nth(p′_{2}, x) ⊃ nd ≤ x

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} head(p′_{1}, nd) = head(p′_{2}, nd)

{2} ∀ (i: below(length[T ](head(p′_{1}, nd)))):

nth(head(p′_{1}, nd), i) = nth(head(p′_{2}, nd), i)

{3} p′_{2} = append(head(p′_{1}, nd), tail(p′_{2}, nd))
{4} nd = 0
{5} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: i′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.1.2.2.

path_factor.1.2.1.3:

{-1} ∀ (x: nat):

x < length(p′_{1}) ∧ x < length(p′_{2}) ∧ ¬ nth(p′_{1}, x) = nth(p′_{2}, x) ⊃ nd ≤ x

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} nth(p′_{1}, nd − 1) = nth(p′_{2}, nd − 1)
{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Instantiating the top quantifier in -1 with the terms: nd − 1, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.1.3.

path_factor.1.2.2:

{-1} minimum?(nd,

λ (i: nat):

i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})

{1} length(tail[T ](p′_{2}, nd − 1)) ≥ 1 ∧

path?(g′)(tail[T ](p′_{2}, nd − 1))

{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.2.

path_factor.1.2.3:

{-1} minimum?(nd,

λ (i: nat):

i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))
{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} nd − 1 ≥ 0
{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

C.97 Proofs for Graph (graph.pvs)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.3.

path_factor.1.2.4:

{-1} minimum?(nd,

λ (i: nat):

i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})

{1} length(tail[T ](p′_{1}, nd − 1)) ≥ 1 ∧

path?(g′)(tail[T ](p′_{1}, nd − 1))

{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.4.

path_factor.1.2.5:

{-1} minimum?(nd,

λ (i: nat):

i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} nd − 1 ≥ 0
{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.5.

path_factor.1.2.6:

{-1} minimum?(nd,

λ (i: nat):

i < length(p′_{1}) ∧ i < length(p′_{2}) ∧ ¬ nth(p′_{1}, i) = nth(p′_{2}, i))

{-2} n′ ≥ 0
{-3} length(p′_{1}) ≥ 1
{-4} path?(g′)(p′_{1})
{-5} length(p′_{2}) ≥ 1
{-6} path?(g′)(p′_{2})
{-7} car(p′_{1}) = car(p′_{2})
{-8} n′ < length(p′_{1})
{-9} n′ < length(p′_{2})
{1} nd ≥ 1 ∧ path?(g′)(head[T ](p′_{1}, nd))
{2} nd = 0
{3} nth(p′_{1}, n′) = nth(p′_{2}, n′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.1.2.6.

path_factor.2:

{-1} n′ ≥ 0
{-2} length(p′_{1}) ≥ 1
{-3} path?(g′)(p′_{1})
{-4} length(p′_{2}) ≥ 1
{-5} path?(g′)(p′_{2})
{-6} car(p′_{1}) = car(p′_{2})
{-7} n′ < length(p′_{1})
{-8} n′ < length(p′_{2})

{1} nonempty?[nat]

(λ (i: nat):

i < length[T ](p′_{1}) ∧

i < length[T ](p′_{2}) ∧ ¬ nth[T ](p′_{1}, i) = nth[T ](p′_{2}, i))

{2} nth(p′_{1}, n′) = nth(p′_{2}, n′)

{3} ∃ (q, p1t, p2t: (path?(g′))):

nth(q, length(q) − 1) = car(p1t) ∧ nth(q, length(q) − 1) = car(p2t) ∧ length(p1t) ≥ 2 ∧ length(p2t) ≥ 2 ∧ p′_{1} = append(q, cdr(p1t)) ∧ p′_{2} = append(q, cdr(p2t)) ∧ nth(p1t, 0) = nth(p2t, 0) ∧ ¬ nth(p1t, 1) = nth(p2t, 1)

Hiding formulas: 3, Installing automatic rewrites from: nonempty? empty? member Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_factor.2. Q.E.D.

C.97.33 Graph.node_pair_distinction_TCC1

Terse proof for node_pair_distinction_TCC1.

C.97 Proofs for Graph (graph.pvs)

node_pair_distinction_TCC1:

{1} ∀ (g: graph_type, P: PRED[[(g`nodes), (g`nodes)]]): (∀ (n_{1}, n_{2}: (g`nodes), p_{1}, p_{2}: (path?(g))): ¬ n_{1} = n_{2} ∧ root_path(g, n_{1})(p_{1}) ∧ root_path(g, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2}) ⊃ P (n_{1}, n_{2})) ∧ (∀ (n_{1}, n_{2}: (g`nodes), p: (path?(g))): ¬ n_{1} = n_{2} ∧ path_start(p) = n_{1} ∧ path_end(p) = n_{2} ∧ length(p) ≥ 2 ⊃ P (n_{1}, n_{2})) ∧ (∀ (n_{1}, n_{2}: (g`nodes), p: (path?(g))): ¬ n_{1} = n_{2} ∧ path_start(p) = n_{2} ∧ path_end(p) = n_{1} ∧ length(p) ≥ 2 ⊃ P (n_{1}, n_{2})) ∧ (∀ (n: (g`nodes)): P (n, n)) ∧ finite_tree?(g) ⊃ (∀ (n_{11}, n_{21}, n_{3}: (g`nodes), p_{11}, p_{21}: (path?(g))): g`edges(n_{3}, path_start(p_{11})) ∧ ¬ n_{21} = n_{3} ∧ ¬ n_{11} = n_{3} ∧ ¬ n_{11} = n_{21} ⊃ g`nodes(path_start[T ](p_{21})))

Repeatedly Skolemizing and flattening, Rewriting using nodes_path_start, matching in *,

This completes the proof of node_pair_distinction_TCC1.

Q.E.D.

C.97.34 Graph.node_pair_distinction

Terse proof for node_pair_distinction.

node_pair_distinction:

{1} ∀ (g: graph_type, P: PRED[[(g`nodes), (g`nodes)]]):

(finite_tree?(g) ∧ (∀ (n: (g`nodes)): P (n, n)) ∧ (∀ (n_{1}, n_{2}: (g`nodes), p: (path?(g))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{2} ∧ path_end(p) = n_{1} ∧ length(p) ≥ 2 ⊃

P (n_{1}, n_{2}))
∧

(∀ (n_{1}, n_{2}: (g`nodes), p: (path?(g))): ¬ n_{1} = n_{2} ∧ path_start(p) = n_{1} ∧ path_end(p) = n_{2} ∧ length(p) ≥ 2 ⊃

P (n_{1}, n_{2}))
∧

(∀ (n_{1}, n_{2}: (g`nodes), p_{1}, p_{2}: (path?(g))):

¬ n_{1} = n_{2} ∧

root_path(g, n_{1})(p_{1}) ∧ root_path(g, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P (n_{1}, n_{2}))
∧

(∀ (n_{1}, n_{2}, n_{3}: (g`nodes), p_{1}, p_{2}: (path?(g))):

¬ n_{1} = n_{2} ∧
¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧

g`edges(n_{3}, path_start(p_{1})) ∧ g`edges(n_{3}, path_start(p_{2})) ∧ path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P (n_{1}, n_{2})))

⊃ (∀ (n_{1}, n_{2}: (g`nodes)): P (n_{1}, n_{2}))

Repeatedly Skolemizing and flattening,

Case splitting on n1!1 = n2!1,

we get 2 subgoals:

C.97 Proofs for Graph (graph.pvs)

node_pair_distinction.1:

{-1} n′_{1} = n′_{2}
{-2} g′`nodes(n′_{1})
{-3} g′`nodes(n′_{2})
{-4} finite_tree?(g′)
{-5} ∀ (n: (g′`nodes)): P′(n, n)

{-6} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{2} ∧ path_end(p) = n_{1} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})

{-7} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{1} ∧ path_end(p) = n_{2} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})

{-8} ∀ (n_{1}, n_{2}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

root_path(g′, n_{1})(p_{1}) ∧

root_path(g′, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})

{-9} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, path_start(p_{1})) ∧
g′`edges(n_{3}, path_start(p_{2})) ∧

path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{1} P′(n′_{1}, n′_{2})

Instantiating the top quantifier in -5 with the terms: n′_{1}, Simplifying, rewriting, and recording with decision procedures, This completes the proof of node_pair_distinction.1.

C Proof scripts

node_pair_distinction.2:

{-1} g′`nodes(n′_{1})
{-2} g′`nodes(n′_{2})
{-3} finite_tree?(g′)
{-4} ∀ (n: (g′`nodes)): P′(n, n)

{-5} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{2} ∧ path_end(p) = n_{1} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})

{-6} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{1} ∧ path_end(p) = n_{2} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})

{-7} ∀ (n_{1}, n_{2}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

root_path(g′, n_{1})(p_{1}) ∧

root_path(g′, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})

{-8} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, path_start(p_{1})) ∧
g′`edges(n_{3}, path_start(p_{2})) ∧

path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{1} n′_{1} = n′_{2}
{2} P′(n′_{1}, n′_{2})

Hiding formulas: -4, Simplifying, rewriting, and recording with decision procedures, Letting rp1 name path_to_root(g!1, n1!1), Letting rp2 name path_to_root(g!1, n2!1), Case splitting on EXISTS (i: below(length(rp1))): nth(rp1, i) = n2!1, we get 2 subgoals:

C.97 Proofs for Graph (graph.pvs)

node_pair_distinction.2.1:

{-1} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{-2} path_to_root(g′, n′_{2}) = rp2
{-3} path_to_root(g′, n′_{1}) = rp1
{-4} g′`nodes(n′_{1})
{-5} g′`nodes(n′_{2})
{-6} finite_tree?(g′)
{-7} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{2} ∧ path_end(p) = n_{1} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})
{-8} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{1} ∧ path_end(p) = n_{2} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})
{-9} ∀ (n_{1}, n_{2}: (g′`nodes), p_{1}, p_{2}: (path?(g′))):
¬ n_{1} = n_{2} ∧
root_path(g′, n_{1})(p_{1}) ∧

root_path(g′, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{-10} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))):
¬ n_{1} = n_{2} ∧
¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, path_start(p_{1})) ∧
g′`edges(n_{3}, path_start(p_{2})) ∧

path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{1} n′_{1} = n′_{2}
{2} P′(n′_{1}, n′_{2})

Repeatedly Skolemizing and flattening, Adding type constraints for rp1, Expanding the definition of root_path, Applying disjunctive simplification to flatten sequent, Hiding formulas: -2, -3, Installing automatic rewrites from: path_start path_end path_tail nth_tail car_tail length_tail

path_list? Instantiating the top quantifier in -10 with the terms: n′_{1}, n′_{2}, tail(rp1, i′), Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.1.

C Proof scripts

node_pair_distinction.2.2:

{-1} path_to_root(g′, n′_{2}) = rp2
{-2} path_to_root(g′, n′_{1}) = rp1
{-3} g′`nodes(n′_{1})
{-4} g′`nodes(n′_{2})
{-5} finite_tree?(g′)

{-6} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{2} ∧ path_end(p) = n_{1} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})

{-7} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{1} ∧ path_end(p) = n_{2} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})

{-8} ∀ (n_{1}, n_{2}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

root_path(g′, n_{1})(p_{1}) ∧

root_path(g′, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})

{-9} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, path_start(p_{1})) ∧
g′`edges(n_{3}, path_start(p_{2})) ∧

path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{1} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{2} n′_{1} = n′_{2}
{3} P′(n′_{1}, n′_{2})

Hiding formulas: -6, Case splitting on EXISTS (i: below(length(rp2))): nth(rp2, i) = n1!1, we get 2 subgoals:

C.97 Proofs for Graph (graph.pvs)

node_pair_distinction.2.2.1:

{-1} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{-2} path_to_root(g′, n′_{2}) = rp2
{-3} path_to_root(g′, n′_{1}) = rp1
{-4} g′`nodes(n′_{1})
{-5} g′`nodes(n′_{2})
{-6} finite_tree?(g′)
{-7} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{1} ∧ path_end(p) = n_{2} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})
{-8} ∀ (n_{1}, n_{2}: (g′`nodes), p_{1}, p_{2}: (path?(g′))):
¬ n_{1} = n_{2} ∧
root_path(g′, n_{1})(p_{1}) ∧

root_path(g′, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{-9} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))):
¬ n_{1} = n_{2} ∧
¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, path_start(p_{1})) ∧
g′`edges(n_{3}, path_start(p_{2})) ∧

path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{1} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{2} n′_{1} = n′_{2}
{3} P′(n′_{1}, n′_{2})

Repeatedly Skolemizing and flattening, Adding type constraints for rp2, Expanding the definition of root_path, Applying disjunctive simplification to flatten sequent, Hiding formulas: -2, -3, Installing automatic rewrites from: path_start path_end path_tail nth_tail car_tail length_tail

path_list? Instantiating the top quantifier in -10 with the terms: n′_{1}, n′_{2}, tail(rp2, i′), Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.1.

C Proof scripts

node_pair_distinction.2.2.2:

{-1} path_to_root(g′, n′_{2}) = rp2
{-2} path_to_root(g′, n′_{1}) = rp1
{-3} g′`nodes(n′_{1})
{-4} g′`nodes(n′_{2})
{-5} finite_tree?(g′)

{-6} ∀ (n_{1}, n_{2}: (g′`nodes), p: (path?(g′))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{1} ∧ path_end(p) = n_{2} ∧ length(p) ≥ 2 ⊃

P′(n_{1}, n_{2})

{-7} ∀ (n_{1}, n_{2}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

root_path(g′, n_{1})(p_{1}) ∧

root_path(g′, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})

{-8} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, path_start(p_{1})) ∧
g′`edges(n_{3}, path_start(p_{2})) ∧

path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{1} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{2} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{3} n′_{1} = n′_{2}
{4} P′(n′_{1}, n′_{2})

Hiding formulas: -6, Case splitting on path_start(rp1) = path_start(rp2), we get 2 subgoals:

C.97 Proofs for Graph (graph.pvs)

node_pair_distinction.2.2.2.1:

{-1} path_start(rp1) = path_start(rp2)
{-2} path_to_root(g′, n′_{2}) = rp2
{-3} path_to_root(g′, n′_{1}) = rp1
{-4} g′`nodes(n′_{1})
{-5} g′`nodes(n′_{2})
{-6} finite_tree?(g′)

{-7} ∀ (n_{1}, n_{2}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

root_path(g′, n_{1})(p_{1}) ∧

root_path(g′, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})

{-8} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))): ¬ n_{1} = n_{2} ∧

¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, path_start(p_{1})) ∧
g′`edges(n_{3}, path_start(p_{2})) ∧

path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{1} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{2} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{3} n′_{1} = n′_{2}
{4} P′(n′_{1}, n′_{2})

Hiding formulas: -7, Installing automatic rewrites from: path_list? length_cdr path_start nth path_end concat_path

nth_append_right length_append nth_append_left Using lemma path_factor, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

node_pair_distinction.2.2.2.1.1:

{-1} car(rp1) = car(rp2)
{-2} ∃ (q, p1t, p2t: (path?(g′))):

concatable?(q, p1t) ∧ concatable?(q, p2t) ∧ length(p1t) ≥ 2 ∧ length(p2t) ≥ 2 ∧ rp1 = append(q, cdr(p1t)) ∧ rp2 = append(q, cdr(p2t)) ∧ car(p1t) = car(p2t) ∧ ¬ car(cdr(p1t)) = car(cdr(p2t))

{-3} path_to_root(g′, n′_{2}) = rp2
{-4} path_to_root(g′, n′_{1}) = rp1
{-5} g′`nodes(n′_{1})
{-6} g′`nodes(n′_{2})
{-7} finite_tree?(g′)
{-8} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))):
¬ n_{1} = n_{2} ∧
¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧

g′`edges(n_{3}, car(p_{1})) ∧ g′`edges(n_{3}, car(p_{2})) ∧ nth(p_{1}, length(p_{1}) − 1) = n_{1} ∧ nth(p_{2}, length(p_{2}) − 1) = n_{2} ∧ ¬ car(p_{1}) = car(p_{2})

⊃ P′(n_{1}, n_{2})
{1} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{2} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{3} n′_{1} = n′_{2}
{4} P′(n′_{1}, n′_{2})

Repeatedly Skolemizing and flattening,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -3, -5,

Using lemma path_cdr,

Using lemma path_cdr,

Simplifying, rewriting, and recording with decision procedures,

Instantiating the top quantifier in -20 with the terms: n′_{1}, n′_{2}, car(p1t′), cdr(p1t′), cdr(p2t′),

we get 2 subgoals:

node_pair_distinction.2.2.2.1.1.1:

{-1} path?(g′)(cdr(p2t′))
{-2} path?(g′)(cdr(p1t′))
{-3} length(q′) ≥ 1
{-4} path?(g′)(q′)
{-5} path?(g′)(p1t′)
{-6} path?(g′)(p2t′)
{-7} car(rp1) = car(rp2)
{-8} concatable?(q′, p1t′)
{-9} concatable?(q′, p2t′)
{-10} length(p1t′) ≥ 2
{-11} length(p2t′) ≥ 2
{-12} rp1 = append(q′, cdr(p1t′))
{-13} rp2 = append(q′, cdr(p2t′))
{-14} car(p1t′) = car(p2t′)
{-15} path_to_root(g′, n′_{2}) = rp2
{-16} path_to_root(g′, n′_{1}) = rp1
{-17} g′`nodes(n′_{1})
{-18} g′`nodes(n′_{2})
{-19} finite_tree?(g′)

{-20} ¬ n′_{1} = n′_{2} ∧ ¬ n′_{1} = car(p1t′) ∧ ¬ n′_{2} = car(p1t′) ∧ g′`edges(car(p1t′), car(cdr(p1t′))) ∧ g′`edges(car(p1t′), car(cdr(p2t′))) ∧ nth(cdr(p1t′), length(cdr(p1t′)) − 1) = n′_{1} ∧ nth(cdr(p2t′), length(cdr(p2t′)) − 1) = n′_{2} ∧ ¬ car(cdr(p1t′)) = car(cdr(p2t′))

⊃ P′(n′_{1}, n′_{2})

{1} car(cdr(p1t′)) = car(cdr(p2t′))
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} P′(n′_{1}, n′_{2})

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 6 subgoals:

node_pair_distinction.2.2.2.1.1.1.1:

{-1} path?(g′)(cdr(p2t′))
{-2} path?(g′)(cdr(p1t′))
{-3} length(q′) ≥ 1
{-4} path?(g′)(q′)
{-5} path?(g′)(p1t′)
{-6} path?(g′)(p2t′)
{-7} car(rp1) = car(rp2)
{-8} concatable?(q′, p1t′)
{-9} concatable?(q′, p2t′)
{-10} length(p1t′) ≥ 2
{-11} length(p2t′) ≥ 2
{-12} rp1 = append(q′, cdr(p1t′))
{-13} rp2 = append(q′, cdr(p2t′))
{-14} car(p1t′) = car(p2t′)
{-15} path_to_root(g′, n′_{2}) = rp2
{-16} path_to_root(g′, n′_{1}) = rp1
{-17} g′`nodes(n′_{1})
{-18} g′`nodes(n′_{2})
{-19} finite_tree?(g′)
{-20} n′_{1} = car(p1t′)
{1} car(cdr(p1t′)) = car(cdr(p2t′))
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} P′(n′_{1}, n′_{2})

Keeping (-4 -6 -9 -11 -13 -14 -20 2) and hiding *, Expanding the definition of concatable?, Replacing using formula -5, Instantiating the top quantifier in 1 with the terms: length(q′) − 1, we get 2 subgoals:

node_pair_distinction.2.2.2.1.1.1.1.1:

{-1} path?(g′)(q′)
{-2} path?(g′)(p2t′)
{-3} path_end(q′) = path_start(p2t′)
{-4} length(p2t′) ≥ 2
{-5} rp2 = append(q′, cdr(p2t′))
{-6} car(p1t′) = car(p2t′)
{-7} n′_{1} = car(p1t′)
{1} nth(append(q′, cdr(p2t′)), length(q′) − 1) = n′_{1}

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.1.1.1.

node_pair_distinction.2.2.2.1.1.1.1.2:

{-1} path?(g′)(q′)
{-2} path?(g′)(p2t′)
{-3} path_end(q′) = path_start(p2t′)
{-4} length(p2t′) ≥ 2
{-5} rp2 = append(q′, cdr(p2t′))
{-6} car(p1t′) = car(p2t′)
{-7} n′_{1} = car(p1t′)
{1} length[T ](q′) − 1 < length[T ](rp2)

Replacing using formula -5, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.1.1.2.
node_pair_distinction.2.2.2.1.1.1.2:

{-1} path?(g′)(cdr(p2t′))
{-2} path?(g′)(cdr(p1t′))
{-3} length(q′) ≥ 1
{-4} path?(g′)(q′)
{-5} path?(g′)(p1t′)
{-6} path?(g′)(p2t′)
{-7} car(rp1) = car(rp2)
{-8} concatable?(q′, p1t′)
{-9} concatable?(q′, p2t′)
{-10} length(p1t′) ≥ 2
{-11} length(p2t′) ≥ 2
{-12} rp1 = append(q′, cdr(p1t′))
{-13} rp2 = append(q′, cdr(p2t′))
{-14} car(p1t′) = car(p2t′)
{-15} path_to_root(g′, n′_{2}) = rp2
{-16} path_to_root(g′, n′_{1}) = rp1
{-17} g′`nodes(n′_{1})
{-18} g′`nodes(n′_{2})
{-19} finite_tree?(g′)
{-20} n′_{2} = car(p1t′)
{1} car(cdr(p1t′)) = car(cdr(p2t′))
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} P′(n′_{1}, n′_{2})

Keeping (-4 -5 -8 -10 -12 -20 3) and hiding *, Expanding the definition of concatable?, Replacing using formula -5, Instantiating the top quantifier in 1 with the terms: length(q′) − 1, we get 2 subgoals:

node_pair_distinction.2.2.2.1.1.1.2.1:

{-1} path?(g′)(q′)
{-2} path?(g′)(p1t′)
{-3} path_end(q′) = path_start(p1t′)
{-4} length(p1t′) ≥ 2
{-5} rp1 = append(q′, cdr(p1t′))
{-6} n′_{2} = car(p1t′)
{1} nth(append(q′, cdr(p1t′)), length(q′) − 1) = n′_{2}

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.1.2.1.
node_pair_distinction.2.2.2.1.1.1.2.2:

{-1} path?(g′)(q′)
{-2} path?(g′)(p1t′)
{-3} path_end(q′) = path_start(p1t′)
{-4} length(p1t′) ≥ 2
{-5} rp1 = append(q′, cdr(p1t′))
{-6} n′_{2} = car(p1t′)
{1} length[T ](q′) − 1 < length[T ](rp1)

Replacing using formula -5, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.1.2.2.
node_pair_distinction.2.2.2.1.1.1.3:

{-1} path?(g′)(cdr(p2t′))
{-2} path?(g′)(cdr(p1t′))
{-3} length(q′) ≥ 1
{-4} path?(g′)(q′)
{-5} path?(g′)(p1t′)
{-6} path?(g′)(p2t′)
{-7} car(rp1) = car(rp2)
{-8} concatable?(q′, p1t′)
{-9} concatable?(q′, p2t′)
{-10} length(p1t′) ≥ 2
{-11} length(p2t′) ≥ 2
{-12} rp1 = append(q′, cdr(p1t′))
{-13} rp2 = append(q′, cdr(p2t′))
{-14} car(p1t′) = car(p2t′)
{-15} path_to_root(g′, n′_{2}) = rp2
{-16} path_to_root(g′, n′_{1}) = rp1
{-17} g′`nodes(n′_{1})
{-18} g′`nodes(n′_{2})
{-19} finite_tree?(g′)
{1} car(cdr(p1t′)) = car(cdr(p2t′))
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} nth(cdr(p2t′), length[T ](p2t′) − 2) = n′_{2}
{6} P′(n′_{1}, n′_{2})

Keeping (-4 -6 -9 -13 -15 5) and hiding *, Adding type constraints for rp2, Expanding the definition of root_path, Applying disjunctive simplification to flatten sequent, Hiding formulas: -1, -2, -3, -9, Replacing using formula -5, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.1.3.
node_pair_distinction.2.2.2.1.1.1.4:

{-1} path?(g′)(cdr(p2t′))
{-2} path?(g′)(cdr(p1t′))
{-3} length(q′) ≥ 1
{-4} path?(g′)(q′)
{-5} path?(g′)(p1t′)
{-6} path?(g′)(p2t′)
{-7} car(rp1) = car(rp2)
{-8} concatable?(q′, p1t′)
{-9} concatable?(q′, p2t′)
{-10} length(p1t′) ≥ 2
{-11} length(p2t′) ≥ 2
{-12} rp1 = append(q′, cdr(p1t′))
{-13} rp2 = append(q′, cdr(p2t′))
{-14} car(p1t′) = car(p2t′)
{-15} path_to_root(g′, n′_{2}) = rp2
{-16} path_to_root(g′, n′_{1}) = rp1
{-17} g′`nodes(n′_{1})
{-18} g′`nodes(n′_{2})
{-19} finite_tree?(g′)
{1} car(cdr(p1t′)) = car(cdr(p2t′))
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} nth(cdr(p1t′), length[T ](p1t′) − 2) = n′_{1}
{6} P′(n′_{1}, n′_{2})

Keeping (-4 -5 -8 -12 -16 5) and hiding *, Adding type constraints for rp1, Expanding the definition of root_path, Applying disjunctive simplification to flatten sequent, Hiding formulas: -1, -2, -3, -9, Replacing using formula -5, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.1.4.

C Proof scripts

node_pair_distinction.2.2.2.1.1.1.5:

{-1} path?(g′)(cdr(p2t′))
{-2} path?(g′)(cdr(p1t′))
{-3} length(q′) ≥ 1
{-4} path?(g′)(q′)
{-5} path?(g′)(p1t′)
{-6} path?(g′)(p2t′)
{-7} car(rp1) = car(rp2)
{-8} concatable?(q′, p1t′)
{-9} concatable?(q′, p2t′)
{-10} length(p1t′) ≥ 2
{-11} length(p2t′) ≥ 2
{-12} rp1 = append(q′, cdr(p1t′))
{-13} rp2 = append(q′, cdr(p2t′))
{-14} car(p1t′) = car(p2t′)
{-15} path_to_root(g′, n′_{2}) = rp2
{-16} path_to_root(g′, n′_{1}) = rp1
{-17} g′`nodes(n′_{1})
{-18} g′`nodes(n′_{2})
{-19} finite_tree?(g′)
{1} car(cdr(p1t′)) = car(cdr(p2t′))
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} g′`edges(car(p1t′), car(cdr(p2t′)))
{6} P′(n′_{1}, n′_{2})

Keeping (-6 -14 5) and hiding *, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -2 with the terms: 0, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.1.5.

C.97 Proofs for Graph (graph.pvs)

node_pair_distinction.2.2.2.1.1.1.6:

{-1} path?(g′)(cdr(p2t′))
{-2} path?(g′)(cdr(p1t′))
{-3} length(q′) ≥ 1
{-4} path?(g′)(q′)
{-5} path?(g′)(p1t′)
{-6} path?(g′)(p2t′)
{-7} car(rp1) = car(rp2)
{-8} concatable?(q′, p1t′)
{-9} concatable?(q′, p2t′)
{-10} length(p1t′) ≥ 2
{-11} length(p2t′) ≥ 2
{-12} rp1 = append(q′, cdr(p1t′))
{-13} rp2 = append(q′, cdr(p2t′))
{-14} car(p1t′) = car(p2t′)
{-15} path_to_root(g′, n′_{2}) = rp2
{-16} path_to_root(g′, n′_{1}) = rp1
{-17} g′`nodes(n′_{1})
{-18} g′`nodes(n′_{2})
{-19} finite_tree?(g′)
{1} car(cdr(p1t′)) = car(cdr(p2t′))
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} g′`edges(car(p1t′), car(cdr(p1t′)))
{6} P′(n′_{1}, n′_{2})

Keeping (-5 5) and hiding *, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -2 with the terms: 0, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.1.6.

C Proof scripts

node_pair_distinction.2.2.2.1.1.2:

{-1} path?(g′)(cdr(p2t′))
{-2} path?(g′)(cdr(p1t′))
{-3} length(q′) ≥ 1
{-4} path?(g′)(q′)
{-5} path?(g′)(p1t′)
{-6} path?(g′)(p2t′)
{-7} car(rp1) = car(rp2)
{-8} concatable?(q′, p1t′)
{-9} concatable?(q′, p2t′)
{-10} length(p1t′) ≥ 2
{-11} length(p2t′) ≥ 2
{-12} rp1 = append(q′, cdr(p1t′))
{-13} rp2 = append(q′, cdr(p2t′))
{-14} car(p1t′) = car(p2t′)
{-15} path_to_root(g′, n′_{2}) = rp2
{-16} path_to_root(g′, n′_{1}) = rp1
{-17} g′`nodes(n′_{1})
{-18} g′`nodes(n′_{2})
{-19} finite_tree?(g′)
{1} g′`nodes(car[T ](p1t′))
{2} car(cdr(p1t′)) = car(cdr(p2t′))
{3} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{4} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{5} n′_{1} = n′_{2}
{6} P′(n′_{1}, n′_{2})

Keeping (-5 1) and hiding *, Expanding the definition of path?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -1 with the terms: 0, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.1.2.

node_pair_distinction.2.2.2.1.2:

{-1} car(rp1) = car(rp2)
{-2} path_to_root(g′, n′_{2}) = rp2
{-3} path_to_root(g′, n′_{1}) = rp1
{-4} g′`nodes(n′_{1})
{-5} g′`nodes(n′_{2})
{-6} finite_tree?(g′)
{-7} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))):
¬ n_{1} = n_{2} ∧
¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, car(p_{1})) ∧
g′`edges(n_{3}, car(p_{2})) ∧
nth(p_{1}, length(p_{1}) − 1) = n_{1} ∧

nth(p_{2}, length(p_{2}) − 1) = n_{2} ∧ ¬ car(p_{1}) = car(p_{2})

⊃ P′(n_{1}, n_{2})
{1} ∃ (n: nat): n < length(rp1) ∧ n < length(rp2) ∧ ¬ nth(rp1, n) = nth(rp2, n)
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} P′(n′_{1}, n′_{2})

Hiding formulas: -1, -4, -5, -6, -7, 5, Case splitting on length(rp1) < length(rp2), we get 2 subgoals:

node_pair_distinction.2.2.2.1.2.1:

{-1} length(rp1) < length(rp2)
{-2} path_to_root(g′, n′_{2}) = rp2
{-3} path_to_root(g′, n′_{1}) = rp1
{1} ∃ (n: nat): n < length(rp1) ∧ n < length(rp2) ∧ ¬ nth(rp1, n) = nth(rp2, n)
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}

Adding type constraints for rp1, Expanding the definition of root_path, Applying disjunctive simplification to flatten sequent, Hiding formulas: -2, -3, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in 1 with the terms: length(rp1) − 1, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in 1 with the terms: length(rp1) − 1, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.2.1.
node_pair_distinction.2.2.2.1.2.2:

{-1} path_to_root(g′, n′_{2}) = rp2
{-2} path_to_root(g′, n′_{1}) = rp1
{1} length(rp1) < length(rp2)
{2} ∃ (n: nat): n < length(rp1) ∧ n < length(rp2) ∧ ¬ nth(rp1, n) = nth(rp2, n)
{3} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{4} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{5} n′_{1} = n′_{2}

Adding type constraints for rp2, Expanding the definition of root_path, Applying disjunctive simplification to flatten sequent, Hiding formulas: -2, -3, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in 2 with the terms: length(rp2) − 1, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in 3 with the terms: length(rp2) − 1, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.1.2.2.
node_pair_distinction.2.2.2.2:

{-1} path_to_root(g′, n′_{2}) = rp2
{-2} path_to_root(g′, n′_{1}) = rp1
{-3} g′`nodes(n′_{1})
{-4} g′`nodes(n′_{2})
{-5} finite_tree?(g′)
{-6} ∀ (n_{1}, n_{2}: (g′`nodes), p_{1}, p_{2}: (path?(g′))):
¬ n_{1} = n_{2} ∧
root_path(g′, n_{1})(p_{1}) ∧

root_path(g′, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{-7} ∀ (n_{1}, n_{2}, n_{3}: (g′`nodes), p_{1}, p_{2}: (path?(g′))):
¬ n_{1} = n_{2} ∧
¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g′`edges(n_{3}, path_start(p_{1})) ∧
g′`edges(n_{3}, path_start(p_{2})) ∧

path_end(p_{1}) = n_{1} ∧ path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})

⊃ P′(n_{1}, n_{2})
{1} path_start(rp1) = path_start(rp2)
{2} ∃ (i: below(length(rp2))): nth(rp2, i) = n′_{1}
{3} ∃ (i: below(length(rp1))): nth(rp1, i) = n′_{2}
{4} n′_{1} = n′_{2}
{5} P′(n′_{1}, n′_{2})

Hiding formulas: -7, Instantiating the top quantifier in -6 with the terms: n′_{1}, n′_{2}, rp1, rp2, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of node_pair_distinction.2.2.2.2.

Q.E.D.

C.97.35 Graph.symmetric_node_pair_distinction_TCC1

Terse proof for symmetric_node_pair_distinction_TCC1.

symmetric_node_pair_distinction_TCC1:

{1} ∀ (g: graph_type, P: PRED[[(g`nodes), (g`nodes)]]): (∀ (n_{1}, n_{2}: (g`nodes), p_{1}, p_{2}: (path?(g))): ¬ n_{1} = n_{2} ∧ root_path(g, n_{1})(p_{1}) ∧ root_path(g, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2}) ⊃ P (n_{1}, n_{2})) ∧ (∀ (n_{1}, n_{2}: (g`nodes), p: (path?(g))): ¬ n_{1} = n_{2} ∧ path_start(p) = n_{2} ∧ path_end(p) = n_{1} ∧ length(p) ≥ 2 ⊃ P (n_{1}, n_{2})) ∧ (∀ (n: (g`nodes)): P (n, n)) ∧ symmetric?(P) ∧ finite_tree?(g) ⊃ (∀ (n_{11}, n_{21}, n_{3}: (g`nodes), p_{11}, p_{21}: (path?(g))): g`edges(n_{3}, path_start(p_{11})) ∧ ¬ n_{21} = n_{3} ∧ ¬ n_{11} = n_{3} ∧ ¬ n_{11} = n_{21} ⊃ g`nodes(path_start[T ](p_{21})))

Repeatedly Skolemizing and flattening, Rewriting using nodes_path_start, matching in *,

This completes the proof of symmetric_node_pair_distinction_TCC1.

Q.E.D.

C.97.36 Graph.symmetric_node_pair_distinction

Terse proof for symmetric_node_pair_distinction.
symmetric_node_pair_distinction:

{1} ∀ (g: graph_type, P: PRED[[(g`nodes), (g`nodes)]]):

(finite_tree?(g) ∧ symmetric?(P) ∧ (∀ (n: (g`nodes)): P (n, n)) ∧ (∀ (n_{1}, n_{2}: (g`nodes), p: (path?(g))):

¬ n_{1} = n_{2} ∧ path_start(p) = n_{2} ∧ path_end(p) = n_{1} ∧ length(p) ≥ 2 ⊃

P (n_{1}, n_{2}))

∧

(∀ (n_{1}, n_{2}: (g`nodes), p_{1}, p_{2}: (path?(g))):

¬ n_{1} = n_{2} ∧
root_path(g, n_{1})(p_{1}) ∧
root_path(g, n_{2})(p_{2}) ∧ ¬ path_start(p_{1}) = path_start(p_{2})
⊃ P (n_{1}, n_{2}))
∧
(∀ (n_{1}, n_{2}, n_{3}: (g`nodes), p_{1}, p_{2}: (path?(g))):
¬ n_{1} = n_{2} ∧
¬ n_{1} = n_{3} ∧
¬ n_{2} = n_{3} ∧
g`edges(n_{3}, path_start(p_{1})) ∧
g`edges(n_{3}, path_start(p_{2})) ∧
path_end(p_{1}) = n_{1} ∧
path_end(p_{2}) = n_{2} ∧ ¬ path_start(p_{1}) = path_start(p_{2})
⊃ P (n_{1}, n_{2})))

⊃ (∀ (n_{1}, n_{2}: (g`nodes)): P (n_{1}, n_{2}))

Skolemizing and flattening, Using lemma node_pair_distinction, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: -2, -4, -5, 2, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -6 with the terms: n′_{2}, n′_{1}, p′, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of symmetric?, Instantiating the top quantifier in -10 with the terms: n′_{2}, n′_{1}, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of symmetric_node_pair_distinction.

Q.E.D.

C.98 Proofs for Graph_Relations (graph.pvs)

C.98.1 Graph_Relations.trans_closure_char_TCC1

Terse proof for trans_closure_char_TCC1.
trans_closure_char_TCC1:

{1} ∀ (x, y: T, l: list[T ]): length(l) ≥ 2 ⊃ path_list?[T ](l)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_list? length Simplifying, rewriting, and recording with decision procedures, This completes the proof of trans_closure_char_TCC1. Q.E.D.

C.98.2 Graph_Relations.trans_closure_char_TCC2

Terse proof for trans_closure_char_TCC2.
trans_closure_char_TCC2:

{1} ∀ (x, y: T, l: list[T ]):

path_end(l) = y ∧ path_start(l) = x ∧ length(l) ≥ 2 ⊃ (∀ (i: below(length[T ](l) − 1)): i < length[T ](l))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of trans_closure_char_TCC2. Q.E.D.

C.98.3 Graph_Relations.trans_closure_char_TCC3

Terse proof for trans_closure_char_TCC3.
trans_closure_char_TCC3:

{1} ∀ (x, y: T, l: list[T ]):

path_end(l) = y ∧ path_start(l) = x ∧ length(l) ≥ 2 ⊃ (∀ (i: below(length[T ](l) − 1)): i + 1 < length[T ](l))

C.98 Proofs for Graph_Relations (graph.pvs)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of trans_closure_char_TCC3.

Q.E.D.

C.98.4 Graph_Relations.trans_closure_char

Terse proof for trans_closure_char.
trans_closure_char:

{1} ∀ (R: PRED[[T, T ]], x, y: T):

transitive_closure(R)(x, y) ≡ (∃ (l: list[T ]):

length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y ∧ (∀ (i: below(length(l) − 1)):

R(nth(l, i), nth(l, i + 1))))

Installing automatic rewrites from: path_list? length length_is_cons length_cdr

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

trans_closure_char.1:

{-1} transitive_closure(R′)(x′, y′)
{1} ∃ (l: list[T ]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

Expanding the definition of transitive_closure,

Instantiating the top quantifier in -1 with the terms: λ (x, y: T): ∃ (l: list[T ]): length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i))),

we get 3 subgoals:

trans_closure_char.1.1:

{-1} (R′ ⊆ λ (x, y : T) : ∃ (l : list[T ]) : length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y ∧ (∀ (i : below(length(l) − 1)) : R′(nth(l, i), nth(l, 1 + i)))) ∧ transitive?(λ (x, y: T):

∃ (l: list[T ]): length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y ∧ (∀ (i: below(length(l) − 1)):

R′(nth(l, i), nth(l, 1 + i))))

⊃
(∃ (l: list[T ]):

length(l) ≥ 2 ∧

path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)):

R′(nth(l, i), nth(l, 1 + i))))

{1} ∃ (l: list[T ]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

Applying propositional simplification,

we get 2 subgoals:

trans_closure_char.1.1.1:

{1} (R′ ⊆ λ (x, y : T) : ∃ (l : list[T ]) : length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y ∧ (∀ (i : below(length(l) − 1)) : R′(nth(l, i), nth(l, 1 + i))))
{2} ∃ (l: list[T ]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

Hiding formulas: 2,

Expanding the definition(s) of (subset? member),

Repeatedly Skolemizing and flattening,

Instantiating the top quantifier in 1 with the terms: (:x′′‘1, x′′‘2:),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of trans_closure_char.1.1.1.

trans_closure_char.1.1.2:

{1} transitive?(λ (x, y: T):

∃ (l: list[T ]): length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y ∧ (∀ (i: below(length(l) − 1)):

R′(nth(l, i), nth(l, 1 + i))))

{2} ∃ (l: list[T ]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

Hiding formulas: 2, Expanding the definition of transitive?, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: length_append nth_append_right nth_append_left Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in 1 with the terms: append(l′, cdr(l′′)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

trans_closure_char.1.1.2.1:

{-1} length(l′) ≥ 2
{-2} path_start(l′) = x′′
{-3} path_end(l′) = y′′
{-4} ∀ (i: below(length(l′) − 1)): R′(nth(l′, i), nth(l′, 1 + i))
{-5} length(l′′) ≥ 2
{-6} path_start(l′′) = y′′
{-7} path_end(l′′) = z′
{-8} ∀ (i: below(length(l′′) − 1)): R′(nth(l′′, i), nth(l′′, 1 + i))
{1} ∀ (i: below(length(append(l′, cdr(l′′))) − 1)):

R′(nth(append(l′, cdr(l′′)), i), nth(append(l′, cdr(l′′)), 1 + i))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Case splitting on i!1 < length(l!1) - 1, we get 2 subgoals:

trans_closure_char.1.1.2.1.1:

{-1} i′ < length(l′) − 1
{-2} i′ < length(l′) + length(l′′) − 2
{-3} length(l′) ≥ 2
{-4} path_start(l′) = x′′
{-5} path_end(l′) = y′′
{-6} ∀ (i: below(length(l′) − 1)): R′(nth(l′, i), nth(l′, 1 + i))
{-7} length(l′′) ≥ 2
{-8} path_start(l′′) = y′′
{-9} path_end(l′′) = z′
{-10} ∀ (i: below(length(l′′) − 1)): R′(nth(l′′, i), nth(l′′, 1 + i))
{1} R′(nth(append(l′, cdr(l′′)), i′), nth(append(l′, cdr(l′′)), 1 + i′))

Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables,

This completes the proof of trans_closure_char.1.1.2.1.1.
trans_closure_char.1.1.2.1.2:

{-1} i′ < length(l′) + length(l′′) − 2
{-2} length(l′) ≥ 2
{-3} path_start(l′) = x′′
{-4} path_end(l′) = y′′
{-5} ∀ (i: below(length(l′) − 1)): R′(nth(l′, i), nth(l′, 1 + i))
{-6} length(l′′) ≥ 2
{-7} path_start(l′′) = y′′
{-8} path_end(l′′) = z′
{-9} ∀ (i: below(length(l′′) − 1)): R′(nth(l′′, i), nth(l′′, 1 + i))
{1} i′ < length(l′) − 1
{2} R′(nth(append(l′, cdr(l′′)), i′), nth(append(l′, cdr(l′′)), 1 + i′))

Case splitting on i!1 = length(l!1) - 1, we get 2 subgoals:

trans_closure_char.1.1.2.1.2.1:

{-1} i′ = length(l′) − 1
{-2} i′ < length(l′) + length(l′′) − 2
{-3} length(l′) ≥ 2
{-4} path_start(l′) = x′′
{-5} path_end(l′) = y′′
{-6} ∀ (i: below(length(l′) − 1)): R′(nth(l′, i), nth(l′, 1 + i))
{-7} length(l′′) ≥ 2
{-8} path_start(l′′) = y′′
{-9} path_end(l′′) = z′
{-10} ∀ (i: below(length(l′′) − 1)): R′(nth(l′′, i), nth(l′′, 1 + i))
{1} i′ < length(l′) − 1
{2} R′(nth(append(l′, cdr(l′′)), i′), nth(append(l′, cdr(l′′)), 1 + i′))

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of path_end, Replacing using formula -1, Replacing using formula -5, Instantiating the top quantifier in -10 with the terms: 0, Expanding the definition of nth, Expanding the definition of path_start, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char.1.1.2.1.2.1.

trans_closure_char.1.1.2.1.2.2:

{-1} i′ < length(l′) + length(l′′) − 2
{-2} length(l′) ≥ 2
{-3} path_start(l′) = x′′
{-4} path_end(l′) = y′′
{-5} ∀ (i: below(length(l′) − 1)): R′(nth(l′, i), nth(l′, 1 + i))
{-6} length(l′′) ≥ 2
{-7} path_start(l′′) = y′′
{-8} path_end(l′′) = z′
{-9} ∀ (i: below(length(l′′) − 1)): R′(nth(l′′, i), nth(l′′, 1 + i))
{1} i′ = length(l′) − 1
{2} i′ < length(l′) − 1
{3} R′(nth(append(l′, cdr(l′′)), i′), nth(append(l′, cdr(l′′)), 1 + i′))

Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -9 with the terms: i′ − length(l′) + 1, Expanding the definition of nth, which is trivially true.

This completes the proof of trans_closure_char.1.1.2.1.2.2.
trans_closure_char.1.1.2.2:

{-1} length(l′) ≥ 2
{-2} path_start(l′) = x′′
{-3} path_end(l′) = y′′
{-4} ∀ (i: below(length(l′) − 1)): R′(nth(l′, i), nth(l′, 1 + i))
{-5} length(l′′) ≥ 2
{-6} path_start(l′′) = y′′
{-7} path_end(l′′) = z′
{-8} ∀ (i: below(length(l′′) − 1)): R′(nth(l′′, i), nth(l′′, 1 + i))
{1} path_end(append(l′, cdr(l′′))) = z′

Expanding the definition of path_end, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of nth, which is trivially true.

This completes the proof of trans_closure_char.1.1.2.2.
trans_closure_char.1.1.2.3:

{-1} length(l′) ≥ 2
{-2} path_start(l′) = x′′
{-3} path_end(l′) = y′′
{-4} ∀ (i: below(length(l′) − 1)): R′(nth(l′, i), nth(l′, 1 + i))
{-5} length(l′′) ≥ 2
{-6} path_start(l′′) = y′′
{-7} path_end(l′′) = z′
{-8} ∀ (i: below(length(l′′) − 1)): R′(nth(l′′, i), nth(l′′, 1 + i))
{1} path_start(append(l′, cdr(l′′))) = x′′

Expanding the definition of path_start, Expanding the definition of append, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of trans_closure_char.1.1.2.3.

trans_closure_char.1.2:

{1} ∀ (x, y: T, l: list[T ]):

path_start(l) = x ∧ length(l) ≥ 2 ⊃ length(l) ≥ 1 {2} ∃ (l: list[T ]):

length(l) ≥ 2 ∧

path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

Hiding formulas: 2,

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement,

This completes the proof of trans_closure_char.1.2.

trans_closure_char.1.3:

{1} ∀ (x, y: T, l: list[T ]): length(l) ≥ 2 ⊃ length(l) ≥ 1
{2} ∃ (l: list[T ]):

length(l) ≥ 2 ∧

path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

Hiding formulas: 2,

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement,

This completes the proof of trans_closure_char.1.3.

trans_closure_char.2:

{-1} ∃ (l: list[T ]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

{1} transitive_closure(R′)(x′, y′)

Case splitting on FORALL (x, y: T, l: (path_list?[T])): length(l) >= 2 AND path_start(l) = x AND path_end(l) = y AND (FORALL (i: below(length(l) - 1)): R!1(nth(l, i), nth(l, 1 + i))) IMPLIES transitive_closure(R!1)(x, y),

we get 2 subgoals:

trans_closure_char.2.1:

{-1} ∀ (x, y: T, l: (path_list?[T ])):

length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y ∧ (∀ (i: below(length(l) − 1)):

R′(nth(l, i), nth(l, 1 + i))) ⊃ transitive_closure(R′)(x, y)

{-2} ∃ (l: list[T ]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

{1} transitive_closure(R′)(x′, y′)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of trans_closure_char.2.1.

trans_closure_char.2.2:

{-1} ∃ (l: list[T ]):

length(l) ≥ 2 ∧ path_start(l) = x′ ∧ path_end(l) = y′ ∧ (∀ (i: below(length(l) − 1)): R′(nth(l, i), nth(l, 1 + i)))

{1} ∀ (x, y: T, l: (path_list?[T ])):

length(l) ≥ 2 ∧ path_start(l) = x ∧ path_end(l) = y ∧ (∀ (i: below(length(l) − 1)):

R′(nth(l, i), nth(l, 1 + i))) ⊃ transitive_closure(R′)(x, y)

{2} transitive_closure(R′)(x′, y′)

Hiding formulas: -1, 2, Inducting on l on formula 1 using induction scheme path_list_induction[T ], we get 2 subgoals:

trans_closure_char.2.2.1:

{1} ∀ (t: T):

∀ (x, y: T):

(length(cons(t, null)) ≥ 2 ∧ path_start(cons(t, null)) = x ∧ path_end(cons(t, null)) = y ∧ (∀ (i: below(length(cons(t, null)) − 1)):

R′(nth(cons(t, null), i), nth(cons(t, null), 1 + i))))

⊃ transitive_closure(R′)(x, y)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: nth path_start path_end Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char.2.2.1.

trans_closure_char.2.2.2:

{1} ∀ (t: T, tail: (path_list?[T ])):
(∀ (x, y: T):

(length(tail) ≥ 2 ∧ path_start(tail) = x ∧ path_end(tail) = y ∧ (∀ (i: below(length(tail) − 1)):

R′(nth(tail, i), nth(tail, 1 + i))))

⊃ transitive_closure(R′)(x, y)) ⊃

(∀ (x, y: T):

(length(cons(t, tail)) ≥ 2 ∧ path_start(cons(t, tail)) = x ∧ path_end(cons(t, tail)) = y ∧ (∀ (i: below(length(cons(t, tail)) − 1)):

R′(nth(cons(t, tail), i), nth(cons(t, tail), 1 + i))))

⊃ transitive_closure(R′)(x, y))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_start path_end Simplifying, rewriting, and recording with decision procedures, Case splitting on length(tail!1) = 1, we get 2 subgoals:

trans_closure_char.2.2.2.1:

{-1} length(tail′) = 1
{-2} length(tail′) ≥ 1
{-3} ∀ (x, y: T):

(length(tail′) ≥ 2 ∧ car(tail′) = x ∧ nth(tail′, length(tail′) − 1) = y ∧ (∀ (i: below(length(tail′) − 1)):

R′(nth(tail′, i), nth(tail′, 1 + i))))

⊃ transitive_closure(R′)(x, y)

{-4} 1 + length(tail′) ≥ 2
{-5} t′ = x′′
{-6} nth(cons(t′, tail′), length(tail′)) = y′′

{-7} ∀ (i: below(length(cons(t′, tail′)) − 1)):

R′(nth(cons(t′, tail′), i), nth(cons(t′, tail′), 1 + i))

{1} transitive_closure(R′)(x′′, y′′)

Hiding formulas: -3, Installing automatic rewrites from: nth Instantiating the top quantifier in -6 with the terms: 0, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of transitive_closure, Repeatedly Skolemizing and flattening, Expanding the definition(s) of (subset? member), Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char.2.2.2.1.

trans_closure_char.2.2.2.2:

{-1} length(tail′) ≥ 1
{-2} ∀ (x, y: T):

(length(tail′) ≥ 2 ∧ car(tail′) = x ∧ nth(tail′, length(tail′) − 1) = y ∧ (∀ (i: below(length(tail′) − 1)):

R′(nth(tail′, i), nth(tail′, 1 + i))))

⊃ transitive_closure(R′)(x, y)

{-3} 1 + length(tail′) ≥ 2
{-4} t′ = x′′
{-5} nth(cons(t′, tail′), length(tail′)) = y′′

{-6} ∀ (i: below(length(cons(t′, tail′)) − 1)):

R′(nth(cons(t′, tail′), i), nth(cons(t′, tail′), 1 + i))

{1} length(tail′) = 1
{2} transitive_closure(R′)(x′′, y′′)

Expanding the definition of nth, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -2 with the terms: car(tail′), y′′, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

trans_closure_char.2.2.2.2.1:

{-1} length(tail′) ≥ 1
{-2} nth(tail′, length(tail′) − 1) = y′′
{-3} transitive_closure(R′)(car(tail′), y′′)
{-4} 1 + length(tail′) ≥ 2
{-5} t′ = x′′

{-6} ∀ (i: below(length(cons(t′, tail′)) − 1)):

R′(nth(cons(t′, tail′), i), nth(cons(t′, tail′), 1 + i))

{1} length(tail′) = 1
{2} transitive_closure(R′)(x′′, y′′)

Instantiating the top quantifier in -6 with the terms: 0, Installing automatic rewrites from: nth Simplifying, rewriting, and recording with decision procedures, Replacing using formula -5, Hiding formulas: -1, -2, -4, -5, Expanding the definition of transitive_closure, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of transitive?, Instantiating the top quantifier in -4 with the terms: x′′, car(tail′), y′′, Simplifying, rewriting, and recording with decision procedures, Expanding the definition(s) of (subset? member), Instantiating the top quantifier in -3 with the terms: (x′′, car(tail′)), Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char.2.2.2.2.1.

trans_closure_char.2.2.2.2.2:

{-1} length(tail′) ≥ 1
{-2} nth(tail′, length(tail′) − 1) = y′′
{-3} 1 + length(tail′) ≥ 2
{-4} t′ = x′′

{-5} ∀ (i: below(length(cons(t′, tail′)) − 1)):

R′(nth(cons(t′, tail′), i), nth(cons(t′, tail′), 1 + i))

{1} length(tail′) = 1

{2} ∀ (i: below(length(tail′) − 1)):

R′(nth(tail′, i), nth(tail′, 1 + i))

{3} transitive_closure(R′)(x′′, y′′)

Keeping (-5 2) and hiding *, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: i′ + 1, Installing automatic rewrites from: nth Simplifying, rewriting, and recording with decision procedures,

This completes the proof of trans_closure_char.2.2.2.2.2.

Q.E.D.

C.99 Proofs for Graph_Util (graph.pvs)

C.99.1 Graph_Util.every_nth

Terse proof for every_nth.

every_nth:

{1} ∀ (P: PRED[T ], l: list[T ]):

every(P)(l) ≡ (∀ (i: below(length(l))): P (nth(l, i)))

Inducting on l on formula 1, we get 2 subgoals:

every_nth.1:

{1} ∀ (P: PRED[T ]):

every(P)(null) ≡ (∀ (i: below(length(null))): P (nth(null, i)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of every_nth.1.

every_nth.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (P: PRED[T ]):

every(P)(cons2_var) ≡ (∀ (i: below(length(cons2_var))): P (nth(cons2_var, i))))

⊃

(∀ (P: PRED[T ]):

every(P)(cons(cons1_var, cons2_var)) ≡

(∀ (i: below(length(cons(cons1_var, cons2_var)))): P (nth(cons(cons1_var, cons2_var), i))))

C.99 Proofs for Graph_Util (graph.pvs)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

every_nth.2.1:

{-1} every(P′)(cons(cons1_var′, cons2_var′))
{-2} ∀ (P: PRED[T ]):

every(P)(cons2_var′) ≡

(∀ (i: below(length(cons2_var′))): P (nth(cons2_var′, i)))

{1} ∀ (i: below(length(cons(cons1_var′, cons2_var′)))): P′(nth(cons(cons1_var′, cons2_var′), i))

Expanding the definition of every, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Expanding the definition of length, Expanding the definition of nth, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -4 with the terms: i′ − 1, This completes the proof of every_nth.2.1.

every_nth.2.2:

{-1} ∀ (i: below(length(cons(cons1_var′, cons2_var′)))): P′(nth(cons(cons1_var′, cons2_var′), i))

{-2} ∀ (P: PRED[T ]):

every(P)(cons2_var′) ≡

(∀ (i: below(length(cons2_var′))): P (nth(cons2_var′, i)))

{1} every(P′)(cons(cons1_var′, cons2_var′))

Expanding the definition of every, Applying propositional simplification, we get 2 subgoals:

every_nth.2.2.1:

{-1} ∀ (i: below(length(cons(cons1_var′, cons2_var′)))): P′(nth(cons(cons1_var′, cons2_var′), i))

{-2} ∀ (P: PRED[T ]):

every(P)(cons2_var′) ≡

(∀ (i: below(length(cons2_var′))): P (nth(cons2_var′, i)))

{1} P′(cons1_var′)

Instantiating the top quantifier in -1 with the terms: 0, we get 2 subgoals:

every_nth.2.2.1.1:

{-1} P′(nth(cons(cons1_var′, cons2_var′), 0))
{-2} ∀ (P: PRED[T ]):

every(P)(cons2_var′) ≡

(∀ (i: below(length(cons2_var′))): P (nth(cons2_var′, i)))

{1} P′(cons1_var′)

Expanding the definition of nth, which is trivially true. This completes the proof of every_nth.2.2.1.1.

every_nth.2.2.1.2:

{-1} ∀ (P: PRED[T ]):

every(P)(cons2_var′) ≡

(∀ (i: below(length(cons2_var′))): P (nth(cons2_var′, i)))

{1} 0 < length[T ](cons[T ](cons1_var′, cons2_var′))
{2} P′(cons1_var′)

Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of every_nth.2.2.1.2.

every_nth.2.2.2:

{-1} ∀ (i: below(length(cons(cons1_var′, cons2_var′)))): P′(nth(cons(cons1_var′, cons2_var′), i))

{-2} ∀ (P: PRED[T ]):

every(P)(cons2_var′) ≡

(∀ (i: below(length(cons2_var′))): P (nth(cons2_var′, i)))

{1} every(P′)(cons2_var′)

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: 1, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: i′ + 1, we get 2 subgoals:

every_nth.2.2.2.1:

{-1} i′ < length(cons2_var′)
{-2} P′(nth(cons(cons1_var′, cons2_var′), i′ + 1))
{1} P′(nth(cons2_var′, i′))

Expanding the definition of nth, which is trivially true. This completes the proof of every_nth.2.2.2.1.

every_nth.2.2.2.2:

{-1} i′ < length(cons2_var′)
{1} 1 + i′ < length[T ](cons[T ](cons1_var′, cons2_var′))
{2} P′(nth(cons2_var′, i′))

Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of every_nth.2.2.2.2. Q.E.D.

C.99.2 Graph_Util.nth_append_left_TCC1

Terse proof for nth_append_left_TCC1.
nth_append_left_TCC1:

{1} ∀ (l_{1}, l_{2}: list[T ], n: nat):

n < length(l_{1}) ⊃ n < length[T ](append[T ](l_{1}, l_{2}))

Repeatedly Skolemizing and flattening, Rewriting using length_append, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_append_left_TCC1. Q.E.D.

C.99.3 Graph_Util.nth_append_left

Terse proof for nth_append_left.
nth_append_left:

{1} ∀ (l_{1}, l_{2}: list[T ], n: nat):

n < length(l_{1}) ⊃ nth(append(l_{1}, l_{2}), n) = nth(l_{1}, n)

Inducting on l_{1} on formula 1, we get 3 subgoals:

nth_append_left.1:

{1} ∀ (l_{2}: list[T ], n: nat):

n < length(null) ⊃ nth(append(null, l_{2}), n) = nth(null, n)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_append_left.1.

nth_append_left.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]): (∀ (l_{2}: list[T ], n: nat): n < length(cons2_var) ⊃ nth(append(cons2_var, l_{2}), n) = nth(cons2_var, n)) ⊃ (∀ (l_{2}: list[T ], n: nat): n < length(cons(cons1_var, cons2_var)) ⊃ nth(append(cons(cons1_var, cons2_var), l_{2}), n) = nth(cons(cons1_var, cons2_var), n))

Repeatedly Skolemizing and flattening, Expanding the definition of append, Expanding the definition of nth, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using -2, matching in *, This completes the proof of nth_append_left.2.

nth_append_left.3:

{1} ∀ (l_{1}, l_{2}: list[T ], n: nat):

n < length(l_{1}) ⊃ n < length[T ](append[T ](l_{1}, l_{2}))

{2} ∀ (l_{2}: list[T ], n: nat):

n < length(l′_{1}) ⊃ nth(append(l′_{1}, l_{2}), n) = nth(l′_{1}, n)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using length_append, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_append_left.3. Q.E.D.

C.99.4 Graph_Util.nth_append_right_TCC1

Terse proof for nth_append_right_TCC1.
nth_append_right_TCC1:

{1} ∀ (l_{1}, l_{2}: list[T ], n: nat):

n ≥ length(l_{1}) ∧ n < length(append(l_{1}, l_{2})) ⊃ n − length[T ](l_{1}) ≥ 0 ∧ n − length[T ](l_{1}) < length[T ](l_{2})

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Rewriting using length_append, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_append_right_TCC1. Q.E.D.

C.99.5 Graph_Util.nth_append_right

Terse proof for nth_append_right.
nth_append_right:

{1} ∀ (l_{1}, l_{2}: list[T ], n: nat):

n ≥ length(l_{1}) ∧ n < length(append(l_{1}, l_{2})) ⊃ nth(append(l_{1}, l_{2}), n) = nth(l_{2}, n − length(l_{1}))

Inducting on l_{1} on formula 1, we get 3 subgoals:

nth_append_right.1:

{1} ∀ (l_{2}: list[T ], n: nat):

n ≥ length(null) ∧ n < length(append(null, l_{2})) ⊃ nth(append(null, l_{2}), n) = nth(l_{2}, n − length(null))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_append_right.1.

nth_append_right.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]): (∀ (l_{2}: list[T ], n: nat):

n ≥ length(cons2_var) ∧ n < length(append(cons2_var, l_{2})) ⊃ nth(append(cons2_var, l_{2}), n) = nth(l_{2}, n − length(cons2_var)))

⊃

(∀ (l_{2}: list[T ], n: nat):

n ≥ length(cons(cons1_var, cons2_var)) ∧

n < length(append(cons(cons1_var, cons2_var), l_{2}))

⊃

nth(append(cons(cons1_var, cons2_var), l_{2}), n) = nth(l_{2}, n − length(cons(cons1_var, cons2_var))))

Repeatedly Skolemizing and flattening, Rewriting using length_append, matching in *, Expanding the definition of length, Expanding the definition of length, Expanding the definition of append, Expanding the definition of nth, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using -2, matching in *, Rewriting using length_append, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_append_right.2.

nth_append_right.3:

{1} ∀ (l_{1}, l_{2}: list[T ], n: nat):
n ≥ length(l_{1}) ∧ n < length(append(l_{1}, l_{2})) ⊃
n − length[T ](l_{1}) ≥ 0 ∧ n − length[T ](l_{1}) < length[T ](l_{2})
{2} ∀ (l_{2}: list[T ], n: nat):
n ≥ length(l′_{1}) ∧ n < length(append(l′_{1}, l_{2})) ⊃
nth(append(l′_{1}, l_{2}), n) = nth(l_{2}, n − length(l′_{1}))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using length_append, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_append_right.3. Q.E.D.

C.99.6 Graph_Util.list_pred_card

Terse proof for list_pred_card.
list_pred_card:

{1} ∀ (l: list[T ], P: PRED[T ]):

is_finite(P) ∧ every(P)(l) ∧ length(l) > card(P) ⊃ (∃ (n_{1}, n_{2}: below(length(l))): ¬ n_{1} = n_{2} ∧ nth(l, n_{1}) = nth(l, n_{2}))

Repeatedly Skolemizing and flattening, Letting f name LAMBDA (i: below(length(l!1))): nth(l!1, i), Case splitting on injective?(f), we get 2 subgoals:

list_pred_card.1:

{-1} injective?(f)
{-2} (λ (i: below(length(l′))): nth(l′, i)) = f
{-3} is_finite(P′)
{-4} every(P′)(l′)
{-5} length(l′) > card(P′)
{1} ∃ (n_{1}, n_{2}: below(length(l′))): ¬ n_{1} = n_{2} ∧ nth(l′, n_{1}) = nth(l′, n_{2})

Using lemma bijective_restrict_to_image, Simplifying, rewriting, and recording with decision procedures, Case splitting on (EXISTS (d: below(length[T](l!1))): TRUE) OR (FORALL (r: (im-

age[below(length(l!1)), T] (f, fullset[below(length[T](l!1))]))): FALSE), we get 2 subgoals:

list_pred_card.1.1:

{-1} (∃ (d: below(length[T ](l′))): true) ∨

(∀ (r:

(image[below(length(l′)), T ](f, fullset[below(length[T ](l′))]))): false)

{-2} bijective?(restrict_to_image(f))
{-3} injective?(f)
{-4} (λ (i: below(length(l′))): nth(l′, i)) = f
{-5} is_finite(P′)
{-6} every(P′)(l′)
{-7} length(l′) > card(P′)
{1} ∃ (n_{1}, n_{2}: below(length(l′))): ¬ n_{1} = n_{2} ∧ nth(l′, n_{1}) = nth(l′, n_{2})

Using lemma bijective_inverse_alt_is_bijective,

Using lemma card_bij,

we get 2 subgoals:

list_pred_card.1.1.1:

{-1} card(image(f, fullset[below(length(l′))])) = length(l′) ≡

(∃ (f_1: [(image(f, fullset[below(length(l′))])) → below[length(l′)]]):

bijective?(f_1))

{-2} bijective?[(image(f, fullset[below(length(l′))])), below(length(l′))]

(inverse_alt(restrict_to_image(f)))

{-3} (∃ (d: below(length[T ](l′))): true) ∨

(∀ (r:

(image[below(length(l′)), T ](f, fullset[below(length[T ](l′))]))): false)

{-4} bijective?(restrict_to_image(f))
{-5} injective?(f)
{-6} (λ (i: below(length(l′))): nth(l′, i)) = f
{-7} is_finite(P′)
{-8} every(P′)(l′)
{-9} length(l′) > card(P′)
{1} ∃ (n_{1}, n_{2}: below(length(l′))): ¬ n_{1} = n_{2} ∧ nth(l′, n_{1}) = nth(l′, n_{2})

Applying disjunctive simplification to flatten sequent,

Splitting conjunctions,

we get 2 subgoals:

list_pred_card.1.1.1.1:

{-1} card(image(f, fullset[below(length(l′))])) = length(l′)

{-2} card(image(f, fullset[below(length(l′))])) = length(l′) ⊃

(∃ (f_1: [(image(f, fullset[below(length(l′))])) → below[length(l′)]]):

bijective?(f_1))

{-3} bijective?[(image(f, fullset[below(length(l′))])), below(length(l′))]

(inverse_alt(restrict_to_image(f)))

{-4} (∃ (d: below(length[T ](l′))): true) ∨

(∀ (r:

(image[below(length(l′)), T ](f, fullset[below(length[T ](l′))]))): false)

{-5} bijective?(restrict_to_image(f))
{-6} injective?(f)
{-7} (λ (i: below(length(l′))): nth(l′, i)) = f
{-8} is_finite(P′)
{-9} every(P′)(l′)
{-10} length(l′) > card(P′)
{1} ∃ (n_{1}, n_{2}: below(length(l′))): ¬ n_{1} = n_{2} ∧ nth(l′, n_{1}) = nth(l′, n_{2})

Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -2, Using lemma card_subset, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -1, -2, -3, -4, -5, -6, 2, Expanding the definition(s) of (fullset subset? member image f), Repeatedly Skolemizing and flattening, Rewriting using every_nth, matching in *, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of list_pred_card.1.1.1.1.

list_pred_card.1.1.1.2:

{-1} card(image(f, fullset[below(length(l′))])) = length(l′) ⊃

(∃ (f_1: [(image(f, fullset[below(length(l′))])) → below[length(l′)]]):

bijective?(f_1))

{-2} bijective?[(image(f, fullset[below(length(l′))])), below(length(l′))]

(inverse_alt(restrict_to_image(f)))

{-3} (∃ (d: below(length[T ](l′))): true) ∨

(∀ (r:

(image[below(length(l′)), T ](f, fullset[below(length[T ](l′))]))): false)

{-4} bijective?(restrict_to_image(f))
{-5} injective?(f)
{-6} (λ (i: below(length(l′))): nth(l′, i)) = f
{-7} is_finite(P′)
{-8} every(P′)(l′)
{-9} length(l′) > card(P′)

{1} ∃ (f_1: [(image(f, fullset[below(length(l′))])) → below[length(l′)]]):

bijective?(f_1)

{2} ∃ (n_{1}, n_{2}: below(length(l′))): ¬ n_{1} = n_{2} ∧ nth(l′, n_{1}) = nth(l′, n_{2})

Hiding formulas: -1, 2, Instantiating quantified variables, This completes the proof of list_pred_card.1.1.1.2.

list_pred_card.1.1.2:

{-1} bijective?[(image(f, fullset[below(length(l′))])), below(length(l′))]

(inverse_alt(restrict_to_image(f)))

{-2} (∃ (d: below(length[T ](l′))): true) ∨

(∀ (r:

(image[below(length(l′)), T ](f, fullset[below(length[T ](l′))]))): false)

{-3} bijective?(restrict_to_image(f))
{-4} injective?(f)
{-5} (λ (i: below(length(l′))): nth(l′, i)) = f
{-6} is_finite(P′)
{-7} every(P′)(l′)
{-8} length(l′) > card(P′)

{1} is_finite[T ]

(image[below(length(l′)), T ](f, fullset[below(length[T ](l′))]))

{2} ∃ (n_{1}, n_{2}: below(length(l′))): ¬ n_{1} = n_{2} ∧ nth(l′, n_{1}) = nth(l′, n_{2})

Hiding formulas: -1, -2, 2, Using lemma finite_image, Keeping 1 and hiding *, Expanding the definition of is_finite, Instantiating the top quantifier in 1 with the terms: length(l′), id, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of list_pred_card.1.1.2.

list_pred_card.1.2:

{-1} bijective?(restrict_to_image(f))
{-2} injective?(f)
{-3} (λ (i: below(length(l′))): nth(l′, i)) = f
{-4} is_finite(P′)
{-5} every(P′)(l′)
{-6} length(l′) > card(P′)

{1} (∃ (d: below(length[T ](l′))): true) ∨

(∀ (r:

(image[below(length(l′)), T ](f, fullset[below(length[T ](l′))]))): false)

{2} ∃ (n_{1}, n_{2}: below(length(l′))): ¬ n_{1} = n_{2} ∧ nth(l′, n_{1}) = nth(l′, n_{2})

Applying disjunctive simplification to flatten sequent, Hiding formulas: 3, Repeatedly Skolemizing and flattening, Expanding the definition of image, Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of list_pred_card.1.2.

list_pred_card.2:

{-1} (λ (i: below(length(l′))): nth(l′, i)) = f
{-2} is_finite(P′)
{-3} every(P′)(l′)
{-4} length(l′) > card(P′)
{1} injective?(f)
{2} ∃ (n_{1}, n_{2}: below(length(l′))): ¬ n_{1} = n_{2} ∧ nth(l′, n_{1}) = nth(l′, n_{2})

Expanding the definition of injective?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 2 with the terms: x′_{1}, x′_{2}, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -4, Simplifying, rewriting, and recording with decision procedures, This completes the proof of list_pred_card.2. Q.E.D.

C.99.7 Graph_Util.path_start_TCC1

Terse proof for path_start_TCC1.
path_start_TCC1:

{1} ∀ (l: (path_list?)): cons?[T ](l)

Repeatedly Skolemizing and flattening, Expanding the definition of path_list?, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of path_start_TCC1. Q.E.D.

C.99.8 Graph_Util.path_end_TCC1

Terse proof for path_end_TCC1.

path_end_TCC1:

{1} ∀ (l: (path_list?)):

length[T ](l) − 1 ≥ 0 ∧ length[T ](l) − 1 < length[T ](l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of path_end_TCC1. Q.E.D.

C.99.9 Graph_Util.path_list_induction_TCC1

Terse proof for path_list_induction_TCC1.
path_list_induction_TCC1:

{1} ∀ (t: T): path_list?(cons[T ](t, null[T ]))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_list? length Simplifying, rewriting, and recording with decision procedures,

This completes the proof of path_list_induction_TCC1.

Q.E.D.

C.99.10 Graph_Util.path_list_induction_TCC2

Terse proof for path_list_induction_TCC2.
path_list_induction_TCC2:

{1} ∀ (p: [(path_list?) → boolean]):

(∀ (t: T): p(cons(t, null))) ⊃ (∀ (t_{1}: T, tail: (path_list?)): p(tail) ⊃ path_list?(cons[T ](t_{1}, tail)))

Repeatedly Skolemizing and flattening, Hiding formulas: -2, -3, Installing automatic rewrites from: path_list? length Simplifying, rewriting, and recording with decision procedures,

This completes the proof of path_list_induction_TCC2.

Q.E.D.

C.99.11 Graph_Util.path_list_induction

Terse proof for path_list_induction.
path_list_induction:

{1} ∀ (p: [(path_list?) → boolean]):

(∀ (t: T): p(cons(t, null))) ∧ (∀ (t: T, tail: (path_list?)): p(tail) ⊃ p(cons(t, tail))) ⊃ (∀ (l: (path_list?)): p(l))

Skolemizing and flattening, Inducting on l on formula 1, we get 3 subgoals:

path_list_induction.1:

{-1} ∀ (t: T): p′(cons(t, null))
{-2} ∀ (t: T, tail: (path_list?)): p′(tail) ⊃ p′(cons(t, tail))
{1} path_list?(l′)
{2} p′(l′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_list_induction.1.

path_list_induction.2:

{-1} ∀ (t: T): p′(cons(t, null))
{-2} ∀ (t: T, tail: (path_list?)): p′(tail) ⊃ p′(cons(t, tail))
{1} path_list?(null) ⊃ p′(null)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_list? length Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_list_induction.2.

path_list_induction.3:

{-1} ∀ (t: T): p′(cons(t, null))
{-2} ∀ (t: T, tail: (path_list?)): p′(tail) ⊃ p′(cons(t, tail))

{1} ∀ (cons1_var: T, cons2_var: list[T ]): (path_list?(cons2_var) ⊃ p′(cons2_var)) ⊃ path_list?(cons(cons1_var, cons2_var)) ⊃ p′(cons(cons1_var, cons2_var))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: path_list? length Simplifying, rewriting, and recording with decision procedures, Case splitting on cons2_var!1 = null, we get 2 subgoals:

path_list_induction.3.1:

{-1} cons2_var′ = null
{-2} length(cons2_var′) ≥ 1 ⊃ p′(cons2_var′)
{-3} 1 + length(cons2_var′) ≥ 1
{-4} ∀ (t: T): p′(cons(t, null))
{-5} ∀ (t: T, tail: (path_list?)): p′(tail) ⊃ p′(cons(t, tail))
{1} p′(cons(cons1_var′, cons2_var′))

Hiding formulas: -2, -3, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of path_list_induction.3.1.

path_list_induction.3.2:

{-1} length(cons2_var′) ≥ 1 ⊃ p′(cons2_var′)
{-2} 1 + length(cons2_var′) ≥ 1
{-3} ∀ (t: T): p′(cons(t, null))
{-4} ∀ (t: T, tail: (path_list?)): p′(tail) ⊃ p′(cons(t, tail))
{1} cons2_var′ = null
{2} p′(cons(cons1_var′, cons2_var′))

Simplifying, rewriting, and recording with decision procedures, Rewriting using -4, matching in *, This completes the proof of path_list_induction.3.2. Q.E.D.

C.99.12 Graph_Util.concat_path_TCC1

Terse proof for concat_path_TCC1.
concat_path_TCC1:

{1} ∀ (lr: (concatable?)): cons?[T ](PROJ_2(lr))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of concat_path_TCC1. Q.E.D.

C.99.13 Graph_Util.concat_path_TCC2

Terse proof for concat_path_TCC2.
concat_path_TCC2:

{1} ∀ (lr: (concatable?)): path_list?(append[T ](PROJ_1(lr), cdr[T ](PROJ_2(lr))))

Repeatedly Skolemizing and flattening, Expanding the definition of concatable?, Applying disjunctive simplification to flatten sequent, Hiding formulas: -3, Expanding the definition of path_list?, Rewriting using length_append, matching in *, Rewriting using length_cdr, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of concat_path_TCC2. Q.E.D.

C.99.14 Graph_Util.length_concat_path

Terse proof for length_concat_path.
length_concat_path:

{1} ∀ (l, r: list[T ]):

concatable?(l, r) ⊃ length(concat_path(l, r)) = length(l) + length(r) − 1

Repeatedly Skolemizing and flattening, Expanding the definition of concat_path, Rewriting using length_append, matching in *, Rewriting using length_cdr, matching in *, we get 2 subgoals:

length_concat_path.1:

{-1} concatable?(l′, r′)
{1} length(r′) − 1 + length(l′) = length(l′) + length(r′) − 1

Simplifying, rewriting, and recording with decision procedures, This completes the proof of length_concat_path.1.

length_concat_path.2:

{-1} concatable?(l′, r′)
{1} length(r′) > 0
{2} length(cdr(r′)) = length(r′) − 1

Expanding the definition of concatable?, Expanding the definition of path_list?, which is trivially true. This completes the proof of length_concat_path.2. Q.E.D.

C.100 Proofs for Hoare (hoare.pvs)

C.100.1 Hoare.valid_TCC1

Terse proof for valid_TCC1.

C.100 Proofs for Hoare (hoare.pvs)

valid_TCC1:

{1} ∀ (P: PRED[State], c: [State → StmtResult[State]], s):

P (s) ∧ OK?(c(s)) ⊃ OK?[State](c(s)) ∨ Break?[State](c(s)) ∨ Continue?[State](c(s)) ∨ Return?[State](c(s)) ∨ Switch?[State](c(s)) ∨ Default?[State](c(s)) ∨ Exception?[State](c(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of valid_TCC1. Q.E.D.

C.100.2 Hoare.valid_TCC2

Terse proof for valid_TCC2.

valid_TCC2:

{1} ∀ (P: PRED[State], C: [StmtResult[State] → StmtResult[State]], s): P (s) ∧ OK?(C(OK(s))) ⊃ OK?[State](C(OK[State](s))) ∨ Break?[State](C(OK[State](s))) ∨ Continue?[State](C(OK[State](s))) ∨ Return?[State](C(OK[State](s))) ∨ Switch?[State](C(OK[State](s))) ∨ Default?[State](C(OK[State](s))) ∨ Exception?[State](C(OK[State](s)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of valid_TCC2. Q.E.D.

C.100.3 Hoare.valid_and

Terse proof for valid_and.

valid_and:

{1} ∀ (P, Q, R: PRED[State], c: [State → StmtResult[State]]): valid(P, c, Q) ∧ valid(P, c, R) ⊃

valid(P, c, λ (s: State): Q(s) ∧ R(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of valid_and. Q.E.D.

C.100.4 Hoare.valid_implied

Terse proof for valid_implied.

valid_implied:

{1} ∀ (P, Q, R: PRED[State], c: [State → StmtResult[State]]): valid(P, c, Q) ∧ valid(P, c, λ (s: State): Q(s) ⊃ R(s)) ⊃

valid(P, c, λ (s: State): Q(s) ∧ R(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of valid_implied. Q.E.D.

C.100.5 Hoare.Valid_and

Terse proof for Valid_and.

Valid_and:

{1} ∀ (P, Q, R: PRED[State], c: [State → StmtResult[State]]): Valid(P, c, Q) ∧ Valid(P, c, R) ⊃

Valid(P, c, λ (s: State): Q(s) ∧ R(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Valid_and. Q.E.D.

C.101 Proofs for IA32 (constants.pvs)

C.101.1 IA32.max_linear_offset_val

The L^{A}TEX code for this proof is broken.

C.101.2 IA32.mem_addr_4g_TCC1

Terse proof for mem_addr_4g_TCC1.
mem_addr_4g_TCC1:

{1} ∀ (a: Memory_Address_4G): in_memory(min_linear, max_linear)(a)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of mem_addr_4g_TCC1. Q.E.D.

C.102 Proofs for Import_All (everything.pvs)

This theory contains no provable formal statements.

C.103 Proofs for IntegralConversions (conversions.pvs)

This theory contains no provable formal statements.

C.104 Proofs for IntegralPromotions (conversions.pvs)

C.104 Proofs for IntegralPromotions (conversions.pvs)

C.104.1 IntegralPromotions.int_conversion_TCC1

Terse proof for int_conversion_TCC1.
int_conversion_TCC1:

{1} ∃ (x: [typ: Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] ({t: Cpp_Type | char?(t) ∨ schar?(t) ∨ uchar?(t) ∨ short?(t) ∨ ushort?(t)}))) → [(range(typ)) → (range(int))]]): true

Instantiating the top quantifier in 1 with the terms: (λ (typ: Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] ({t: Cpp_Type | char?(t) ∨ schar?(t) ∨ uchar?(t) ∨ short?(t) ∨ ushort?(t)})))): λ (r: (range(typ))): 0),

we get 2 subgoals:

int_conversion_TCC1.1:

{1} true

which is trivially true. This completes the proof of int_conversion_TCC1.1.

int_conversion_TCC1.2:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] ({t: Cpp_Type |

char?(t) ∨ schar?(t) ∨ uchar?(t) ∨ short?(t) ∨ ushort?(t)}))),

r: (range(typ))): range(int)(0)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, Rewriting using int_binary, matching in *, Using lemma min_int, Using lemma max_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of int_conversion_TCC1.2. Q.E.D.

C.104.2 IntegralPromotions.int_conversion_spec_TCC1

Terse proof for int_conversion_spec_TCC1.

int_conversion_spec_TCC1:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] ({t: Cpp_Type |

char?(t) ∨ schar?(t) ∨ uchar?(t) ∨ short?(t) ∨ ushort?(t)}))),

n: (range(typ))): Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Applying propositional simplification, we get 2 subgoals:

int_conversion_spec_TCC1.1:

{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of int_conversion_spec_TCC1.1.
int_conversion_spec_TCC1.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of int_conversion_spec_TCC1.2.

Q.E.D.

C.104.3 IntegralPromotions.int_conversion_TCC2

Terse proof for int_conversion_TCC2.
int_conversion_TCC2:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] ({t: Cpp_Type |

char?(t) ∨ schar?(t) ∨ uchar?(t) ∨ short?(t) ∨ ushort?(t)})))):

cv(non_bool_integral_enum?)(typ)

C.104 Proofs for IntegralPromotions (conversions.pvs)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of int_conversion_TCC2. Q.E.D.

C.104.4 IntegralPromotions.int_conversion_TCC3

Terse proof for int_conversion_TCC3.
int_conversion_TCC3:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] ({t: Cpp_Type |

char?(t) ∨ schar?(t) ∨ uchar?(t) ∨ short?(t) ∨ ushort?(t)})))):

Cpp_Type?(int) ∧ cv(non_bool_integral_enum?)(int)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Applying propositional simplification, we get 2 subgoals:

int_conversion_TCC3.1:

{1} Cpp_Type?(int)

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of int_conversion_TCC3.1.

int_conversion_TCC3.2:

{1} cv(non_bool_integral_enum?)(int)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of int_conversion_TCC3.2. Q.E.D.

C.104.5 IntegralPromotions.bool2int_TCC1

Terse proof for bool2int_TCC1.

bool2int_TCC1:

{1} ∀ (b: bool): b ⊃ range(int)(1)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using int_binary, matching in *, Using lemma min_int, Using lemma max_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bool2int_TCC1. Q.E.D.

C.104.6 IntegralPromotions.bool2int_TCC2

Terse proof for bool2int_TCC2.

bool2int_TCC2:

{1} ∀ (b: bool): ¬ b ⊃ range(int)(0)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Expanding the definition of range_integral, Rewriting using int_binary, matching in *, Using lemma max_int, Using lemma min_int, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of bool2int_TCC2. Q.E.D.

C.105 Proofs for Interpreted_Data (abstract_data.pvs)

C.105.1 Interpreted_Data.interpreted_data_type?_TCC1

Terse proof for interpreted_data_type?_TCC1.
interpreted_data_type?_TCC1:

{1} ∀ (idt: Interpreted_data_type): (∀ (l: list[Byte], a: Address): valid?(uidt(idt))(l, a) ≡ up?(from_byte(idt)(l, a))) ∧ (∀ (d: Data, a: Address): valid?(uidt(idt))(to_byte(idt)(d, a), a)) ∧ uninterpreted_data_type?(idt`uidt) ⊃ (∀ (d_{1}: Data, a_{1}: Address): up?[Data](from_byte(idt)(to_byte(idt)(d_{1}, a_{1}), a_{1})))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

C.105 Proofs for Interpreted_Data (abstract_data.pvs)

This completes the proof of interpreted_data_type?_TCC1.

Q.E.D.

C.105.2 Interpreted_Data.pod_is_interpreted_data

Terse proof for pod_is_interpreted_data.
pod_is_interpreted_data:

{1} ∀ (x: (pod_data_type?)): interpreted_data_type?(x)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pod_is_interpreted_data. Q.E.D.

C.105.3 Interpreted_Data.pod_size

Terse proof for pod_size.

pod_size:

{1} ∀ (dt: (pod_data_type?)): size(uidt(dt)) > 0

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pod_data_type?, which is trivially true. This completes the proof of pod_size. Q.E.D.

C.105.4 Interpreted_Data.data_type_length

Terse proof for data_type_length.
data_type_length:

{1} ∀ (addr: Address, idt: (interpreted_data_type?), l: list[Byte]): valid?(uidt(idt))(l, addr) ⊃ length(l) = size(uidt(idt))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of data_type_length. Q.E.D.

C.105.5 Interpreted_Data.length_to_byte

Terse proof for length_to_byte.
length_to_byte:

{1} ∀ (addr: Address, idt: (interpreted_data_type?), data: Data): length(to_byte(idt)(data, addr)) = size(uidt(idt))

Repeatedly Skolemizing and flattening, Expanding the definition of interpreted_data_type?, Expanding the definition of uninterpreted_data_type?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -1 with the terms: (to_byte(idt!1)(data!1, addr!1) addr!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, This completes the proof of length_to_byte. Q.E.D.

C.105.6 Interpreted_Data.valid_from_byte

Terse proof for valid_from_byte.
valid_from_byte:

{1} ∀ (addr: Address, idt: (interpreted_data_type?), l: list[Byte]): idt`uidt`valid?(l, addr) ⊃ up?(from_byte(idt)(l, addr))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of valid_from_byte. Q.E.D.

C.105.7 Interpreted_Data.valid_iff_from_byte

Terse proof for valid_iff_from_byte.
valid_iff_from_byte:

{1} ∀ (addr: Address, idt: (interpreted_data_type?), l: list[Byte]): idt`uidt`valid?(l, addr) ⇔ up?(from_byte(idt)(l, addr))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of valid_iff_from_byte. Q.E.D.

C.105.8 Interpreted_Data.valid_to_byte

Terse proof for valid_to_byte.

valid_to_byte:

{1} ∀ (addr: Address, idt: (interpreted_data_type?), data: Data): idt`uidt`valid?(to_byte(idt)(data, addr), addr)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of valid_to_byte. Q.E.D.

C.105.9 Interpreted_Data.up_from_byte_to_byte

Terse proof for up_from_byte_to_byte.
up_from_byte_to_byte:

{1} ∀ (addr: Address, idt: (interpreted_data_type?), data: Data): up?(from_byte(idt)(to_byte(idt)(data, addr), addr))

C.106 Proofs for Interpreted_Data_Lift (abstract_data.pvs)

Repeatedly Skolemizing and flattening, Expanding the definition of interpreted_data_type?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of up_from_byte_to_byte. Q.E.D.

C.105.10 Interpreted_Data.from_byte_to_byte

Terse proof for from_byte_to_byte.
from_byte_to_byte:

{1} ∀ (addr: Address, idt: (interpreted_data_type?), data: Data): from_byte(idt)(to_byte(idt)(data, addr), addr) = up(data)

Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of from_byte_to_byte. Q.E.D.

C.105.11 Interpreted_Data.in_blessed_memory_subset

Terse proof for in_blessed_memory_subset.
in_blessed_memory_subset:

{1} ∀ (addr: Address, idt: (interpreted_data_type?), address_range: PRED[Address]): in_blessed_memory?(idt, addr, address_range) ⊃ (address_block(addr, size(uidt(idt))) ⊆ address_range)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of in_blessed_memory_subset.

Q.E.D.

C.106 Proofs for Interpreted_Data_Lift (abstract_data.pvs)

This theory contains no provable formal statements.

C.107 Proofs for IterationStatements1 (statements.pvs)

C.107.1 IterationStatements1.iterate_while_TCC1

Terse proof for iterate_while_TCC1.
iterate_while_TCC1:

{1} ∀ (n: nat, s: State): ¬ n = 0 ⊃ n − 1 ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_while_TCC1. Q.E.D.

C.107.2 IterationStatements1.iterate_while_TCC2

Terse proof for iterate_while_TCC2.
iterate_while_TCC2:

{1} ∀ (n: nat, s: State): ¬ n = 0 ⊃ n − 1 < n

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_while_TCC2. Q.E.D.

C.107.3 IterationStatements1.while_termination_point?_TCC1

Terse proof for while_termination_point?_TCC1.
while_termination_point?_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, n: nat, res: StmtResult[State]): OK?(res) ∧ res = iterate_while(n, b_ex, body)(s) ⊃ OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_termination_point?_TCC1.

Q.E.D.

C.107.4 IterationStatements1.while_TCC1

Terse proof for while_TCC1.

while_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State): (∃ (n: nat): while_termination_point?(b_ex, body, s)(n)) ⊃ nonempty?[nat](while_termination_point?(b_ex, body, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of while_TCC1. Q.E.D.

C.107.5 IterationStatements1.nonzero_min_while_termination_point

Terse proof for nonzero_min_while_termination_point.

C.107 Proofs for IterationStatements1 (statements.pvs)

nonzero_min_while_termination_point:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State): (∃ (n: nat): while_termination_point?(b_ex, body, s)(n)) ∧ ¬ min[nat](while_termination_point?(b_ex, body, s)) = 0 ⊃ OK?(b_ex(s)) ∧ data(b_ex(s))

Repeatedly Skolemizing and flattening, Rewriting using min_def, matching in *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of nonzero_min_while_termination_point.

Q.E.D.

C.107.6 IterationStatements1.while_as_if_while

Terse proof for while_as_if_while.
while_as_if_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]): while(b_ex, body) = if_else(b_ex, body ## catch_continue ## while(b_ex, body) ## catch_break, skip)

Expanding the definition of while, Expanding the definition of if_else, Repeatedly Skolemizing and flattening, Applying decompose-equality, we get 3 subgoals:

while_as_if_while.1:

{1} if ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

then (iterate_while(min[nat](while_termination_point?(b_ex′, body′, x′)), b_ex′,

body′)

## e2s(b_ex′) ## catch_break) (x′)

else Hang endif = (b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif))

(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

C.107 Proofs for IterationStatements1 (statements.pvs)

while_as_if_while.1.1:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

{1} (iterate_while(min[nat](while_termination_point?(b_ex′, body′, x′)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (x′)

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif))

(x′)

Case splitting on min(while_termination_point?(b_ex!1, body!1, x!1)) = 0,

we get 2 subgoals:

while_as_if_while.1.1.1:

{-1} min(while_termination_point?(b_ex′, body′, x′)) = 0
{-2} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

{1} (iterate_while(min[nat](while_termination_point?(b_ex′, body′, x′)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (x′)

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif))

(x′)

Replacing using formula -1,

Rewriting using min_def, matching in *,

Expanding the definition of minimum?,

Expanding the definition of while_termination_point?,

Expanding the definition of iterate_while,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.1.1.1.

while_as_if_while.1.1.2:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} (iterate_while(min[nat](while_termination_point?(b_ex′, body′, x′)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (x′)

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif))

(x′)

Using lemma nonzero_min_while_termination_point,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of iterate_while,

Expanding the definition of ##,

Expanding the definition of lift,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

while_as_if_while.1.1.2.1:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-2} OK?(b_ex′(x′))
{-3} data(b_ex′(x′))
{-4} OK?(e2s(b_ex′)(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} catch_break(lift(e2s(b_ex′))

(lift(iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′))

(catch_continue(body′(state(e2s(b_ex′)(x′)))))))

=

catch_break(lift(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then catch_break(lift(e2s(b_ex′))

(iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, s)),

b_ex′, body′)

(s)))

else Hang endif)

(catch_continue(body′(state(b_ex′(x′))))))

Expanding the definition of e2s,

Expanding the definition of lift,

Case splitting on OK?(catch_continue(body!1(state(b_ex!1(x!1))))),

we get 2 subgoals:

while_as_if_while.1.1.2.1.1:

{-1} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-2} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-3} OK?(b_ex′(x′))
{-4} data(b_ex′(x′))
{-5} OK?(e2s(b_ex′)(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} catch_break(cases cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

catch_break(cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, state_1)(n)

then catch_break(cases iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, state_1)),

b_ex′, body′) (state_1) of

OK(state_1): e2s(b_ex′)(state_1) else iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, state_1)),

b_ex′, body′) (state_1)

endcases)

else Hang endif

else catch_continue(body′(state(b_ex′(x′))))

endcases)

Simplifying, rewriting, and recording with decision procedures,

Case splitting on EXISTS (n: nat): while_termination_point?(b_ex!1, body!1, state(catch_continue (body!1(state(b_ex!1(x!1)))))) (n),

we get 2 subgoals:

while_as_if_while.1.1.2.1.1.1:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} catch_break(cases iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state(catch_continue(body′(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

if ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n) then catch_break(catch_break(cases iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, state (catch_continue (body′ (state

(b_ex′(x′))))))),

b_ex′, body′) (state(catch_continue

(body′

(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1) else iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, state (catch_continue (body′ (state

(b_ex′(x′))))))),

b_ex′, body′) (state(catch_continue

(body′

(state(b_ex′(x′))))))

endcases))

else catch_break(Hang)

endif

1268

C.107 Proofs for IterationStatements1 (statements.pvs)

Replacing using formula -1, Case splitting on min(while_termination_point?(b_ex!1, body!1, x!1)) - 1 = min(while_termination_point?(b_ex!1,

body!1, state(catch_continue (body!1(state(b_ex!1(x!1))))))), we get 2 subgoals:

while_as_if_while.1.1.2.1.1.1.1:

{-1} min(while_termination_point? (b_ex′, body′, x′)) − 1 =

min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{-2} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-3} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-4} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-5} OK?(b_ex′(x′))
{-6} data(b_ex′(x′))
{-7} OK?(e2s(b_ex′)(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0

{2} catch_break(cases iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state(catch_continue(body′(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

catch_break(catch_break(cases iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, state (catch_continue (body′ (state (b_ex′

(x′))))))),

b_ex′, body′) (state(catch_continue(body′

(state (b_ex′

(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, state (catch_continue (body′ (state (b_ex′

(x′))))))),

b_ex′, body′) (state(catch_continue(body′

(state

(b_ex′(x′))))))

endcases))

C.107 Proofs for IterationStatements1 (statements.pvs)

Replacing using formula -1, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.1.1.2.1.1.1.1.

while_as_if_while.1.1.2.1.1.1.2:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))

{1} min(while_termination_point? (b_ex′, body′, x′)) − 1 =

min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

{3} catch_break(cases iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state(catch_continue(body′(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

catch_break(catch_break(cases iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, state (catch_continue (body′ (state (b_ex′

(x′))))))),

b_ex′, body′) (state(catch_continue(body′

(state (b_ex′

(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else iterate_while(min[nat]

(while_termination_point?(b_ex′, body′, state (catch_continue (body′ (state (b_ex′

(x′))))))),

b_ex′, body′) (state(catch_continue(body′

(state

(b_ex′(x′))))))

endcases))

Hiding formulas: 3,

Rewriting using min_plus1, matching in *,

we get 2 subgoals:

while_as_if_while.1.1.2.1.1.1.2.1:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))

{1} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{2} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) = 0

Case splitting on (LAMBDA (n: nat): while_termination_point?(b_ex!1, body!1, x!1)(1 + n)) = while_termination_point?(b_ex!1, body!1, state(catch_continue (body!1(state(b_ex!1(x!1)))))),

we get 2 subgoals:

while_as_if_while.1.1.2.1.1.1.2.1.1:

{-1} (λ (n: nat): while_termination_point?(b_ex′, body′, x′)(1 + n)) =

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′))))))

{-2} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-3} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-4} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-5} OK?(b_ex′(x′))
{-6} data(b_ex′(x′))
{-7} OK?(e2s(b_ex′)(x′))

{1} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{2} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) = 0

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of while_as_if_while.1.1.2.1.1.1.2.1.1.

while_as_if_while.1.1.2.1.1.1.2.1.2:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))

{1} (λ (n: nat): while_termination_point?(b_ex′, body′, x′)(1 + n)) =

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′))))))

{2} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{3} 1 + min(λ (n : nat) : while_termination_point? (b_ex′, body′, x′)(1 + n)) = 0

Hiding formulas: (2 3),

Applying decompose-equality,

Expanding the definition of while_termination_point?,

Expanding the definition of iterate_while,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.1.1.2.1.1.1.2.1.2.
while_as_if_while.1.1.2.1.1.1.2.2:

{-1} while_termination_point?(b_ex′, body′, x′)(0)
{-2} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{-3} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-4} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-5} OK?(b_ex′(x′))
{-6} data(b_ex′(x′))
{-7} OK?(e2s(b_ex′)(x′))

{1} min(while_termination_point? (b_ex′, body′, x′)) − 1 = min(while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))))

{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

Hiding formulas: 1,

Rewriting using min_def, matching in *,

Expanding the definition of minimum?,

which is trivially true.

This completes the proof of while_as_if_while.1.1.2.1.1.1.2.2.

while_as_if_while.1.1.2.1.1.2:

{-1} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-2} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-3} OK?(b_ex′(x′))
{-4} data(b_ex′(x′))
{-5} OK?(e2s(b_ex′)(x′))

{1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

{3} catch_break(cases iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state(catch_continue(body′(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

if ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n) then catch_break(catch_break(cases iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, state (catch_continue (body′ (state

(b_ex′(x′))))))),

b_ex′, body′) (state(catch_continue

(body′

(state(b_ex′(x′)))))) of

OK(state_1): e2s(b_ex′)(state_1) else iterate_while(min[nat]

(while_termination_point?

(b_ex′, body′, state (catch_continue (body′ (state

(b_ex′(x′))))))),

b_ex′, body′) (state(catch_continue

(body′

(state(b_ex′(x′))))))

endcases))

else catch_break(Hang)

endif

1275

Hiding formulas: 3, Repeatedly Skolemizing and flattening, Case splitting on n!1 = 0, we get 2 subgoals:

while_as_if_while.1.1.2.1.1.2.1:

{-1} n′ = 0
{-2} n′ ≥ 0
{-3} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-4} while_termination_point?(b_ex′, body′, x′)(n′)
{-5} OK?(b_ex′(x′))
{-6} data(b_ex′(x′))
{-7} OK?(e2s(b_ex′)(x′))

{1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

Replacing using formula -1, Rewriting using min_def, matching in *, Expanding the definition of minimum?, which is trivially true.

This completes the proof of while_as_if_while.1.1.2.1.1.2.1.
while_as_if_while.1.1.2.1.1.2.2:

{-1} n′ ≥ 0
{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} while_termination_point?(b_ex′, body′, x′)(n′)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))
{1} n′ = 0

{2} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n)

{3} min(while_termination_point?(b_ex′, body′, x′)) = 0

Instantiating the top quantifier in 2 with the terms: n′ − 1, we get 2 subgoals:

while_as_if_while.1.1.2.1.1.2.2.1:

{-1} n′ ≥ 0
{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} while_termination_point?(b_ex′, body′, x′)(n′)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))
{1} n′ = 0

{2} while_termination_point?(b_ex′, body′,

state(catch_continue(body′(state(b_ex′(x′)))))) (n′ − 1)

{3} min(while_termination_point?(b_ex′, body′, x′)) = 0

C.107 Proofs for IterationStatements1 (statements.pvs)

Hiding formulas: 3, Expanding the definition of while_termination_point?, Expanding the definition of iterate_while, Applying disjunctive simplification to flatten sequent, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.1.1.2.1.1.2.2.1.
while_as_if_while.1.1.2.1.1.2.2.2:

{-1} n′ ≥ 0
{-2} OK?(catch_continue(body′(state(b_ex′(x′)))))
{-3} while_termination_point?(b_ex′, body′, x′)(n′)
{-4} OK?(b_ex′(x′))
{-5} data(b_ex′(x′))
{-6} OK?(e2s(b_ex′)(x′))
{1} n′ − 1 ≥ 0
{2} n′ = 0
{3} min(while_termination_point?(b_ex′, body′, x′)) = 0

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of while_as_if_while.1.1.2.1.1.2.2.2.

while_as_if_while.1.1.2.1.2:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-2} OK?(b_ex′(x′))
{-3} data(b_ex′(x′))
{-4} OK?(e2s(b_ex′)(x′))
{1} OK?(catch_continue(body′(state(b_ex′(x′)))))
{2} min(while_termination_point?(b_ex′, body′, x′)) = 0

{3} catch_break(cases cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases of

OK(state_1): e2s(b_ex′)(state_1)

else cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′) (state_1) else catch_continue(body′(state(b_ex′(x′)))) endcases

endcases)

=

catch_break(cases catch_continue(body′(state(b_ex′(x′)))) of

OK(state_1):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, state_1)(n)

then catch_break(cases iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, state_1)),

b_ex′, body′) (state_1) of

OK(state_1): e2s(b_ex′)(state_1) else iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, state_1)),

b_ex′, body′) (state_1)

endcases)

else Hang endif

else catch_continue(body′(state(b_ex′(x′))))

endcases)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of while_as_if_while.1.1.2.1.2.

while_as_if_while.1.1.2.2:

{-1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{-2} OK?(b_ex′(x′))
{-3} data(b_ex′(x′))
{1} min(while_termination_point?(b_ex′, body′, x′)) = 0
{2} OK?(e2s(b_ex′)(x′))

{3} catch_break(lift(e2s(b_ex′))

(lift(iterate_while(min [nat](while_termination_point? (b_ex′, body′, x′)) − 1,

b_ex′, body′))

(catch_continue(e2s(b_ex′)(x′)))))

=

catch_break(lift(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then catch_break(lift(e2s(b_ex′))

(iterate_while(min[nat]

(while_termination_point? (b_ex′, body′, s)),

b_ex′, body′)

(s)))

else Hang endif)

(catch_continue(body′(state(b_ex′(x′))))))

Expanding the definition of e2s, which is trivially true.

This completes the proof of while_as_if_while.1.1.2.2.
while_as_if_while.1.2:

{1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{2} Hang?((b_ex′ ##
(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif))

(x′))

Copying formula number: 1 Copying formula number: 1 Instantiating the top quantifier in 1 with the terms: 0, Instantiating the top quantifier in 2 with the terms: 1, Expanding the definition of while_termination_point?, Expanding the definition of iterate_while, Expanding the definition of iterate_while, Expanding the definition of skip, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on EXISTS (n: nat): while_termination_point?(b_ex!1, body!1, state((e2s(b_ex!1) ##

body!1 ## catch_continue ## (LAMBDA (s): OK(s))) (x!1))) (n), we get 2 subgoals:

while_as_if_while.1.2.1:

{-1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′)))

(n)

{-2} OK?(b_ex′(x′))
{-3} data(b_ex′(x′))
{-4} OK?((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))(x′))

{-5} OK?(b_ex′(state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′))))

{-6} data(b_ex′(state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′))))

{1} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)

{2} Hang?((b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else λ (s: State): OK(s)

endif)) (x′))

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (n′ + 1), Expanding the definition of while_termination_point?, Expanding the definition of iterate_while, Applying disjunctive simplification to flatten sequent, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of while_as_if_while.1.2.1.

while_as_if_while.1.2.2:

{-1} OK?(b_ex′(x′))
{-2} data(b_ex′(x′))
{-3} OK?((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))(x′))

{-4} OK?(b_ex′(state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′))))

{-5} data(b_ex′(state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′))))

{1} ∃ (n: nat):

while_termination_point?(b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue ## (λ (s): OK(s)))

(x′)))

(n)

{2} ∃ (n: nat): while_termination_point?(b_ex′, body′, x′)(n)
{3} Hang?((b_ex′ ##
(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat]

(while_termination_point?(b_ex′,

body′,
s)),
b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else λ (s: State): OK(s)

endif)) (x′))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.1.2.2.

while_as_if_while.2:

{1} ∀ (b: bool):
b ⊃
(∀ (s: State):

(∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)) ⊃ nonempty?[nat](while_termination_point?(b_ex′, body′, s)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of while_as_if_while.2.

while_as_if_while.3:

{1} ∀ (s: State):

(∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)) ⊃ nonempty?[nat](while_termination_point?(b_ex′, body′, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of while_as_if_while.3. Q.E.D.

C.107.7 IterationStatements1.iterate_do_as_while

Terse proof for iterate_do_as_while.
iterate_do_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], n: nat): iterate_do(n, body, b_ex) = (body ## catch_continue ## iter- ate_while(n, b_ex, body))

Inducting on n on formula 1, we get 2 subgoals:

iterate_do_as_while.1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]): iterate_do(0, body, b_ex) = (body ## catch_continue ## iter- ate_while(0, b_ex, body))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, Applying decompose-equality, This completes the proof of iterate_do_as_while.1.

iterate_do_as_while.2:

{1} ∀ j:

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]):

iterate_do(j, body, b_ex) = (body ## catch_continue ## iterate_while(j, b_ex, body)))

⊃

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]):

iterate_do(j + 1, body, b_ex) =

(body ## catch_continue ## iterate_while(j + 1, b_ex, body)))

Repeatedly Skolemizing and flattening, Expanding the definition of iterate_do, Expanding the definition of iterate_while, Applying decompose-equality, Instantiating quantified variables, Replacing using formula -2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_do_as_while.2. Q.E.D.

C.107.8 IterationStatements1.do_termination_point?_TCC1

Terse proof for do_termination_point?_TCC1.
do_termination_point?_TCC1:

{1} ∀ (body: [State → StmtResult[State]], b_ex: [State → ExprResult[State, bool]], s: State, n: nat, res: StmtResult[State]): OK?(res) ∧ res = iterate_do(n, body, b_ex)(s) ⊃ OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of do_termination_point?_TCC1.

Q.E.D.

C.107.9 IterationStatements1.termination_point_do_as_while_TCC1

Terse proof for termination_point_do_as_while_TCC1.
termination_point_do_as_while_TCC1:

{1} ∀ (body: [State → StmtResult[State]], s: State): OK?((body ## catch_continue)(s)) ⊃ OK?[State]((##[State](body, catch_continue[State]))(s)) ∨ Break?[State]((##[State](body, catch_continue[State]))(s)) ∨ Continue?[State]((##[State](body, catch_continue[State]))(s)) ∨ Return?[State]((##[State](body, catch_continue[State]))(s)) ∨ Switch?[State]((##[State](body, catch_continue[State]))(s)) ∨ Default?[State]((##[State](body, catch_continue[State]))(s)) ∨ Exception?[State]((##[State](body, catch_continue[State]))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of termination_point_do_as_while_TCC1.

Q.E.D.

C.107.10 IterationStatements1.termination_point_do_as_while

Terse proof for termination_point_do_as_while.

termination_point_do_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State): OK?((body ## catch_continue)(s)) ⊃ do_termination_point?(body, b_ex, s) = while_termination_point?(b_ex, body, state((body ## catch_continue)(s)))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Expanding the definition of do_termination_point?, Expanding the definition of while_termination_point?, Rewriting using iterate_do_as_while, matching in *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of termination_point_do_as_while.

Q.E.D.

C.107.11 IterationStatements1.do_while_TCC1

Terse proof for do_while_TCC1.

do_while_TCC1:

{1} ∀ (body: [State → StmtResult[State]], b_ex: [State → ExprResult[State, bool]], s: State): (∃ (n: nat): do_termination_point?(body, b_ex, s)(n)) ⊃ nonempty?[nat](do_termination_point?(body, b_ex, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_while_TCC1. Q.E.D.

C.107.12 IterationStatements1.do_as_while

Terse proof for do_as_while.

do_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]): do_while(body, b_ex) = (body ## catch_continue ## while(b_ex, body) ## catch_break)

Repeatedly Skolemizing and flattening, Expanding the definition of do_while, Expanding the definition of while, Applying decompose-equality, we get 3 subgoals:

do_as_while.1:

{1} if ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n) then (iterate_do(min[nat](do_termination_point?(body′, b_ex′, x′)), body′, b_ex′) ## e2s(b_ex′) ## catch_break) (x′) else Hang endif = ((body′ ## catch_continue ## (λ (s: State): if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n) then (iterate_while(min[nat](while_termination_point?(b_ex′, body′, s)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (s) else Hang endif)) ## catch_break) (x′)

Installing automatic rewrites from: (iterate_do_as_while! termination_point_do_as_while!) Case splitting on OK?((body!1 ## catch_continue)(x!1)), we get 2 subgoals:

do_as_while.1.1:

{-1} OK?((body′ ## catch_continue)(x′)) ; {1} if ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n) then (iterate_do(min[nat](do_termination_point?(body′, b_ex′, x′)), body′, b_ex′) ## e2s(b_ex′) ## catch_break) (x′) else Hang endif = ((body′ ## catch_continue ## (λ (s: State): if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n) then (iterate_while(min[nat](while_termination_point?(b_ex′, body′, s)), b_ex′, body′) ## e2s(b_ex′) ## catch_break) (s) else Hang endif)) ## catch_break) (x′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.1.1.

do_as_while.1.2:

{1} OK?((body′ ## catch_continue)(x′))

{2} if ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n)

then (iterate_do(min[nat](do_termination_point?(body′, b_ex′, x′)), body′, b_ex′) ## e2s(b_ex′) ## catch_break) (x′)

else Hang endif = ((body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)

then (iterate_while(min[nat](while_termination_point?(b_ex′, body′, s)),

b_ex′, body′)

## e2s(b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break) (x′)

Trying repeated skolemization, instantiation, and if-lifting, we get 2 subgoals:

do_as_while.1.2.1:

{-1} Break?(body′(x′))
{1} ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n)

Instantiating the top quantifier in 1 with the terms: 0, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.1.2.1.

do_as_while.1.2.2:

{1} Continue?(body′(x′))
{2} OK?(body′(x′))
{3} ∃ (n: nat): do_termination_point?(body′, b_ex′, x′)(n)
{4} Hang?(body′(x′))

Instantiating the top quantifier in 3 with the terms: 0, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.1.2.2.

do_as_while.2:

{1} ∀ (s: State):

(∃ (n: nat): while_termination_point?(b_ex′, body′, s)(n)) ⊃ nonempty?[nat](while_termination_point?(b_ex′, body′, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.2.

do_as_while.3:

{1} ∀ (s: State):

(∃ (n: nat): do_termination_point?(body′, b_ex′, s)(n)) ⊃ nonempty?[nat](do_termination_point?(body′, b_ex′, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of do_as_while.3. Q.E.D.

C.107.13 IterationStatements1.do_while_unroll

Terse proof for do_while_unroll.
do_while_unroll:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], max: nat): do_while(max, body, b_ex) = (body ## catch_continue ## while(max, b_ex, body) ## catch_break)

Repeatedly Skolemizing and flattening, Expanding the definition of do_while, Expanding the definition of while, Rewriting using do_as_while, matching in *, This completes the proof of do_while_unroll. Q.E.D.

C.108 Proofs for IterationStatements2 (statements.pvs)

C.108.1 IterationStatements2.iterate_for_TCC1

Terse proof for iterate_for_TCC1.
iterate_for_TCC1:

{1} ∀ (n: nat, s: State): ¬ n = 0 ⊃ n − 1 ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_for_TCC1. Q.E.D.

C.108.2 IterationStatements2.iterate_for_TCC2

Terse proof for iterate_for_TCC2.
iterate_for_TCC2:

{1} ∀ (n: nat, s: State): ¬ n = 0 ⊃ n − 1 < n

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_for_TCC2. Q.E.D.

C.108.3 IterationStatements2.iterate_for_as_while_TCC1

Terse proof for iterate_for_as_while_TCC1.
iterate_for_as_while_TCC1:

{1} ∀ (n: nat): n > 0 ⊃ n − 1 ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of iterate_for_as_while_TCC1.

Q.E.D.

C.108.4 IterationStatements2.iterate_for_as_while

Terse proof for iterate_for_as_while.
iterate_for_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], n: nat): n > 0 ⊃ iterate_for(n, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ## iterate_while(n − 1, expr ## b_ex, body)

## e2s(expr))

Inducting on n on formula 1,

we get 3 subgoals:

iterate_for_as_while.1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]]): 0 > 0 ⊃ iterate_for(0, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ## iterate_while(0 − 1, expr ## b_ex, body) ##

e2s(expr))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of iterate_for_as_while.1.

iterate_for_as_while.2:

{1} ∀ j:

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]]): j > 0 ⊃ iterate_for(j, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ## iterate_while(j − 1, expr ## b_ex, body) ## e2s(expr)))

⊃

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]]): j + 1 > 0 ⊃ iterate_for(j + 1, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ##

iterate_while(j + 1 − 1, expr ## b_ex, body) ## e2s(expr)))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Applying decompose-equality,

Case splitting on j!1 = 0,

we get 2 subgoals:

iterate_for_as_while.2.1:

{-1} j′ = 0
{-2} j′ ≥ 0
{-3} j′ > 0 ⊃

iterate_for(j′, b_ex′, expr′, body′) =

(e2s(b_ex′) ## body′ ## catch_continue ## iterate_while(j′ − 1, expr′ ## b_ex′, body′) ## e2s(expr′))

{-4} 1 + j′ > 0

{1} iterate_for(1 + j′, b_ex′, expr′, body′)(x′) =

(e2s(b_ex′) ## body′ ## catch_continue ## iterate_while(j′, expr′ ## b_ex′, body′) ## e2s(expr′))

(x′)

Replacing using formula -1,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of iterate_for_as_while.2.1.

iterate_for_as_while.2.2:

{-1} j′ ≥ 0
{-2} j′ > 0 ⊃

iterate_for(j′, b_ex′, expr′, body′) =

(e2s(b_ex′) ## body′ ## catch_continue ## iterate_while(j′ − 1, expr′ ## b_ex′, body′) ## e2s(expr′))

{-3} 1 + j′ > 0
{1} j′ = 0

{2} iterate_for(1 + j′, b_ex′, expr′, body′)(x′) =

(e2s(b_ex′) ## body′ ## catch_continue ## iterate_while(j′, expr′ ## b_ex′, body′) ## e2s(expr′))

(x′)

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of iterate_for, Expanding the definition of iterate_while, Replacing using formula -2, Keeping (2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of iterate_for_as_while.2.2.
iterate_for_as_while.3:

{1} ∀ (n: nat): n > 0 ⊃ n − 1 ≥ 0

{2} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]]): n′ > 0 ⊃ iterate_for(n′, b_ex, expr, body) = (e2s(b_ex) ## body ## catch_continue ## iterate_while(n′ − 1, expr ## b_ex, body)

## e2s(expr))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of iterate_for_as_while.3. Q.E.D.

C.108.5 IterationStatements2.for_termination_point?_TCC1

Terse proof for for_termination_point?_TCC1.
for_termination_point?_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]],

expr: [State → ExprResult[State, ExprData]], body: [State → StmtResult[State]],

s: State, n: nat, res: StmtResult[State]): OK?(res) ∧ res = iterate_for(n, b_ex, expr, body)(s) ⊃ OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_termination_point?_TCC1.

Q.E.D.

C.108.6 IterationStatements2.termination_point_for_as_while_TCC1

Terse proof for termination_point_for_as_while_TCC1.
termination_point_for_as_while_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

s: State, n: nat): n > 0 ∧ OK?((e2s(b_ex) ## body ## catch_continue)(s)) ⊃ OK?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Break?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Continue?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Return?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Switch?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Default?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Exception?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of termination_point_for_as_while_TCC1.

Q.E.D.

C.108.7 IterationStatements2.termination_point_for_as_while

Terse proof for termination_point_for_as_while.
termination_point_for_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State, n: nat): n > 0 ∧ OK?((e2s(b_ex) ## body ## catch_continue)(s)) ⊃ for_termination_point?(b_ex, expr, body, s)(n) = while_termination_point?(expr ## b_ex, body, state((e2s(b_ex) ## body ## catch_continue)(s))) (n − 1)

Repeatedly Skolemizing and flattening, Expanding the definition of for_termination_point?, Expanding the definition of while_termination_point?, Rewriting using iterate_for_as_while, matching in *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of termination_point_for_as_while.

Q.E.D.

C.108.8 IterationStatements2.min_termination_point_for_as_while_TCC1

Terse proof for min_termination_point_for_as_while_TCC1.
min_termination_point_for_as_while_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State): (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)) ∧ OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) ⊃ nonempty?[nat](for_termination_point?(b_ex, expr, body, s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of min_termination_point_for_as_while_TCC1.

Q.E.D.

C.108.9 IterationStatements2.min_termination_point_for_as_while_TCC2

Terse proof for min_termination_point_for_as_while_TCC2.

min_termination_point_for_as_while_TCC2:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], s: State): (¬ min[nat](for_termination_point?(b_ex, expr, body, s)) = 0 ∧ OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) ∧ (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)))

⊃

OK?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Break?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Continue?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Return?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Switch?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))

∨

Default?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Exception?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of min_termination_point_for_as_while_TCC2.

Q.E.D.

C.108.10 IterationStatements2.min_termination_point_for_as_while_TCC3

Terse proof for min_termination_point_for_as_while_TCC3.
min_termination_point_for_as_while_TCC3:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State): (¬ min[nat](for_termination_point?(b_ex, expr, body, s)) = 0 ∧ OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) ∧ (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n))) ⊃ nonempty?[nat] (while_termination_point?[State] (##[State, ExprData, boolean](expr, b_ex), body, state[State] ((##[State] (##[State](e2s[State, boolean](b_ex), body), catch_continue[State])) (s))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Case splitting on n!1 = 0, we get 2 subgoals:

min_termination_point_for_as_while_TCC3.1:

{-1} n′ = 0
{-2} n′ ≥ 0
{-3} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(s′))
{-4} for_termination_point?(b_ex′, expr′, body′, s′)(n′)
{1} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = 0

{2} nonempty?[nat]

(while_termination_point?[State]

(##[State, ExprData, boolean](expr′, b_ex′), body′,

state[State]

((##[State]

(##[State](e2s[State, boolean](b_ex′), body′),

catch_continue[State])) (s′))))

Rewriting using min_def, matching in *, Expanding the definition of minimum?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of min_termination_point_for_as_while_TCC3.1.

min_termination_point_for_as_while_TCC3.2:

{-1} n′ ≥ 0
{-2} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(s′))
{-3} for_termination_point?(b_ex′, expr′, body′, s′)(n′)
{1} n′ = 0
{2} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = 0

{3} nonempty?[nat]

(while_termination_point?[State]

(##[State, ExprData, boolean](expr′, b_ex′), body′,

state[State]

((##[State]

(##[State](e2s[State, boolean](b_ex′), body′),

catch_continue[State])) (s′))))

Rewriting using termination_point_for_as_while, matching in *, Hiding formulas: 2, Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of min_termination_point_for_as_while_TCC3.2.

Q.E.D.

C.108.11 IterationStatements2.min_termination_point_for_as_while

Terse proof for min_termination_point_for_as_while.
min_termination_point_for_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], s: State): (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)) ∧ OK?[State]((e2s(b_ex) ## body ## catch_continue)(s)) ∧ ¬ min[nat](for_termination_point?(b_ex, expr, body, s)) = 0 ⊃ min[nat](for_termination_point?(b_ex, expr, body, s)) = min [nat](while_termination_point? (expr ## b_ex, body, state [State]((e2s(b_ex) ## body ## catch_continue)(s)))) + 1

Skolemizing (with typepred on new Skolem constants), Applying disjunctive simplification to flatten sequent, Case splitting on while_termination_point?(expr!1 ## b_ex!1, body!1, state((e2s(b_ex!1) ## body!1

## catch_continue) (s!1))) = (LAMBDA (n: nat): for_termination_point?(b_ex!1, expr!1, body!1, s!1)(n + 1)),

we get 2 subgoals:

min_termination_point_for_as_while.1:

{-1} while_termination_point?(expr′ ## b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue)(s′)))

= (λ (n: nat): for_termination_point?(b_ex′, expr′, body′, s′)(n + 1))

{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, s′)(n)
{-3} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(s′))
{1} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = 0

{2} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(s′)))) + 1

Replacing using formula -1, Keeping (-2 1 2) and hiding *, Using lemma min_plus1, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: 2, Rewriting using min_def, matching in *, Expanding the definition of minimum?, which is trivially true.

This completes the proof of min_termination_point_for_as_while.1.
min_termination_point_for_as_while.2:

{-1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, s′)(n)
{-2} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(s′))

{1} while_termination_point?(expr′ ## b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue)(s′)))

= (λ (n: nat): for_termination_point?(b_ex′, expr′, body′, s′)(n + 1))

{2} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = 0

{3} min[nat](for_termination_point?(b_ex′, expr′, body′, s′)) = min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(s′)))) + 1

Hiding formulas: 3, Applying decompose-equality, Rewriting using termination_point_for_as_while, matching in *,

This completes the proof of min_termination_point_for_as_while.2.

Q.E.D.

C.108.12 IterationStatements2.nonzero_min_for_termination_point_TCC1

Terse proof for nonzero_min_for_termination_point_TCC1.
nonzero_min_for_termination_point_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State): (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)) ⊃ nonempty?[nat](for_termination_point?(b_ex, expr, body, s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of nonzero_min_for_termination_point_TCC1.

Q.E.D.

C.108.13 IterationStatements2.nonzero_min_for_termination_point

Terse proof for nonzero_min_for_termination_point.
nonzero_min_for_termination_point:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], expr: [State → ExprResult[State, ExprData]], s: State): (∃ (n: nat): for_termination_point?(b_ex, expr, body, s)(n)) ∧ ¬ min[nat](for_termination_point?(b_ex, expr, body, s)) = 0 ⊃ OK?(b_ex(s)) ∧ data(b_ex(s))

Repeatedly Skolemizing and flattening, Rewriting using min_def, matching in *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of nonzero_min_for_termination_point.

Q.E.D.

C.108.14 IterationStatements2.for_as_while

Terse proof for for_as_while.

for_as_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], init: [State → StmtResult[State]]):

for(init, b_ex, expr, body) = (init ##

if_else(b_ex, body ## catch_continue ## while(expr ## b_ex, body) ## catch_break, skip))

Installing automatic rewrites from: for while comp_eval_if_ok_fstmt_single lift skip Repeatedly Skolemizing and flattening, Applying decompose-equality, Expanding the definition of if_else, Expanding the definition of while, Expanding the definition of ##, Case splitting on OK?(init!1(x!1)), we get 2 subgoals:

for_as_while.1:

{-1} OK?(init′(x′))

{1} lift(λ (state: State):

if ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state)(n)

then (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state)), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state)

else Hang endif)

(init′(x′)) = lift((b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif))

## catch_break

else skip endif)))

(init′(x′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

for_as_while.1.1:

{-1} OK?(init′(x′))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{1} (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′)))

Case splitting on min(for_termination_point?(b_ex!1, expr!1, body!1, state(init!1(x!1)))) = 0,

we get 2 subgoals:

for_as_while.1.1.1:

{-1} min(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))) = 0
{-2} OK?(init′(x′))
{-3} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{1} (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′)))

Replacing using formula -1,

Expanding the definition of iterate_for,

Rewriting using min_def, matching in *,

Hiding formulas: -3,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.1.

for_as_while.1.1.2:

{-1} OK?(init′(x′))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{1} min(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))) = 0

{2} (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′)))

Using lemma nonzero_min_for_termination_point,

Rewriting using iterate_for_as_while, matching in *,

Rewriting using min_termination_point_for_as_while, matching in *,

we get 2 subgoals:

for_as_while.1.1.2.1:

{-1} (∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)) ∧ ¬ 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 ⊃ OK?(b_ex′(state(init′(x′)))) ∧ data(b_ex′(state(init′(x′))))

{-2} OK?(init′(x′))
{-3} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′)))))) − 1,

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′)))

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of lift,

Rewriting using comp_simple_stmt_simple_expr, matching in *,

Case splitting on OK?((body!1 ## catch_continue)(state((init!1 ## b_ex!1)(x!1)))),

we get 2 subgoals:

for_as_while.1.1.2.1.1:

{-1} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{-3} OK?((init′ ## b_ex′)(x′))
{-4} data((init′ ## b_ex′)(x′))
{-5} OK?(init′(x′))

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

state[State]

((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

catch_break(cases (body′ ## catch_continue)(state((init′ ## b_ex′)(x′))) of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (state_1)

else Hang endif

else (body′ ## catch_continue)(state((init′ ## b_ex′)(x′)))

endcases)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

for_as_while.1.1.2.1.1.1:

{-1} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{-3} OK?((init′ ## b_ex′)(x′))
{-4} data((init′ ## b_ex′)(x′))
{-5} OK?(init′(x′))

{-6} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n)

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

state[State]

((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

catch_break((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state ((body′ ## catch_continue)

(state

((init′ ## b_ex′)

(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′)

## catch_break)

(state((body′ ## catch_continue) (state((init′ ## b_ex′)(x′))))))

Keeping (-1 -3 -5 2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.1.

for_as_while.1.1.2.1.1.2:

{-1} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{-3} OK?((init′ ## b_ex′)(x′))
{-4} data((init′ ## b_ex′)(x′))
{-5} OK?(init′(x′))

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n)

{3} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

state[State]

((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′))) = catch_break(Hang)

Hiding formulas: 3, Repeatedly Skolemizing and flattening, Case splitting on n!1 = 0, we get 2 subgoals:

for_as_while.1.1.2.1.1.2.1:

{-1} n′ = 0
{-2} n′ ≥ 0
{-3} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-4} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-5} OK?((init′ ## b_ex′)(x′))
{-6} data((init′ ## b_ex′)(x′))
{-7} OK?(init′(x′))

{1} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {2} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n)

Replacing using formula -1, Expanding the definition of for_termination_point?, Expanding the definition of iterate_for, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.2.1.

for_as_while.1.1.2.1.1.2.2:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-3} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} n′ = 0

{2} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {3} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n)

Instantiating the top quantifier in 3 with the terms: n′ − 1, we get 2 subgoals:

for_as_while.1.1.2.1.1.2.2.1:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-3} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} n′ = 0

{2} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {3} while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n′ − 1)

Rewriting using termination_point_for_as_while, matching in *, we get 2 subgoals:

for_as_while.1.1.2.1.1.2.2.1.1:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))

{-3} while_termination_point?(expr′ ## b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))

(n′ − 1)

{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} n′ = 0

{2} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {3} while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n′ − 1)

C.108 Proofs for IterationStatements2 (statements.pvs)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.2.2.1.1.
for_as_while.1.1.2.1.1.2.2.1.2:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-3} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} OK?((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))
{2} n′ = 0

{3} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {4} while_termination_point?(expr′ ## b_ex′, body′,

state((body′ ## catch_continue)

(state((init′ ## b_ex′)(x′)))))

(n′ − 1)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.2.2.1.2.
for_as_while.1.1.2.1.1.2.2.2:

{-1} n′ ≥ 0
{-2} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))
{-3} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n′)
{-4} OK?((init′ ## b_ex′)(x′))
{-5} data((init′ ## b_ex′)(x′))
{-6} OK?(init′(x′))
{1} n′ − 1 ≥ 0
{2} n′ = 0

{3} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0

Keeping (-1 1 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.1.2.2.2.

for_as_while.1.1.2.1.2:

{-1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{-2} OK?((init′ ## b_ex′)(x′))
{-3} data((init′ ## b_ex′)(x′))
{-4} OK?(init′(x′))
{1} OK?((body′ ## catch_continue)(state((init′ ## b_ex′)(x′))))

{2} 1 + min [nat](while_termination_point? (expr′ ## b_ex′, body′, state [State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))))

= 0 {3} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

state[State]

((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))),

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

catch_break(cases (body′ ## catch_continue)(state((init′ ## b_ex′)(x′))) of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (state_1)

else Hang endif

else (body′ ## catch_continue)(state((init′ ## b_ex′)(x′))) endcases)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.1.2.

for_as_while.1.1.2.2:

{-1} (∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n))

⊃ OK?(b_ex′(state(init′(x′)))) ∧ data(b_ex′(state(init′(x′))))

{-2} OK?(init′(x′))
{-3} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{1} OK?[State]((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))
{2} min(for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))) = 0

{3} ((e2s(b_ex′) ## body′ ## catch_continue ##

iterate_while(min [nat](for_termination_point? (b_ex′, expr′, body′, state(init′(x′)))) − 1,

expr′ ## b_ex′, body′)

## e2s(expr′)) ## e2s(b_ex′) ## catch_break) (state(init′(x′)))

=

(b_ex′ ##

(λ (b: bool): if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′,

s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.1.2.2.

for_as_while.1.2:

{-1} OK?(init′(x′))
{1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)
{2} Hang?((b_ex′ ##
(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif)) (state(init′(x′))))

Copying formula number: 1

Copying formula number: 1

Instantiating the top quantifier in 1 with the terms: 0,

Instantiating the top quantifier in 2 with the terms: 1,

Expanding the definition of for_termination_point?,

Expanding the definition of iterate_for,

Expanding the definition of iterate_for,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of ##,

Expanding the definition of catch_break,

Expanding the definition of lift,

Expanding the definition of e2s,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of catch_continue,

Simplifying, rewriting, and recording with decision procedures,

Case splitting on OK?(body!1(state(b_ex!1(state(init!1(x!1)))))) OR Continue?(body!1(state(b_ex!1(state(init!1(x!1)))))),

we get 2 subgoals:

for_as_while.1.2.1:

{-1} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-2} OK?(OK(state(init′(x′))))
{-3} OK?(b_ex′(state(init′(x′))))
{-4} data(b_ex′(state(init′(x′))))

{-5} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-6} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-7} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-8} OK?(init′(x′))
{1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{2} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of

Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1311 C Proof scripts

Case splitting on EXISTS (n: nat): while_termination_point?(expr!1 ## b_ex!1, body!1, state(body!1 (state(b_ex!1(state(init!1(x!1))))))) (n),

we get 3 subgoals:

for_as_while.1.2.1.1:

{-1} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state(body′(state(b_ex′(state(init′(x′))))))) (n)

{-2} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-3} OK?(OK(state(init′(x′))))
{-4} OK?(b_ex′(state(init′(x′))))
{-5} data(b_ex′(state(init′(x′))))

{-6} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-7} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-8} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-9} OK?(init′(x′))
{1} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{2} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of

Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1313 C Proof scripts

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: n′ + 1, Rewriting using termination_point_for_as_while, matching in *, we get 2 subgoals:

for_as_while.1.2.1.1.1:

{-1} n′ ≥ 0

{-2} while_termination_point?(expr′ ## b_ex′, body′,

state(body′(state(b_ex′(state(init′(x′))))))) (n′)

{-3} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-4} OK?(OK(state(init′(x′))))
{-5} OK?(b_ex′(state(init′(x′))))
{-6} data(b_ex′(state(init′(x′))))

{-7} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-8} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-9} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-10} OK?(init′(x′))

{1} while_termination_point?(expr′ ## b_ex′, body′,

state((e2s(b_ex′) ## body′ ## catch_continue)

(state(init′(x′)))))

(n′)

1315 C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.2.1.1.1.

for_as_while.1.2.1.1.2:

{-1} n′ ≥ 0

{-2} while_termination_point?(expr′ ## b_ex′, body′,

state(body′(state(b_ex′(state(init′(x′))))))) (n′)

{-3} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-4} OK?(OK(state(init′(x′))))
{-5} OK?(b_ex′(state(init′(x′))))
{-6} data(b_ex′(state(init′(x′))))

{-7} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-8} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-9} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-10} OK?(init′(x′))
{1} OK?((e2s(b_ex′) ## body′ ## catch_continue)(state(init′(x′))))
{2} for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(1 + n′)

1317 C Proof scripts

Hiding formulas: (-2 2), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of for_as_while.1.2.1.1.2.

for_as_while.1.2.1.2:

{-1} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-2} OK?(OK(state(init′(x′))))
{-3} OK?(b_ex′(state(init′(x′))))
{-4} data(b_ex′(state(init′(x′))))

{-5} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-6} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-7} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-8} OK?(init′(x′))

{1} ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′,

state(body′(state(b_ex′(state(init′(x′))))))) (n)

{2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{3} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of

Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1319

C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of for_as_while.1.2.1.2.

for_as_while.1.2.1.3:

{-1} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{-2} OK?(OK(state(init′(x′))))
{-3} OK?(b_ex′(state(init′(x′))))
{-4} data(b_ex′(state(init′(x′))))

{-5} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-6} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-7} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-8} OK?(init′(x′))

{1} OK?[State](body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Break?[State](body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Continue?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Return?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Switch?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Default?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′)))))) ∨ Exception?[State]

(body′(state[State, boolean](b_ex′(state[State](init′(x′))))))

{2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{3} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of

Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1321

This completes the proof of for_as_while.1.2.1.3.

for_as_while.1.2.2:

{-1} OK?(OK(state(init′(x′))))
{-2} OK?(b_ex′(state(init′(x′))))
{-3} data(b_ex′(state(init′(x′))))

{-4} OK?(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res endcases)) ## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))

{-5} OK?(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-6} data(b_ex′(state(((((λ (s: State):

cases b_ex′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases)

## body′ ## (λ (res: StmtResult[State]):

cases res of Continue(state): OK(state) else res end-

cases))

## (λ (s: State):

cases expr′(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (s): OK(s))) (state(init′(x′))))))

{-7} OK?(init′(x′))

{1} OK?(body′(state(b_ex′(state(init′(x′)))))) ∨

Continue?(body′(state(b_ex′(state(init′(x′))))))

{2} ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state(init′(x′)))(n)

{3} Hang?(cases cases cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Exception(ex_1, state) endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases of Break(state_1): OK(state_1) else cases cases body′(state(b_ex′(state(init′(x′))))) of

Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases of

OK(state_1):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, state_1)(n) then ((iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, state_1)),

expr′ ## b_ex′, body′)

## (λ (s: State):

cases (expr′ ## b_ex′)(s) of OK(state, data): OK(state), Fatal: Fatal, Hang: Hang, Exception(ex_1, state): Excep-

tion(ex_1, state)

endcases))

## (λ (res: StmtResult[State]):

cases res of Break(state): OK(state) else res end-

cases))

(state_1)

else Hang endif

else cases body′(state(b_ex′(state(init′(x′))))) of Continue(state_1): OK(state_1) else body′(state(b_ex′(state(init′(x′))))) endcases

endcases endcases)

1323

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of for_as_while.1.2.2.

for_as_while.2:

{1} OK?(init′(x′))

{2} lift(λ (state: State):

if ∃ (n: nat): for_termination_point?(b_ex′, expr′, body′, state)(n)

then (iterate_for(min[nat]

(for_termination_point?(b_ex′, expr′, body′, state)), b_ex′, expr′, body′)

## e2s(b_ex′) ## catch_break) (state)

else Hang endif)

(init′(x′)) = lift((b_ex′ ##

(λ (b: bool):

if b

then (body′ ## catch_continue ##

(λ (s: State):

if ∃ (n: nat):

while_termination_point?(expr′ ## b_ex′, body′, s)(n) then (iterate_while(min[nat]

(while_termination_point?(expr′ ## b_ex′, body′, s)),

expr′ ## b_ex′, body′)

## e2s(expr′ ## b_ex′) ## catch_break) (s)

else Hang endif)) ## catch_break

else skip endif)))

(init′(x′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of for_as_while.2.

Q.E.D.

C.108.15 IterationStatements2.for_unroll

Terse proof for for_unroll.

for_unroll:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], init: [State → StmtResult[State]],

max: nat): for(max, init, b_ex, expr, body) = (init ##

if_else(b_ex, body ## catch_continue ## while(max, expr ## b_ex, body) ## catch_break, skip))

Repeatedly Skolemizing and flattening, Expanding the definition of for, Expanding the definition of while, Rewriting using for_as_while, matching in *, This completes the proof of for_unroll. Q.E.D.

C.109 Proofs for IterationStatements3 (statements.pvs)

C.109.1 IterationStatements3.do_while_inv_unroll

Terse proof for do_while_inv_unroll.
do_while_inv_unroll:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

variant: [State → [State → Ord]]): do_while(body, b_ex)(P, Q, R, variant, <) = (body ## catch_continue ## while(b_ex, body)(P, Q, R, vari-

ant, <) ## catch_break)

Repeatedly Skolemizing and flattening, Expanding the definition of do_while, Expanding the definition of while, Rewriting using do_as_while, matching in *, This completes the proof of do_while_inv_unroll. Q.E.D.

C.110 Proofs for IterationStatements4 (statements.pvs)

C.110.1 IterationStatements4.for_inv_unroll

Terse proof for for_inv_unroll.

for_inv_unroll:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

expr: [State → ExprResult[State, ExprData]], init: [State → StmtResult[State]],

variant: [State → [State → Ord]]): for(init, b_ex, expr, body)(P, Q, R, variant, <) = (init ##

if_else(b_ex,

body ## catch_continue ## while(expr ## b_ex, body)(P, Q, R, vari-

ant, <) ## catch_break, skip))

Repeatedly Skolemizing and flattening, Expanding the definition of for, Expanding the definition of while, Rewriting using for_as_while, matching in *, This completes the proof of for_inv_unroll. Q.E.D.

C.111 Proofs for JumpStatements1 (statements.pvs)

This theory contains no provable formal statements.

C.112 Proofs for JumpStatements2 (statements.pvs)

This theory contains no provable formal statements.

C.113 Proofs for LabeledStatements (statements.pvs)

This theory contains no provable formal statements.

C.114 Proofs for Linear_Memory (linear_memory.pvs)

C.114.1 Linear_Memory.xlat_idx_TCC1

Terse proof for xlat_idx_TCC1.

xlat_idx_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): offset(addr) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of xlat_idx_TCC1. Q.E.D.

C.114 Proofs for Linear_Memory (linear_memory.pvs)

C.114.2 Linear_Memory.xlat_idx_TCC2

Terse proof for xlat_idx_TCC2.

xlat_idx_TCC2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): bus_width− (lvl + 1) × bits_per_level≥ 0

Trying repeated skolemization, instantiation, and if-lifting, Using lemma bus_width, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of xlat_idx_TCC2. Q.E.D.

C.114.3 Linear_Memory.xlat_idx_pe_aligned_TCC1

Terse proof for xlat_idx_pe_aligned_TCC1.
xlat_idx_pe_aligned_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): offset(base) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_idx_pe_aligned_TCC1.

Q.E.D.

C.114.4 Linear_Memory.xlat_idx_pe_aligned_TCC2

Terse proof for xlat_idx_pe_aligned_TCC2.
xlat_idx_pe_aligned_TCC2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G):

aligned?(bits_per_level + pe_size)(offset(base)) ⊃ offset(xlat_idx(lvl, base, addr)) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_idx_pe_aligned_TCC2.

Q.E.D.

C.114.5 Linear_Memory.xlat_idx_pe_aligned

Terse proof for xlat_idx_pe_aligned.
xlat_idx_pe_aligned:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G):

aligned?(bits_per_level + pe_size)(offset(base)) ⊃ aligned?(pe_size)(offset(xlat_idx(lvl, base, addr)))

Repeatedly Skolemizing and flattening, Expanding the definition of xlat_idx, Installing automatic rewrites from: (bus_width! bits_per_level! max_level!) Case splitting on -1 * (bits_per_level * lvl!1) - bits_per_level + bus_width >= 0, we get 2 subgoals:

xlat_idx_pe_aligned.1:

{-1} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{1} aligned?(pe_size)

(offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size)))

Using lemma aligned_shift_bits_ok,

we get 2 subgoals:

xlat_idx_pe_aligned.1.1:

{-1} pe_size ≤ pe_size ⊃

aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-2} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))

{1} aligned?(pe_size)

(offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size)))

Expanding the definition of +,

Using lemma aligned_plus,

we get 4 subgoals:

xlat_idx_pe_aligned.1.1.1:

{-1} aligned?(min(bits_per_level + pe_size, pe_size))

(offset(base′) + shift_bits_left (cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level ), pe_size))

{-2} pe_size ≤ pe_size ⊃

aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-3} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-4} lvl′ < max_level
{-5} Mem?(base′`type_of)
{-6} 0 ≤ base′`offset
{-7} base′`offset < max_linear_offset
{-8} Mem?(addr′`type_of)
{-9} 0 ≤ addr′`offset
{-10} addr′`offset < max_linear_offset
{-11} aligned?(bits_per_level + pe_size)(offset(base′))

{1} aligned?(pe_size) (base′‘offset + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size))

Expanding the definition of min,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_pe_aligned.1.1.1.
xlat_idx_pe_aligned.1.1.2:

{-1} pe_size ≤ pe_size ⊃

aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-2} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))

{1} aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), 22 − 10 × lvl′, 10), pe_size))

{2} aligned?(pe_size) (base′‘offset + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_pe_aligned.1.1.2.

xlat_idx_pe_aligned.1.1.3:

{-1} pe_size ≤ pe_size ⊃

aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-2} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{1} 22 − 10 × lvl′ ≥ 0

{2} aligned?(pe_size)

(base′‘offset + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_pe_aligned.1.1.3.
xlat_idx_pe_aligned.1.1.4:

{-1} pe_size ≤ pe_size ⊃

aligned?(pe_size)

(shift_bits_left(cut_bits(offset(addr′), bus_width− (lvl′ + 1) × bits_per_level , bits_per_level),

pe_size))

{-2} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{1} aligned?(10 + pe_size)(offset(base′))

{2} aligned?(pe_size)

(base′‘offset + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_pe_aligned.1.1.4.

xlat_idx_pe_aligned.1.2:

{-1} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0
{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))
{1} 22 − 10 × lvl′ ≥ 0

{2} aligned?(pe_size)

(offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of xlat_idx_pe_aligned.1.2.

xlat_idx_pe_aligned.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} aligned?(bits_per_level + pe_size)(offset(base′))
{1} −1 × (bits_per_level × lvl′) − bits_per_level + bus_width≥ 0

{2} aligned?(pe_size)

(offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × bits_per_level × lvl′ − bits_per_level + bus_width, bits_per_level ), pe_size)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of xlat_idx_pe_aligned.2. Q.E.D.

C.114.6 Linear_Memory.xlat_idx_memory_address

Terse proof for xlat_idx_memory_address.
xlat_idx_memory_address:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): aligned?(bits_per_level + pe_size)(offset(base)) ⊃ xlat_idx(lvl, base, addr) < max_linear

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: Mem + < max_linear max_linear_offset bits_per_level pe_size

max_level bus_width Expanding the definition of xlat_idx, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma aligned_add_below, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using shift_bits_left_less, matching in *, This completes the proof of xlat_idx_memory_address. Q.E.D.

C.114.7 Linear_Memory.xlat_idx_memory_address2

Terse proof for xlat_idx_memory_address2.
xlat_idx_memory_address2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): aligned?(bits_per_level + pe_size)(offset(base)) ⊃ 0 ≤ offset(xlat_idx(lvl, base, addr))

Expanding the definition of xlat_idx, Repeatedly Skolemizing and flattening, Adding type constraints for shift_bits_left(cut_bits(offset(addr!1), -1 * (lvl!1 * bits_per_level) -

bits_per_level + bus_width, bits_per_level), pe_size), we get 2 subgoals:

xlat_idx_memory_address2.1:

{-1} shift_bits_left(cut_bits(offset(addr′), −1 × (lvl′ × bits_per_level ) − bits_per_level + bus_width, bits_per_level),

pe_size)

≥ 0

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{1} 0 ≤

offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × lvl′ × bits_per_level − bits_per_level + bus_width, bits_per_level ), pe_size))

Expanding the definition of +, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_memory_address2.1.
xlat_idx_memory_address2.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} aligned?(bits_per_level + pe_size)(offset(base′))
{1} −1 × (lvl′ × bits_per_level ) − bits_per_level + bus_width≥ 0

{2} 0 ≤

offset (base′ + shift_bits_left (cut_bits(offset(addr′), −1 × lvl′ × bits_per_level − bits_per_level + bus_width, bits_per_level ), pe_size))

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, Expanding the definition of bus_width, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_memory_address2.2.

Q.E.D.

C.114.8 Linear_Memory.xlat_ofs_memory_address

Terse proof for xlat_ofs_memory_address.
xlat_ofs_memory_address:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): aligned?(bus_width− (lvl + 1) × bits_per_level )(offset(base)) ⊃ xlat_ofs(lvl, base, addr) < max_linear

Installing automatic rewrites from: Mem + < max_linear max_linear_offset bits_per_level pe_size max_level bus_width

Repeatedly Skolemizing and flattening, Expanding the definition of xlat_ofs, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma aligned_add_below, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of xlat_ofs_memory_address. Q.E.D.

C.114.9 Linear_Memory.xlat_ofs_memory_address2

Terse proof for xlat_ofs_memory_address2.
xlat_ofs_memory_address2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G): aligned?(bus_width− (lvl + 1) × bits_per_level )(offset(base)) ⊃ 0 ≤ offset(xlat_ofs(lvl, base, addr))

Expanding the definition of xlat_ofs, Expanding the definition of +, Repeatedly Skolemizing and flattening, Using lemma cut_bits_below, we get 2 subgoals:

xlat_ofs_memory_address2.1:

{-1} cut_bits(offset(addr′), 0,

−1 × lvl′ × bits_per_level − bits_per_level + bus_width)

< expt(2, −1 × lvl′ × bits_per_level − bits_per_level + bus_width)

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset

{-9} aligned?(−1 × lvl′ × bits_per_level − bits_per_level + bus_width)

(offset(base′))

{1} 0 ≤ base′‘offset + cut_bits(offset(addr′), 0, −1 × lvl′ × bits_per_level − bits_per_level + bus_width)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_memory_address2.1.
xlat_ofs_memory_address2.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset

{-8} aligned?(−1 × lvl′ × bits_per_level − bits_per_level + bus_width)

(offset(base′))

{1} −1 × lvl′ × bits_per_level − bits_per_level + bus_width≥ 0

{2} 0 ≤ base′‘offset + cut_bits(offset(addr′), 0, −1 × lvl′ × bits_per_level − bits_per_level + bus_width)

Keeping (-1 1) and hiding *, Installing automatic rewrites from: bus_width Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_ofs_memory_address2.2.

Q.E.D.

C.114.10 Linear_Memory.raise_fault_TCC1

Terse proof for raise_fault_TCC1.
raise_fault_TCC1:

{1} ∀ (access: Memory_access, pfa: Memory_Address_4G): (Read ∈ (singleton[Memory_access](access) ∪ {Read}))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of raise_fault_TCC1. Q.E.D.

C.114.11 Linear_Memory.translate_TCC1

Terse proof for translate_TCC1.
translate_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

pe_addr: Address): pe_addr = xlat_idx(lvl, base, addr) ⊃ (∀ (pe: (range_pt(lvl))):

accessible?(pe, access) ∧ privileged?(pe, priv) ∧ present?(pe) ∧ paging_type?(lvl, pe) ⊃ range_pt(lvl)(set_reference(pe, access)))

Repeatedly Skolemizing and flattening,

Rewriting using set_reference_range, matching in *,

This completes the proof of translate_TCC1.

Q.E.D.

C.114.12 Linear_Memory.translate_memory_address

Terse proof for translate_memory_address.
translate_memory_address:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ⊃ data(translate(lvl, base, addr, access, priv)(s))`2 < max_linear

Expanding the definition of translate,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: ( ##! <! ok_result! exception_result! fatal_result! raise_fault! max_linear! Mem!)

Case splitting on OK?(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1)) AND present?(data(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1))),

we get 2 subgoals:

translate_memory_address.1:

{-1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{-10} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))`2

< max_linear

Adding type constraints for base(data(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1))),

we get 2 subgoals:

translate_memory_address.1.1:

{-1} Mem?(base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`type_of)

{-2} 0 ≤

base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`offset

{-3} base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`offset

< max_linear_offset {-4} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} Mem?(addr′`type_of)
{-10} 0 ≤ addr′`offset
{-11} addr′`offset < max_linear_offset
{-12} aligned?(bits_per_level + pe_size)(offset(base′))

{-13} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))`2

< max_linear Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_memory_address.1.1.
translate_memory_address.1.2:

{-1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{-10} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} present?(data[Physical_memory, ((range_pt(lvl′)))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) (s′)))

{2} data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))`2

< max_linear

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of translate_memory_address.1.2.
translate_memory_address.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} aligned?(bits_per_level + pe_size)(offset(base′))

{-9} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{2} data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))`2

< max_linear

Hiding formulas: 2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_memory_address.2.

Q.E.D.

C.114.13 Linear_Memory.translate_memory_address2

Terse proof for translate_memory_address2.

translate_memory_address2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ⊃ 0 ≤ offset(data(translate(lvl, base, addr, access, priv)(s))`2)

Expanding the definition of translate,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: ( ##! <! ok_result! exception_result! fatal_result! raise_fault! max_linear! Mem!)

Case splitting on OK?(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1)) AND present?(data(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1))),

we get 2 subgoals:

translate_memory_address2.1:

{-1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{-10} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))

{1} 0 ≤

offset

(data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))`2)

Adding type constraints for base(data(read_data(pm, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, addr!1))(s!1))),

we get 2 subgoals:

translate_memory_address2.1.1:

{-1} Mem?(base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`type_of)

{-2} 0 ≤

base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`offset

{-3} base(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))`offset

< max_linear_offset {-4} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} Mem?(addr′`type_of)
{-10} 0 ≤ addr′`offset
{-11} addr′`offset < max_linear_offset
{-12} aligned?(bits_per_level + pe_size)(offset(base′))

{-13} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))

{1} 0 ≤

offset

(data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))`2)

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_memory_address2.1.1.

translate_memory_address2.1.2:

{-1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{-2} lvl′ < max_level
{-3} Mem?(base′`type_of)
{-4} 0 ≤ base′`offset
{-5} base′`offset < max_linear_offset
{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))

{-10} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))

{1} present?(data[Physical_memory, ((range_pt(lvl′)))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) (s′)))

{2} 0 ≤

offset

(data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))`2)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of translate_memory_address2.1.2.
translate_memory_address2.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} aligned?(bits_per_level + pe_size)(offset(base′))

{-9} OK?((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′)

endif else fatal_result endif))

(s′))

{1} OK?(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))(s′)) ∧

present?(data(read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′))

(s′)))

{2} 0 ≤

offset

(data((read_data(pm, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data(pm, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′) endif

else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))`2)

Hiding formulas: 2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_memory_address2.2.

Q.E.D.

C.114.14 Linear_Memory.translate_result_leaf_TCC1

Terse proof for translate_result_leaf_TCC1.
translate_result_leaf_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ offset

(data[Physical_memory, [bool, Address]]

(translate(lvl, base, addr, access, priv)(s))`2) ≥ 0

Repeatedly Skolemizing and flattening, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_leaf_TCC1.

Q.E.D.

C.114.15 Linear_Memory.translate_result_leaf_TCC2

Terse proof for translate_result_leaf_TCC2.
translate_result_leaf_TCC2:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ bus_width− bits_per_level × (lvl + 1) ≥ 0

Repeatedly Skolemizing and flattening, Keeping (-1 1) and hiding *, Installing automatic rewrites from: bus_width Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of translate_result_leaf_TCC2.

Q.E.D.

C.114.16 Linear_Memory.translate_result_leaf

Terse proof for translate_result_leaf.

translate_result_leaf:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ aligned?(bus_width− bits_per_level × (lvl + 1))

(offset(data(translate(lvl, base, addr, access, priv)(s))`2))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Installing automatic rewrites from: ( ##! ok_result! exception_result! fatal_result! raise_fault!

is_leaf?! bus_width! pe_size! bits_per_level! base! paging_tape?! pdir_entry?! ptab_entry?! max_level!) Expanding the definition of paging_type?, Expanding the definition of pdir_entry?, Expanding the definition of ptab_entry?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of translate_result_leaf. Q.E.D.

C.114.17 Linear_Memory.translate_result_no_leaf_TCC1

Terse proof for translate_result_no_leaf_TCC1.
translate_result_no_leaf_TCC1:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ ¬ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ offset

(data[Physical_memory, [bool, Address]]

(translate(lvl, base, addr, access, priv)(s))`2) ≥ 0

Repeatedly Skolemizing and flattening, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_no_leaf_TCC1.

Q.E.D.

C.114.18 Linear_Memory.translate_result_no_leaf

Terse proof for translate_result_no_leaf.

translate_result_no_leaf:

{1} ∀ (lvl: Level, base, addr: Memory_Address_4G, access: Mem-

ory_access, priv: Memory_privilege,

s: Linear_memory): aligned?(bits_per_level + pe_size)(offset(base)) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ∧ ¬ data(translate(lvl, base, addr, access, priv)(s))`1 ⊃ aligned?(bits_per_level + pe_size)

(offset(data(translate(lvl, base, addr, access, priv)(s))`2))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Installing automatic rewrites from: ( ##! ok_result! exception_result! fatal_result! raise_fault!

is_leaf?! bus_width! pe_size! bits_per_level! base! paging_tape?! pdir_entry?! ptab_entry?! max_level!) Expanding the definition of paging_type?, Expanding the definition of pdir_entry?, Expanding the definition of ptab_entry?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_no_leaf.

Q.E.D.

C.114.19 Linear_Memory.linear_resolve_TCC1

Terse proof for linear_resolve_TCC1.
linear_resolve_TCC1:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ lvl < max_level)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of linear_resolve_TCC1. Q.E.D.

C.114.20 Linear_Memory.linear_resolve_TCC2

Terse proof for linear_resolve_TCC2.

linear_resolve_TCC2:

{1} ∀ (addr: Memory_Address_4G, access: Memory_access, cs: Segment_Reg_type,

priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat):

lvl = pdir_lvl ⊃ (∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(−1 × lvl × bits_per_level − bits_per_level + bus_width)

(offset(t`2)) else aligned?(bits_per_level + pe_size)(offset(t`2)) endif)

(translate(lvl, pdbr`base_addr, addr, access, priv)(x_{1}))))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Using lemma translate_result_leaf, Using lemma translate_result_no_leaf, Using lemma translate_memory_address, Using lemma translate_memory_address2, Installing automatic rewrites from: max_linear Mem < bits_per_level pe_size Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of linear_resolve_TCC2. Q.E.D.

C.114.21 Linear_Memory.linear_resolve_TCC3

Terse proof for linear_resolve_TCC3.
linear_resolve_TCC3:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, b: Memory_Address_4G): leaf ⊃ off- set(b) ≥ 0))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: bus_width bits_per_level max_level Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of linear_resolve_TCC3. Q.E.D.

C.114.22 Linear_Memory.linear_resolve_TCC4

Terse proof for linear_resolve_TCC4.

linear_resolve_TCC4:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, b: Memory_Address_4G): leaf ⊃ bus_width− bits_per_level × (lvl + 1) ≥ 0))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: bus_width bits_per_level max_level pdir_lvl Simplifying, rewriting, and recording with decision procedures, This completes the proof of linear_resolve_TCC4. Q.E.D.

C.114.23 Linear_Memory.linear_resolve_TCC5

Terse proof for linear_resolve_TCC5.
linear_resolve_TCC5:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, b: Memory_Address_4G): ¬ leaf ⊃ offset(b) ≥ 0))

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of linear_resolve_TCC5. Q.E.D.

C.114.24 Linear_Memory.linear_resolve_TCC6

Terse proof for linear_resolve_TCC6.
linear_resolve_TCC6:

{1} ∀ (addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, base: {b: Memory_Address_4G | if leaf then aligned?(bus_width− bits_per_level × (lvl + 1)) (offset(b)) else aligned?(bits_per_level + pe_size)(offset(b)) endif}): ¬ leaf ⊃ (∀ (lvl1: nat): lvl1 = ptab_lvl ⊃ lvl1 < max_level)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of linear_resolve_TCC6.

Q.E.D.

C.114.25 Linear_Memory.linear_resolve_TCC7

Terse proof for linear_resolve_TCC7.
linear_resolve_TCC7:

{1} ∀ (addr: Memory_Address_4G, access: Memory_access, cs: Segment_Reg_type, priv: Memory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat): lvl = pdir_lvl ⊃ (∀ (leaf: bool, base: {b: Memory_Address_4G | if leaf then aligned?(bus_width− bits_per_level × (lvl + 1)) (offset(b)) else aligned?(bits_per_level + pe_size)(offset(b)) endif}): ¬ leaf ⊃ (∀ (lvl1: nat): lvl1 = ptab_lvl ⊃ (∀ (x_{1}: Physical_memory): every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true, λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate(lvl1, base, addr, access, priv)(x_{1}))))))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Using lemma translate_memory_address, Using lemma translate_memory_address2, Installing automatic rewrites from: max_linear Mem < bits_per_level pe_size Using lemma translate_result_leaf, Using lemma translate_result_no_leaf, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of linear_resolve_TCC7. Q.E.D.

C.114.26 Linear_Memory.linear_resolve_TCC8

Terse proof for linear_resolve_TCC8.

linear_resolve_TCC8:

{1} ∀ (leaf: bool, addr: Memory_Address_4G, cs: Segment_Reg_type, priv: Mem-

ory_privilege): priv = segment_to_priv(cs) ⊃ (∀ (pdbr: Pdbr_type, lvl: nat):

lvl = pdir_lvl ⊃ (∀ (b: Memory_Address_4G):

leaf ⊃ −1 × lvl × bits_per_level − bits_per_level + bus_width≥ 0))

Repeatedly Skolemizing and flattening,

Keeping (-9 1) and hiding *,

Installing automatic rewrites from: bus_width

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_TCC8.

Q.E.D.

C.114.27 Linear_Memory.linear_resolve_memory_address

Terse proof for linear_resolve_memory_address.
linear_resolve_memory_address:

{1} ∀ (access: Memory_access, addr: Memory_Address_4G, x_{1}: Linear_memory):

every[Linear_memory, Address]

(λ (x: Linear_memory): true,

λ (x: Address):

Mem?(x`type_of) ∧ 0 ≤ x`offset ∧ x`offset < max_linear_offset) (linear_resolve(addr, access)(x_{1}))

Repeatedly Skolemizing and flattening,

Expanding the definition of every,

Expanding the definition of linear_resolve,

Expanding the definition of ##,

Expanding the definition of ok_result,

Installing automatic rewrites from: max_linear Mem < bits_per_level bus_width min_linear Address_Helpers.<= max_level pe_size xlat_ofs_memory_address! pdir_lvl ptab_lvl translate_result_leaf translate_result_no_leaf translate_memory_address! translate_memory_address2! xlat_ofs_memory_address2! translate_result_leaf translate_result_no_leaf

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 6 subgoals:

linear_resolve_memory_address.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{1} xlat_ofs(0,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)

(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′)`offset

< max_linear_offset

Using lemma xlat_ofs_memory_address,

Using lemma translate_result_leaf,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_memory_address.1.

linear_resolve_memory_address.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{1} 0 ≤

xlat_ofs(0,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′)`offset

Using lemma xlat_ofs_memory_address2,

Using lemma translate_result_leaf,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_memory_address.2.

linear_resolve_memory_address.3:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{1} Mem?(xlat_ofs(0,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′)`type_of)

Using lemma xlat_ofs_memory_address,

Using lemma translate_result_leaf,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_memory_address.3.

linear_resolve_memory_address.4:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} OK?(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))

{1} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{2} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)

(x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))`2,

addr′)`offset

< max_linear_offset

1356

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Using lemma translate_result_no_leaf, Using lemma translate_result_no_leaf, Using lemma translate_result_leaf, Using lemma xlat_ofs_memory_address, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_memory_address.4.

linear_resolve_memory_address.5:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} OK?(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))

{1} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{2} 0 ≤

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))`2,

addr′)`offset

1358

C.114 Proofs for Linear_Memory (linear_memory.pvs)

Using lemma xlat_ofs_memory_address2, Using lemma translate_result_no_leaf, Using lemma translate_result_no_leaf, Using lemma translate_result_leaf, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_memory_address.5.

linear_resolve_memory_address.6:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} OK?(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))

{-5} OK?(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)(x′_{1}))))

{-6} OK?(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))

{-7} OK?(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))

{1} data(translate(0,

data(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)(CS)(x′_{1}))))

(state(read_data(pm, pdbr_data_type)(PDBR)

(state(read_data(pm, segment_reg_data_type)(CS) (x′_{1}))))))`1

{2} Mem?(xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))`2,

addr′, access′,

segment_to_priv(data(read_data(pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(translate(0,

data(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))`base_addr,

addr′, access′,

segment_to_priv(data

(read_data (pm, seg-

ment_reg_data_type)

(CS) (x′_{1}))))

(state(read_data(pm, pdbr_data_type) (PDBR) (state

(read_data (pm, seg-

ment_reg_data_type)

(CS)

(x′_{1}))))))))`2,

addr′)`type_of)

1360

Using lemma translate_result_no_leaf, Using lemma translate_result_leaf, Using lemma translate_result_no_leaf, Using lemma translate_memory_address, Using lemma xlat_ofs_memory_address, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_memory_address.6.

Q.E.D.

C.114.28 Linear_Memory.linear_read_TCC1

Terse proof for linear_read_TCC1.
linear_read_TCC1:

{1} Mem?(min_linear`type_of)

Expanding the definition of min_linear, Rewriting using Mem, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of linear_read_TCC1. Q.E.D.

C.114.29 Linear_Memory.linear_read_TCC2

Terse proof for linear_read_TCC2.
linear_read_TCC2:

{1} Mem?(max_linear`type_of)

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true. This completes the proof of linear_read_TCC2. Q.E.D.

C.114.30 Linear_Memory.linear_read_TCC3

Terse proof for linear_read_TCC3.
linear_read_TCC3:

{1} ∀ (a: Address):

Mem?(type_of(a)) ∧ in_memory(min_linear, max_linear)(a) ⊃ 0 ≤ a`offset ∧ a`offset < max_linear_offset

Expanding the definition of min_linear, Trying repeated skolemization, instantiation, and if-lifting, Expanding the definition of max_linear, Expanding the definition of max_linear_offset, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of linear_read_TCC3. Q.E.D.

C.114.31 Linear_Memory.linear_read_side_effect_TCC1

Terse proof for linear_read_side_effect_TCC1.
linear_read_side_effect_TCC1:

{1} ∀ (a: Address, bl: list[Byte], s: Linear_memory): Mem?(type_of(a)) ∧ (null?(bl) ∨ (reg_base(min_linear)(type_of(a)) ≤ a ∧ a + length(bl) ≤ reg_size(max_linear)(type_of(a)))) ⊃ every[[Address, list[Byte]]] (λ (t: [Address, list[Byte]]): Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Case splitting on bl!1 = null, we get 2 subgoals:

linear_read_side_effect_TCC1.1:

{-1} bl′ = null
{-2} Mem?(type_of(a′))
{-3} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{1} every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Using lemma split_null, Expanding the definition of every, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_read_side_effect_TCC1.1.
linear_read_side_effect_TCC1.2:

{-1} Mem?(type_of(a′))
{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{1} bl′ = null

{2} every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Using lemma split_range, Using lemma split_no_null, Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_read_side_effect_TCC1.2.1:

{-1} cons?(bl′)
{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} reg_base(min_linear)(type_of(a′)) ≤ a′
{-6} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{1} every((λ (a_{2}: Address, bl2: list[Byte]):

cons?(bl2) ∧ a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′))) (split(min_page, a′, bl′))

{2} every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Hiding formulas: 2, Using lemma every_conjunct_left, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_read_side_effect_TCC1.2.1.
linear_read_side_effect_TCC1.2.2:

{-1} cons?(bl′)
{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} reg_base(min_linear)(type_of(a′)) ≤ a′
{-6} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{1} ∀ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)

⊃ Mem?(t_1`1`type_of) ∧ 0 ≤ t_1`1`offset ∧ t_1`1`offset < max_linear_offset

{2} every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Hiding formulas: (-2 -3 2), Trying repeated skolemization, instantiation, and if-lifting, Expanding the definition of max_linear, Expanding the definition of Mem, Expanding the definition of max_linear_offset, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_read_side_effect_TCC1.2.2.

Q.E.D.

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

C.115.1 Linear_Memory_Blessing.PTab_Address_TCC1

Terse proof for PTab_Address_TCC1.
PTab_Address_TCC1:

{1} ∀ (a: Memory_Address_4G): offset(a) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of PTab_Address_TCC1. Q.E.D.

C.115.2 Linear_Memory_Blessing.pe_in_pdir_range?_TCC1

Terse proof for pe_in_pdir_range?_TCC1.
pe_in_pdir_range?_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, res: ExprResult[Physical_memory, Pdbr_type]):

OK?(res) ∧ res = read_data(pm_phy, pdbr_data_type)(PDBR)(s) ⊃ (∀ (lin_a: (linear_range)): pdir_lvl[Physical_memory, pm_phy] < max_level)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_pdir_range?_TCC1. Q.E.D.

C.115.3 Linear_Memory_Blessing.pe_in_ptab_range?_TCC1

Terse proof for pe_in_ptab_range?_TCC1.
pe_in_ptab_range?_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, pde: (pe_in_pdir_range?(s, linear_range)), lin_a: (linear_range)):

pdir_lvl[Physical_memory, pm_phy] < max_level

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_ptab_range?_TCC1. Q.E.D.

C.115.4 Linear_Memory_Blessing.pe_in_ptab_range?_TCC2

Terse proof for pe_in_ptab_range?_TCC2.

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

pe_in_ptab_range?_TCC2:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, pde: (pe_in_pdir_range?(s, linear_range)), lin_a: (linear_range), res: ExprResult[Physical_memory, ((range_pt(pdir_lvl[Physical_memory, pm_phy])))]):

OK?(res) ∧ res = read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s) ⊃ pdir?(data[Physical_memory, ((range_pt(pdir_lvl)))](res))

Repeatedly Skolemizing and flattening, Adding type constraints for data[Physical_memory, ((range_pt(pdir_lvl)))](res!1), Expanding the definition of range_pt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pdir_lvl, which is trivially true. This completes the proof of pe_in_ptab_range?_TCC2. Q.E.D.

C.115.5 Linear_Memory_Blessing.pe_in_ptab_range?_TCC3

Terse proof for pe_in_ptab_range?_TCC3.
pe_in_ptab_range?_TCC3:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, pde: (pe_in_pdir_range?(s, linear_range)), lin_a: (linear_range), res: ExprResult[Physical_memory, ((range_pt(pdir_lvl[Physical_memory, pm_phy])))]):

pde_pt?(pdir(data(res))) ∧

OK?(res) ∧ res = read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s)

⊃ ptab_lvl[Physical_memory, pm_phy] < max_level

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_ptab_range?_TCC3. Q.E.D.

C.115.6 Linear_Memory_Blessing.pe_in_ptab_range?_TCC4

Terse proof for pe_in_ptab_range?_TCC4.
pe_in_ptab_range?_TCC4:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], linear_range: PRED[Memory_Address_4G], phy_a: Memory_Address_4G, pde: (pe_in_pdir_range?(s, linear_range)), lin_a: (linear_range), res: ExprResult[Physical_memory, ((range_pt(pdir_lvl[Physical_memory, pm_phy])))]):

pde_pt?(pdir(data(res))) ∧

OK?(res) ∧ res = read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s)

⊃ present?(data[Physical_memory, ((range_pt(pdir_lvl)))](res))

Repeatedly Skolemizing and flattening, Expanding the definition of present?, Adding type constraints for data(res!1), Expanding the definition of range_pt, Expanding the definition of pdir_lvl, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pe_in_ptab_range?_TCC4. Q.E.D.

C.115.7 Linear_Memory_Blessing.pe_in_pt_range?_TCC1

Terse proof for pe_in_pt_range?_TCC1.
pe_in_pt_range?_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], lvl: Level, phy_a: Mem-

ory_Address_4G): ¬ (lvl = pdir_lvl[Physical_memory, pm_phy] ∧ lvl = ptab_lvl[Physical_memory, pm_phy])

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_pt_range?_TCC1. Q.E.D.

C.115.8 Linear_Memory_Blessing.pe_in_pt_range?_TCC2

Terse proof for pe_in_pt_range?_TCC2.
pe_in_pt_range?_TCC2:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], lvl: Level, phy_a: Mem-

ory_Address_4G): lvl = pdir_lvl[Physical_memory, pm_phy] ∨ lvl = ptab_lvl[Physical_memory, pm_phy]

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pe_in_pt_range?_TCC2. Q.E.D.

C.115.9 Linear_Memory_Blessing.pe_in_pt_range_aligned

Terse proof for pe_in_pt_range_aligned.
pe_in_pt_range_aligned:

{1} ∀ (linear_range: PRED[Memory_Address_4G], lvl: Level, s: Linear_memory[Physical_memory, pm_phy], phy_a: Memory_Address_4G): pe_in_pt_range?(s, linear_range, lvl)(phy_a) ⊃ aligned?(pe_size)(offset(phy_a))

Expanding the definition of pe_in_pt_range?, Expanding the definition of pe_in_ptab_range?, Expanding the definition of pe_in_pdir_range?, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: pe_size bits_per_level xlat_idx_pe_aligned Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

pe_in_pt_range_aligned.1:

{-1} lvl′ < max_level
{-2} Mem?(phy_a′`type_of)
{-3} 0 ≤ phy_a′`offset
{-4} phy_a′`offset < max_linear_offset
{-5} lvl′ = pdir_lvl
{-6} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))

{-7} ∃ (lin_a: (linear_range′)):

xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, lin_a)

= phy_a′

{1} aligned?(2)(offset(phy_a′))

Repeatedly Skolemizing and flattening, Adding type constraints for (data(read_data(pm_phy, pdbr_data_type)(PDBR)(s!1))‘base_addr), Using lemma xlat_idx_pe_aligned, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pe_in_pt_range_aligned.1.
pe_in_pt_range_aligned.2:

{-1} lvl′ < max_level
{-2} Mem?(phy_a′`type_of)
{-3} 0 ≤ phy_a′`offset
{-4} phy_a′`offset < max_linear_offset

{-5} ∃ (pde: (pe_in_pdir_range?(s′, linear_range′))):

∃ (lin_a: (linear_range′)):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′)) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′)))) ∧ xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′))), lin_a)

= phy_a′

{1} lvl′ = pdir_lvl
{2} aligned?(2)(offset(phy_a′))

Repeatedly Skolemizing and flattening, Using lemma xlat_idx_pe_aligned, Expanding the definition of base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pe_in_pt_range_aligned.2.

Q.E.D.

C.115.10 Linear_Memory_Blessing.pe_in_pt_address_in_pt

Terse proof for pe_in_pt_address_in_pt.
pe_in_pt_address_in_pt:

{1} ∀ (linear_range: PRED[Memory_Address_4G], lvl: Level,

s: Linear_memory[Physical_memory, pm_phy], base: Memory_Address_4G): pe_in_pt_range?(s, linear_range, lvl)(base) ⊃ (address_block(base, expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s, linear_range)))

Repeatedly Skolemizing and flattening, Expanding the definition of subset?, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of address_in_pt_range?, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

pe_in_pt_address_in_pt.1:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-6} address_block(base′, expt(2, pe_size))(x′)

{1} ∃ (pe: Memory_Address_4G, lvl: Level): pe_in_pt_range?(s′, linear_range′, lvl)(pe) ∧ address_block(pe, expt(2, pe_size))(x′)

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pe_in_pt_address_in_pt.1.
pe_in_pt_address_in_pt.2:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-6} address_block(base′, expt(2, pe_size))(x′)
{1} x′`offset < max_linear_offset

Using lemma pe_in_pt_range_aligned, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of address_block, Applying disjunctive simplification to flatten sequent, Using lemma aligned_add_below, we get 2 subgoals:

pe_in_pt_address_in_pt.2.1:

{-1} pe_size ≤ bus_width ∧ offset(base′) < expt(2, bus_width) ∧ aligned?(pe_size)(offset(base′)) ∧ expt(2, pe_size) − 1 < expt(2, pe_size) ⊃ offset(base′) + expt(2, pe_size) − 1 < expt(2, bus_width)

{-2} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-3} aligned?(pe_size)(offset(base′))
{-4} lvl′ < max_level
{-5} Mem?(base′`type_of)
{-6} 0 ≤ base′`offset
{-7} base′`offset < max_linear_offset
{-8} type_of(base′) = type_of(x′)
{-9} offset(x′) < offset(base′) + expt(2, pe_size)
{1} x′`offset < max_linear_offset

Installing automatic rewrites from: (max_linear_offset! bus_width! pe_size!) Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pe_in_pt_address_in_pt.2.1.
pe_in_pt_address_in_pt.2.2:

{-1} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-2} aligned?(pe_size)(offset(base′))
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} type_of(base′) = type_of(x′)
{-8} offset(x′) < offset(base′) + expt(2, pe_size)
{1} expt(2, pe_size) − 1 ≥ 0
{2} x′`offset < max_linear_offset

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pe_in_pt_address_in_pt.2.2.
pe_in_pt_address_in_pt.3:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-6} address_block(base′, expt(2, pe_size))(x′)
{1} 0 ≤ x′`offset

Expanding the definition of address_block, which is trivially true.

This completes the proof of pe_in_pt_address_in_pt.3.
pe_in_pt_address_in_pt.4:

{-1} lvl′ < max_level
{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} pe_in_pt_range?(s′, linear_range′, lvl′)(base′)
{-6} address_block(base′, expt(2, pe_size))(x′)
{1} Mem?(x′`type_of)

Expanding the definition of address_block, which is trivially true.

This completes the proof of pe_in_pt_address_in_pt.4.

Q.E.D.

C.115.11 Linear_Memory_Blessing.is_linear_plain_memory?_TCC1

Terse proof for is_linear_plain_memory?_TCC1.

is_linear_plain_memory?_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]): (∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm ⊃ (∀ (s_{1}, s_{2}: (pm`states)): OK?[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS)(s_{1})))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of is_linear_plain_memory?_TCC1.

Q.E.D.

C.115.12 Linear_Memory_Blessing.is_linear_plain_memory?_TCC2

Terse proof for is_linear_plain_memory?_TCC2.
is_linear_plain_memory?_TCC2:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]): (∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm ⊃ (∀ (s_{1}, s_{2}: (pm`states)): OK?[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS)(s_{2})))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of is_linear_plain_memory?_TCC2.

Q.E.D.

C.115.13 Linear_Memory_Blessing.is_linear_plain_memory?_TCC3

Terse proof for is_linear_plain_memory?_TCC3.
is_linear_plain_memory?_TCC3:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]): (∀ (s: (pm`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2})))

∧

(∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm

⊃

(∀ (s_{11}, s_{21}: (pm`states)):

OK?[Physical_memory, Pdbr_type] (read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{11})))

Repeatedly Skolemizing and flattening, Instantiating quantified variables,

This completes the proof of is_linear_plain_memory?_TCC3.

Q.E.D.

C.115.14 Linear_Memory_Blessing.is_linear_plain_memory?_TCC4

Terse proof for is_linear_plain_memory?_TCC4.
is_linear_plain_memory?_TCC4:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]): (∀ (s: (pm`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2})))

∧

(∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm

⊃

(∀ (s_{11}, s_{21}: (pm`states)):

OK?[Physical_memory, Pdbr_type] (read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{21})))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

This completes the proof of is_linear_plain_memory?_TCC4.

Q.E.D.

C.115.15 Linear_Memory_Blessing.is_linear_plain_memory?_TCC5

Terse proof for is_linear_plain_memory?_TCC5.

is_linear_plain_memory?_TCC5:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]):

(∀ (s: (pm`states), lvl: Level,

 a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl))):

OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

= pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

∧ pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

= pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr))))

∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2})))

∧ (∀ (s: (pm`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2})))

∧ (∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm

⊃ (∀ (s_{11}, s_{21}: (pm`states), lvl1: Level,

a_{1}:

(pe_in_pt_range?(s_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl1))):

OK?[Physical_memory, ((range_pt(lvl1)))]

(read_data[Physical_memory, ((range_pt(lvl1)))] (pm_phy, paging_data_type(lvl1))(a_{1})(s_{11})))

Repeatedly Skolemizing and flattening, Instantiating quantified variables,

C.115 Proofs for Linear_Memory_Blessing (challenge-linear.pvs)

This completes the proof of is_linear_plain_memory?_TCC5.

Q.E.D.

C.115.16 Linear_Memory_Blessing.is_linear_plain_memory?_TCC6

Terse proof for is_linear_plain_memory?_TCC6.

is_linear_plain_memory?_TCC6:

{1} ∀ (pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]]):

(∀ (s: (pm`states), lvl: Level,

 a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl))):

OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

= pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

∧ pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))

= pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr))))

∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2})))

∧ (∀ (s: (pm`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))) ∧ (∀ (s_{1}, s_{2}: (pm`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2})))

∧ (∀ (s: (pm`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))) ∧ pm`mem = linear_pm

⊃ (∀ (s_{11}, s_{21}: (pm`states), lvl1: Level,

a_{1}:

(pe_in_pt_range?(s_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl1))):

OK?[Physical_memory, ((range_pt(lvl1)))]

(read_data[Physical_memory, ((range_pt(lvl1)))] (pm_phy, paging_data_type(lvl1))(a_{1})(s_{21})))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables,

we get 2 subgoals:

is_linear_plain_memory?_TCC6.1:

{-1} pm′`states(s′_{11})
{-2} pm′`states(s′_{21})
{-3} lvl1′ < max_level
{-4} Mem?(a′_{1}`type_of)
{-5} 0 ≤ a′_{1}`offset
{-6} a′_{1}`offset < max_linear_offset

{-7} pe_in_pt_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl1′)

(a′_{1})

{-8} pe_in_pdir_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)): data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-13} pm′`mem = linear_pm

{1} pe_in_pt_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl1′)

(a′_{1})

{2} OK?[Physical_memory, ((range_pt(lvl1′)))]

(read_data[Physical_memory, ((range_pt(lvl1′)))] (pm_phy, paging_data_type(lvl1′))(a′_{1})(s′_{21}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of pe_in_pt_range?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of is_linear_plain_memory?_TCC6.1.

is_linear_plain_memory?_TCC6.2:

{-1} pm′`states(s′_{11})
{-2} pm′`states(s′_{21})
{-3} lvl1′ < max_level
{-4} Mem?(a′_{1}`type_of)
{-5} 0 ≤ a′_{1}`offset
{-6} a′_{1}`offset < max_linear_offset

{-7} pe_in_pt_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl1′)

(a′_{1})

{-8} ∀ (s: (pm′`states), lvl: Level,

           a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-9} pe_in_pdir_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s′_{11},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-14} pm′`mem = linear_pm

{1} pe_in_pt_range?(s′_{21},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl1′)

(a′_{1})

{2} OK?[Physical_memory, ((range_pt(lvl1′)))]

(read_data[Physical_memory, ((range_pt(lvl1′)))] (pm_phy, paging_data_type(lvl1′))(a′_{1})(s′_{21}))

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Expanding the definition of pe_in_pt_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of is_linear_plain_memory?_TCC6.2.

Q.E.D.

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

C.116.1 Linear_Memory_Blessing_Properties.linear_plain_transformers_ok

Terse proof for linear_plain_transformers_ok.
linear_plain_transformers_ok:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ transformers_ok?(pm`states,

((memory_read_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_transformers (pm‘mem, pm‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))))

Installing automatic rewrites from: (linear_resolve_read_transformers_ok linear_resolve_write_transformers_ok linear_resolve_transformer_invariant singleton member)

Repeatedly Skolemizing and flattening, Rewriting using transformers_ok_all_transformers, matching in *, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of union, Using lemma pm_states, Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

linear_plain_transformers_ok.1:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)
{1} transformers_ok?(pm′`states, singleton(q′))

Expanding the definition of memory_read_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -5, Hiding formulas: -5, Rewriting using pm_read_linear, matching in *, Expanding the definition of linear_read, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA

(pa: Address): FORALL (s: (pm!1‘states)): OK?(linear_resolve(a!1, Read)(s)) IMPLIES pa = data(linear_resolve(a!1, Read)(s)),

we get 4 subgoals:

linear_plain_transformers_ok.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} in_memory(min_linear, max_linear)(a′)
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{1} transformers_ok?(pm′`states, singleton(expr_2_super(linear_resolve(a′, Read))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))))

Hiding formulas: 2, Using lemma linear_resolve_read_transformers_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (s!1 q!2), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Hiding formulas: (-2 2), Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.1.
linear_plain_transformers_ok.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} in_memory(min_linear, max_linear)(a′)
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{1} transformer_invariant?(pm′`states, singleton(expr_2_super(linear_resolve(a′, Read))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))))

Hiding formulas: 2, Using lemma linear_resolve_transformer_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.2.
linear_plain_transformers_ok.1.3:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} in_memory(min_linear, max_linear)(a′)
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states

{1} ∀ (s_1: (pm′`states)):

OK?(linear_resolve(a′, Read)(s_1)) ⊃

(∀ (s: (pm′`states)): OK?(linear_resolve(a′, Read)(s)) ⊃ data(linear_resolve(a′, Read)(s_1)) = data(linear_resolve(a′, Read)(s)))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma linear_resolve_same_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.3.
linear_plain_transformers_ok.1.4:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} in_memory(min_linear, max_linear)(a′)
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{1} ∀ (d:

(λ (pa: Address):

∀ (s: (pm′`states)): OK?(linear_resolve(a′, Read)(s)) ⊃ pa = data(linear_resolve(a′, Read)(s)))):

transformers_ok?(pm′`states, singleton(expr_2_super(memory_read(pm_phy`mem)(d)))) {2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))))

Repeatedly Skolemizing and flattening, Hiding formulas: 2, Using lemma plain_memory_transformers_ok_read_ro_rw, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of transformers_ok?, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Hiding formulas: (-3 -5 2), Instantiating quantified variables, Using lemma pm_linear_resolve_read_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -3, Expanding the definition of memory_read_transformers, Instantiating quantified variables, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -4 -5 -6 -7), Expanding the definition of restrict, Expanding the definition of subset?, Expanding the definition of virt_to_phys_range, Instantiating the top quantifier in -1 with the terms: (d!1), we get 2 subgoals:

linear_plain_transformers_ok.1.4.1:

{-1} (d′ ∈ λ (phy_a: Memory_Address_4G ) : ∃ (lin_a: ((λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))), ac : ((singleton(Read) ∪ singleton(Execute)))) : OK?(linear_resolve(lin_a, ac)(s′)) ∧ data(linear_resolve(lin_a, ac)(s′)) = phy_a)

⇒ (d′ ∈ λ (s : Memory_Address_4G ) : union(pm_phy‘ro_addr, pm_phy‘rw_addr)(s))

{-2} is_linear_plain_memory?(pm′)
{-3} OK?(linear_resolve(a′, Read)(s′))
{-4} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-5} pm′`states(s′)
{-6} plain_memory?(pm_phy)
{-7} d′ = data(linear_resolve(a′, Read)(s′))
{-8} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-9} in_memory(min_linear, max_linear)(a′)
{-10} Mem?(type_of(a′))
{-11} pm′`states = pm_phy`states
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, we get 3 subgoals:

linear_plain_transformers_ok.1.4.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} pm′`states = pm_phy`states
{1} OK?(linear_resolve(a′, Read)(s′)) ∧ data(linear_resolve(a′, Read)(s′)) = d′
{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.4.1.1.

linear_plain_transformers_ok.1.4.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} pm′`states = pm_phy`states

{1} union[Memory_access]

(singleton[Memory_access](Read), singleton[Memory_access](Execute))(Read)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.4.1.2.
linear_plain_transformers_ok.1.4.1.3:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} pm′`states = pm_phy`states

{1} union[Memory_Address_4G]

(λ (s: Memory_Address_4G): pm′`ro_addr(s), λ (s: Memory_Address_4G): pm′`rw_addr(s))

(a′)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Keeping (-7 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.4.1.3.
linear_plain_transformers_ok.1.4.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} x′ = expr_2_super(memory_read(pm_phy`mem)(d′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} pm′`states = pm_phy`states
{1} Mem?(d′`type_of) ∧ 0 ≤ d′`offset ∧ d′`offset < max_linear_offset
{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.1.4.2.
linear_plain_transformers_ok.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} memory_write_transformers(pm′`mem, pm′`rw_addr)(q′)
{1} transformers_ok?(pm′`states, singleton(q′))

Expanding the definition of memory_write_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -6, Hiding formulas: -6, Rewriting using pm_write_linear, matching in *, Expanding the definition of linear_write, Using lemma pm_memory_addr, Installing automatic rewrites from: union_right Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using fexpr_composition_transformers_ok, matching in * where P gets LAMBDA

(pa: Address): FORALL (s: (pm!1‘states)): OK?(linear_resolve(a!1, Write)(s)) IMPLIES pa = data(linear_resolve(a!1, Write)(s)),

we get 4 subgoals:

linear_plain_transformers_ok.2.1:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′)
{-3} Mem?(type_of(a′))
{-4} b′ < max_byte
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(a′)
{1} transformers_ok?(pm′`states, singleton(expr_2_super(linear_resolve(a′, Write))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)(pa, b′)))))

Hiding formulas: 2, Using lemma linear_resolve_write_transformers_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.1.

linear_plain_transformers_ok.2.2:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′)
{-3} Mem?(type_of(a′))
{-4} b′ < max_byte
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(a′)
{1} transformer_invariant?(pm′`states, singleton(expr_2_super(linear_resolve(a′, Write))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)(pa, b′)))))

Hiding formulas: 2, Using lemma linear_resolve_transformer_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 1) and hiding *, Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.2.
linear_plain_transformers_ok.2.3:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′)
{-3} Mem?(type_of(a′))
{-4} b′ < max_byte
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(a′)

{1} ∀ (s_1: (pm′`states)):

OK?(linear_resolve(a′, Write)(s_1)) ⊃ (∀ (s: (pm′`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ data(linear_resolve(a′, Write)(s_1)) = data(linear_resolve(a′, Write)(s)))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)(pa, b′)))))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma linear_resolve_same_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.3.

linear_plain_transformers_ok.2.4:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′)
{-3} Mem?(type_of(a′))
{-4} b′ < max_byte
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(a′)
{1} ∀ (d:

(λ (pa: Address):

∀ (s: (pm′`states)): OK?(linear_resolve(a′, Write)(s)) ⊃ pa = data(linear_resolve(a′, Write)(s)))):

transformers_ok?(pm′`states,

singleton(expr_2_super(memory_write(pm_phy`mem)(d, b′))))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)(pa, b′)))))

Repeatedly Skolemizing and flattening, Hiding formulas: 2, Using lemma plain_memory_transformers_ok_write_block, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

linear_plain_transformers_ok.2.4.1:

{-1} plain_memory?(pm_phy)
{-2} ∀ (s: (pm′`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ d′ = data(linear_resolve(a′, Write)(s))

{-3} is_linear_plain_memory?(pm′)
{-4} in_memory(min_linear, max_linear)(a′)
{-5} Mem?(type_of(a′))
{-6} b′ < max_byte
{-7} pm′`states = pm_phy`states
{-8} pm′`rw_addr(a′)

{1} transformers_ok?(pm′`states, memory_write_transformers(pm_phy`mem, ad-

dress_block(d′, 1)))

{2} transformers_ok?(pm′`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))))
{3} (address_block(d′, 1) ⊆ pm_phy‘rw_addr)

Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Hiding formulas: (1 2), Instantiating quantified variables, Expanding the definition of address_block, Hiding formulas: (-2), Using lemma pm_linear_resolve_write_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -3 -5 -6 -7), Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 3 subgoals:

linear_plain_transformers_ok.2.4.1.1:

{-1} (x′ ∈ virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr), singleton(Write)))

⇒ (x′ ∈ restrict[Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′)
{-3} OK?(linear_resolve(a′, Write)(s′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} (x′ ∈ λ (a : Address) : type_of(d′) = type_of(a) ∧ offset(d′) ≤ offset(a) ∧ offset(a) < 1 + offset(d′))
{-7} d′ = data(linear_resolve(a′, Write)(s′))
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} b′ < max_byte
{-11} pm′`states = pm_phy`states
{-12} pm′`rw_addr(a′)
{1} (x′ ∈ pm_phy‘rw_addr)

Expanding the definition of restrict, Expanding the definition of virt_to_phys_range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on d!1 = x!1, we get 2 subgoals:

linear_plain_transformers_ok.2.4.1.1.1:

{-1} d′ = x′
{-2} OK?(linear_resolve(a′, Write)(s′))
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} type_of(d′) = type_of(x′)
{-7} offset(d′) ≤ offset(x′)
{-8} offset(x′) < 1 + offset(d′)
{-9} d′ = data(linear_resolve(a′, Write)(s′))
{-10} in_memory(min_linear, max_linear)(a′)
{-11} Mem?(type_of(a′))
{-12} b′ < max_byte
{-13} pm′`states = pm_phy`states
{-14} pm′`rw_addr(a′)
{1} data(linear_resolve(a′, Write)(s′)) = x′
{2} pm_phy`rw_addr(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.4.1.1.1.

C Proof scripts

linear_plain_transformers_ok.2.4.1.1.2:

{-1} OK?(linear_resolve(a′, Write)(s′))
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} plain_memory?(pm_phy)
{-5} type_of(d′) = type_of(x′)
{-6} offset(d′) ≤ offset(x′)
{-7} offset(x′) < 1 + offset(d′)
{-8} d′ = data(linear_resolve(a′, Write)(s′))
{-9} in_memory(min_linear, max_linear)(a′)
{-10} Mem?(type_of(a′))
{-11} b′ < max_byte
{-12} pm′`states = pm_phy`states
{-13} pm′`rw_addr(a′)
{1} d′ = x′
{2} data(linear_resolve(a′, Write)(s′)) = x′
{3} pm_phy`rw_addr(x′)

Keeping (-5 -6 -7 1) and hiding *, Applying decompose-equality,

This completes the proof of linear_plain_transformers_ok.2.4.1.1.2.
linear_plain_transformers_ok.2.4.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Write)(s′))
{-3} pm′`states(s′)
{-4} plain_memory?(pm_phy)
{-5} (x′ ∈ λ (a : Address) : type_of(d′) = type_of(a) ∧ offset(d′) ≤ offset(a) ∧ offset(a) < 1 + offset(d′))
{-6} d′ = data(linear_resolve(a′, Write)(s′))
{-7} in_memory(min_linear, max_linear)(a′)
{-8} Mem?(type_of(a′))
{-9} b′ < max_byte
{-10} pm′`states = pm_phy`states
{-11} pm′`rw_addr(a′)
{1} Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset
{2} (x′ ∈ pm_phy‘rw_addr)

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.4.1.2.

linear_plain_transformers_ok.2.4.1.3:

{-1} ∀ (x: Memory_Address_4G):

(x ∈ virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr), singleton(Write))) ⇒ (x ∈ restrict[Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′)
{-3} OK?(linear_resolve(a′, Write)(s′))
{-4} pm′`states(s′)
{-5} plain_memory?(pm_phy)
{-6} (x′ ∈ λ (a : Address) : type_of(d′) = type_of(a) ∧ offset(d′) ≤ offset(a) ∧ offset(a) < 1 + offset(d′))
{-7} d′ = data(linear_resolve(a′, Write)(s′))
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} b′ < max_byte
{-11} pm′`states = pm_phy`states
{-12} pm′`rw_addr(a′)
{1} Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset
{2} (x′ ∈ pm_phy‘rw_addr)

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.2.4.1.3.
linear_plain_transformers_ok.2.4.2:

{-1} plain_memory?(pm_phy)

{-2} transformers_ok?(pm_phy`states, memory_write_transformers(pm_phy`mem, ad-

dress_block(d′, 1))) {-3} ∀ (s: (pm′`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ d′ = data(linear_resolve(a′, Write)(s))

{-4} is_linear_plain_memory?(pm′)
{-5} in_memory(min_linear, max_linear)(a′)
{-6} Mem?(type_of(a′))
{-7} b′ < max_byte
{-8} pm′`states = pm_phy`states
{-9} pm′`rw_addr(a′)
{1} (singleton(expr_2_super (memory_write(pm_phy‘mem)(d′, b′))) ⊆ memory_write_transformers (pm_phy‘mem, address_block(d′, 1)))
{2} transformers_ok?(pm′`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))))

Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Expanding the definition of memory_write_transformers, Instantiating quantified variables, Expanding the definition of address_block, which is trivially true.

This completes the proof of linear_plain_transformers_ok.2.4.2.

linear_plain_transformers_ok.2.4.3:

{-1} plain_memory?(pm_phy)
{-2} ∀ (s: (pm′`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ d′ = data(linear_resolve(a′, Write)(s))

{-3} is_linear_plain_memory?(pm′)
{-4} in_memory(min_linear, max_linear)(a′)
{-5} Mem?(type_of(a′))
{-6} b′ < max_byte
{-7} pm′`states = pm_phy`states
{-8} pm′`rw_addr(a′)
{1} (singleton(expr_2_super (memory_write(pm_phy‘mem)(d′, b′))) ⊆ memory_write_transformers (pm_phy‘mem, address_block(d′, 1)))
{2} transformers_ok?(pm′`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))))
{3} (address_block(d′, 1) ⊆ pm_phy‘rw_addr)

Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Expanding the definition of memory_write_transformers, Instantiating quantified variables, Expanding the definition of address_block, which is trivially true.

This completes the proof of linear_plain_transformers_ok.2.4.3.
linear_plain_transformers_ok.3:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} memory_read_side_effect_super_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)
{1} transformers_ok?(pm′`states, singleton(q′))

Expanding the definition of memory_read_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -6, Hiding formulas: (-1 -6), Rewriting using pm_read_side_effect_linear, matching in *, Expanding the definition of linear_read_side_effect, Case splitting on null?(bl!1) OR (reg_base(min_linear)(type_of(a!1)) <= a!1 AND a!1 + length(bl!1)

<= reg_size(max_linear)(type_of(a!1))), we get 4 subgoals:

linear_plain_transformers_ok.3.1:

{-1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Case splitting on Mem?(type_of(a!1)),

we get 2 subgoals:

linear_plain_transformers_ok.3.1.1:

{-1} Mem?(type_of(a′))

{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Replacing using formula -2, Simplifying, rewriting, and recording with decision procedures, Case splitting on null?(bl!1), we get 2 subgoals:

linear_plain_transformers_ok.3.1.1.1:

{-1} null?(bl′)
{-2} Mem?(type_of(a′))

{-3} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-4} is_linear_plain_memory?(pm′)
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′), lin-

ear_read_side_effect_in_page)

(s))))

Hiding formulas: -3, Using lemma split_null, Expanding the definition of apply_side_effects, Expanding the definition of reduce, Expanding the definition of ok_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.3.1.1.1.
linear_plain_transformers_ok.3.1.1.2:

{-1} Mem?(type_of(a′))
{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} null?(bl′)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′), lin-

ear_read_side_effect_in_page)

(s))))

Hiding formulas: -2, Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -7, Hiding formulas: -7, Case splitting on 0 <= a!1‘offset AND a!1‘offset < max_linear_offset, we get 2 subgoals:

linear_plain_transformers_ok.3.1.1.2.1:

{-1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{-2} Mem?(type_of(a′))
{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} pm′`states(s′)
{1} null?(bl′)

{2} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s))

(s′))

Using lemma address_block_split_type, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using ok_expr_2_super, matching in *, Using lemma apply_side_effects_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_transformers_ok.3.1.1.2.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} Mem?(type_of(a′))
{-8} plain_memory?(pm_phy)
{-9} pm′`states = pm_phy`states

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{2} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{3} null?(bl′)

Using lemma split_linear_read_side_effects_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.3.1.1.2.1.1.
linear_plain_transformers_ok.3.1.1.2.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} Mem?(type_of(a′))
{-8} plain_memory?(pm_phy)
{-9} pm′`states = pm_phy`states

{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′))

{2} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{3} null?(bl′)

Repeatedly Skolemizing and flattening, Using lemma split_linear_read_side_effects_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.3.1.1.2.1.2.

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_transformers_ok.3.1.1.2.2:

{-1} Mem?(type_of(a′))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} pm′`states(s′)
{1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{2} null?(bl′)

{3} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s))

(s′))

Hiding formulas: 3, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of subset?, Instantiating quantified variables, Using lemma pm_memory_addr, Expanding the definition of address_block, Expanding the definition of in_memory, Expanding the definition of reg_size, Expanding the definition of <, Expanding the definition of max_linear, Expanding the definition of reg_base, Expanding the definition of min_linear, Expanding the definition of Mem, Expanding the definition of <=, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.3.1.1.2.2.

linear_plain_transformers_ok.3.1.2:

{-1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} Mem?(type_of(a′))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_transformers_ok_read_side_effects_ro_rw, Using lemma transformers_ok_mono_transformers, Hiding formulas: -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-2 2), Expanding the definition of memory_read_side_effect_super_transformers, Expanding the definition of expr_2_super, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Replacing using formula -1, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -6 with the terms: x′′, Expanding the definition of address_block, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.3.1.2.

linear_plain_transformers_ok.3.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Hiding formulas: 2,

Expanding the definition of length,

Applying disjunctive simplification to flatten sequent,

Using lemma pm_memory_addr,

Using lemma pm_memory_addr,

we get 2 subgoals:

linear_plain_transformers_ok.3.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′ + length(cdr(bl′))) ⊃ in_memory(min_linear, max_linear)(a′ + length(cdr(bl′))) ∧ Mem?(type_of(a′ + length(cdr(bl′))))

{-2} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃

in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} null?(bl′)

{2} (reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases ≤ reg_size(max_linear)(type_of(a′)))

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: (-4 -3),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.3.2.1.

linear_plain_transformers_ok.3.2.2:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃

in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} cons?[Byte](bl′)
{2} null?(bl′)

{3} (reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases ≤ reg_size(max_linear)(type_of(a′)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.3.2.2.

linear_plain_transformers_ok.3.3:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ¬ null?(bl′) ∧ reg_base(min_linear)(type_of(a′)) ≤ a′ ⊃ Mem?(max_linear`type_of)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of linear_plain_transformers_ok.3.3.

linear_plain_transformers_ok.3.4:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ¬ null?(bl′) ⊃ Mem?(min_linear`type_of)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Expanding the definition of min_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of linear_plain_transformers_ok.3.4.
linear_plain_transformers_ok.4:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} memory_write_side_effect_super_transformers(pm′`mem, pm′`rw_addr)(q′)
{1} transformers_ok?(pm′`states, singleton(q′))

Expanding the definition of memory_write_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -6, Hiding formulas: (-1 -6), Rewriting using pm_write_side_effect_linear, matching in *, Expanding the definition of linear_write_side_effect, Case splitting on null?(bl!1) OR (reg_base(min_linear)(type_of(a!1)) <= a!1 AND a!1 + length(bl!1)

<= reg_size(max_linear)(type_of(a!1))), we get 4 subgoals:

linear_plain_transformers_ok.4.1:

{-1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Case splitting on Mem?(type_of(a!1)),

we get 2 subgoals:

linear_plain_transformers_ok.4.1.1:

{-1} Mem?(type_of(a′))

{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Replacing using formula -2, Simplifying, rewriting, and recording with decision procedures, Case splitting on null?(bl!1), we get 2 subgoals:

linear_plain_transformers_ok.4.1.1.1:

{-1} null?(bl′)
{-2} Mem?(type_of(a′))

{-3} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-4} is_linear_plain_memory?(pm′)
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′), lin-

ear_write_side_effect_in_page)

(s))))

Hiding formulas: -3, Using lemma split_null, Expanding the definition of apply_side_effects, Expanding the definition of reduce, Expanding the definition of ok_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.4.1.1.1.
linear_plain_transformers_ok.4.1.1.2:

{-1} Mem?(type_of(a′))
{-2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} null?(bl′)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′), lin-

ear_write_side_effect_in_page)

(s))))

Hiding formulas: -2, Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -7, Hiding formulas: -7, Case splitting on 0 <= a!1‘offset AND a!1‘offset < max_linear_offset, we get 2 subgoals:

linear_plain_transformers_ok.4.1.1.2.1:

{-1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{-2} Mem?(type_of(a′))
{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} pm′`states(s′)
{1} null?(bl′)

{2} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s))

(s′))

Using lemma address_block_split_type, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_transformers_ok.4.1.1.2.1.1:

{-1} is_linear_plain_memory?(pm′)

{-2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} Mem?(type_of(a′))
{-6} plain_memory?(pm_phy)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)
{1} null?(bl′)

{2} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s))

(s′))

Rewriting using ok_expr_2_super, matching in *,

Using lemma apply_side_effects_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_plain_transformers_ok.4.1.1.2.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} Mem?(type_of(a′))
{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{2} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))
{3} null?(bl′)

Using lemma split_linear_write_side_effects_states,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.4.1.1.2.1.1.1.

linear_plain_transformers_ok.4.1.1.2.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} Mem?(type_of(a′))
{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′))

{2} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))
{3} null?(bl′)

Repeatedly Skolemizing and flattening,

Using lemma split_linear_write_side_effects_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformers_ok.4.1.1.2.1.1.2.
linear_plain_transformers_ok.4.1.1.2.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} 0 ≤ a′`offset
{-3} a′`offset < max_linear_offset
{-4} Mem?(type_of(a′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)
{1} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{2} null?(bl′)

{3} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s))

(s′))

Hiding formulas: 3,

Keeping (-6 1) and hiding *,

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets pm!1‘rw_addr,

Rewriting using union_subset3, matching in *,

This completes the proof of linear_plain_transformers_ok.4.1.1.2.1.2.

C Proof scripts

linear_plain_transformers_ok.4.1.1.2.2:

{-1} Mem?(type_of(a′))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-6} pm′`states(s′)
{1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{2} null?(bl′)

{3} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s))

(s′))

Hiding formulas: 3, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of subset?, Instantiating quantified variables, Using lemma pm_memory_addr, Expanding the definition of address_block, Expanding the definition of in_memory, Expanding the definition of reg_size, Expanding the definition of <, Expanding the definition of max_linear, Expanding the definition of reg_base, Expanding the definition of min_linear, Expanding the definition of Mem, Expanding the definition of <=, Rewriting using union_right, matching in *,

This completes the proof of linear_plain_transformers_ok.4.1.1.2.2.

linear_plain_transformers_ok.4.1.2:

{-1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} Mem?(type_of(a′))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_transformers_ok_write_side_effects_ro_rw, Using lemma transformers_ok_mono_transformers, Hiding formulas: -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-2 2), Expanding the definition of memory_write_side_effect_super_transformers, Expanding the definition of expr_2_super, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Replacing using formula -1, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -6 with the terms: x′′, Expanding the definition of address_block, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using union_right, matching in *,

This completes the proof of linear_plain_transformers_ok.4.1.2.

linear_plain_transformers_ok.4.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Hiding formulas: 2,

Expanding the definition of length,

Using lemma pm_memory_addr,

Using lemma pm_memory_addr,

we get 2 subgoals:

linear_plain_transformers_ok.4.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′ + length(cdr(bl′))) ⊃ in_memory(min_linear, max_linear)(a′ + length(cdr(bl′))) ∧ Mem?(type_of(a′ + length(cdr(bl′))))

{-2} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃

in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-3} is_linear_plain_memory?(pm′)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases) ⊆ pm′‘rw_addr)

{1} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases ≤ reg_size(max_linear)(type_of(a′)))

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: (-4 -3),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformers_ok.4.2.1.

linear_plain_transformers_ok.4.2.2:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃

in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases) ⊆ pm′‘rw_addr)
{1} cons?[Byte](bl′)

{2} null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + cases bl′ of null : 0, cons(x, y) : length(y) + 1 endcases ≤ reg_size(max_linear)(type_of(a′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_plain_transformers_ok.4.2.2.

linear_plain_transformers_ok.4.3:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ¬ null?(bl′) ∧ reg_base(min_linear)(type_of(a′)) ≤ a′ ⊃ Mem?(max_linear`type_of)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of linear_plain_transformers_ok.4.3.

linear_plain_transformers_ok.4.4:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ¬ null?(bl′) ⊃ Mem?(min_linear`type_of)

{2} transformers_ok?(pm′`states,

singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′)))

then if Mem?(type_of(a′)) then ap-

ply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)

endif else Fatal endif)))

Expanding the definition of min_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of linear_plain_transformers_ok.4.4.

Q.E.D.

C.116.2 Linear_Memory_Blessing_Properties.linear_plain_unchanged_memory_invariant

Terse proof for linear_plain_unchanged_memory_invariant.
linear_plain_unchanged_memory_invariant:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

((pm‘other_actions∪ memory_read_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))), (pm‘ro_addr∪ pm‘rw_addr))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: has_next_state singleton subset_reflexive pm_write_linear lin-

ear_write Mem in_memory Mem reg_size union_left max_linear < Using lemma linear_unchanged_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_unchanged_memory_invariant.1:

{-1} is_linear_plain_memory?(pm′)

{-2} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Case splitting on extend[Address, Memory_Address_4G, bool, FALSE] (restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr))) = union(pm!1‘ro_addr, pm!1‘rw_addr),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.1.1:

{-1} extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) = (pm′‘ro_addr∪ pm′‘rw_addr)

{-2} is_linear_plain_memory?(pm′)

{-3} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.1.1.
linear_plain_unchanged_memory_invariant.1.2:

{-1} is_linear_plain_memory?(pm′)

{-2} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))

{1} extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) = (pm′‘ro_addr∪ pm′‘rw_addr)

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Hiding formulas: (-2 2), Expanding the definition of extend, Expanding the definition of restrict, Applying decompose-equality, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.1.2.
linear_plain_unchanged_memory_invariant.2:

{-1} is_linear_plain_memory?(pm′)
{1} ∀ (s: (pm′`states)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using unchanged_memory_invariant_all_transformers, matching in * where pm gets

pm_phy‘mem, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of union, Expanding the definition of member, Using lemma pm_plain_phy, Using lemma pm_states, Using lemma plain_memory_unchanged_invariant, Case splitting on subset?(extend[Address, Memory_Address_4G, bool, FALSE] (virt_to_phys_range(s!1,

restrict [Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr)), union (singleton(Read), singleton(Execute)))), union(pm_phy‘ro_addr, pm_phy‘rw_addr)),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} plain_memory?(pm_phy) ⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} is_linear_plain_memory?(pm′) ⊃ pm′`states = pm_phy`states
{-4} is_linear_plain_memory?(pm′) ⊃ plain_memory?(pm_phy)

{-5} (pm′`other_actions(q′) ∨

memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)) ∨ memory_read_side_effect_super_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′) ∨ memory_write_side_effect_super_transformers(pm′`mem, pm′`rw_addr)(q′)

{-6} pm′`states(s′)
{-7} is_linear_plain_memory?(pm′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q′),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

linear_plain_unchanged_memory_invariant.2.1.1:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} plain_memory?(pm_phy)

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} pm′`other_actions(q′)
{-7} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q′),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: (-1 2), Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Keeping (-11 -16 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.1.
linear_plain_unchanged_memory_invariant.2.1.2:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} plain_memory?(pm_phy)

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)
{-7} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q′),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Expanding the definition of memory_read_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -7, Hiding formulas: -7, Rewriting using pm_read_linear, matching in *, Expanding the definition of linear_read, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using plain_memory_unchanged_composition, matching in * where P gets LAMBDA

(pa: Address): FORALL (s: (pm_phy‘states)): OK?(linear_resolve(a!1, Read)(s)) IMPLIES pa = data(linear_resolve(a!1, Read)(s)),

we get 3 subgoals:

linear_plain_unchanged_memory_invariant.2.1.2.1:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} reg_base(min_linear)(a′`type_of) ≤ a′
{-4} a′`type_of = a′`type_of
{-5} a′`offset < max_linear_offset
{-6} Mem?(type_of(a′))
{-7} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-8} plain_memory?(pm_phy)

{-9} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-10} pm′`states = pm_phy`states
{-11} pm′`states(s′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(linear_resolve(a′, Read)(s_1)) ⊃ (∀ (s: (pm_phy`states)):

OK?(linear_resolve(a′, Read)(s)) ⊃ data(linear_resolve(a′, Read)(s_1)) = data(linear_resolve(a′, Read)(s)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma linear_resolve_same_result,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.1.

linear_plain_unchanged_memory_invariant.2.1.2.2:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} reg_base(min_linear)(a′`type_of) ≤ a′
{-4} a′`type_of = a′`type_of
{-5} a′`offset < max_linear_offset
{-6} Mem?(type_of(a′))
{-7} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-8} plain_memory?(pm_phy)

{-9} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-10} pm′`states = pm_phy`states
{-11} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(linear_resolve(a′, Read))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2,

Using lemma linear_resolve_unchanged_pm_phy,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Installing automatic rewrites from: subset? member extend

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Rewriting using pm_resolve_address, matching in *,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.2.2.1:

{-1} extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))))

(x′)

{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)

{-5} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-6} reg_base(min_linear)(a′`type_of) ≤ a′
{-7} a′`type_of = a′`type_of
{-8} a′`offset < max_linear_offset
{-9} Mem?(type_of(a′))

{-10} ∀ (x: Address):

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))))

(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

{-11} plain_memory?(pm_phy)

{-12} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-13} pm′`states = pm_phy`states

{1} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x′)

{2} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(x′)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(linear_resolve(a′, Read))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Expanding the definition of extend,

which is trivially true.

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.2.1.
linear_plain_unchanged_memory_invariant.2.1.2.2.2:

{-1} extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))))

(x′)

{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)

{-5} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-6} reg_base(min_linear)(a′`type_of) ≤ a′
{-7} a′`type_of = a′`type_of
{-8} a′`offset < max_linear_offset
{-9} Mem?(type_of(a′))

{-10} ∀ (x: Address):

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))))

(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

{-11} plain_memory?(pm_phy)

{-12} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-13} pm′`states = pm_phy`states
{1} Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset

{2} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(x′)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(linear_resolve(a′, Read))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.2.2.
linear_plain_unchanged_memory_invariant.2.1.2.3:

{-1} is_linear_plain_memory?(pm′)
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} reg_base(min_linear)(a′`type_of) ≤ a′
{-4} a′`type_of = a′`type_of
{-5} a′`offset < max_linear_offset
{-6} Mem?(type_of(a′))
{-7} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-8} plain_memory?(pm_phy)

{-9} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-10} pm′`states = pm_phy`states
{-11} pm′`states(s′)
{1} ∀ (d:

(λ (pa: Address):

∀ (s: (pm_phy`states)): OK?(linear_resolve(a′, Read)(s)) ⊃ pa = data(linear_resolve(a′, Read)(s)))):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_read(pm_phy`mem)(d))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(a′, Read) ##

(λ (pa: Address): mem-

ory_read(pm_phy`mem)(pa)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Using lemma memory_read_transformers_memory_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.2.3.1:

{-1} memory_read_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

(expr_2_super(memory_read(pm_phy`mem)(d′)))

{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} ∀ (s: (pm_phy`states)):

OK?(linear_resolve(a′, Read)(s)) ⊃ d′ = data(linear_resolve(a′, Read)(s))

{-5} is_linear_plain_memory?(pm′)
{-6} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-7} reg_base(min_linear)(a′`type_of) ≤ a′
{-8} a′`type_of = a′`type_of
{-9} a′`offset < max_linear_offset
{-10} Mem?(type_of(a′))
{-11} plain_memory?(pm_phy)
{-12} pm′`states = pm_phy`states
{-13} pm′`states(s′)
{1} (singleton(expr_2_super (memory_read(pm_phy‘mem)(d′))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.3.1.
linear_plain_unchanged_memory_invariant.2.1.2.3.2:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} ∀ (s: (pm_phy`states)):

OK?(linear_resolve(a′, Read)(s)) ⊃ d′ = data(linear_resolve(a′, Read)(s))

{-4} is_linear_plain_memory?(pm′)
{-5} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-6} reg_base(min_linear)(a′`type_of) ≤ a′
{-7} a′`type_of = a′`type_of
{-8} a′`offset < max_linear_offset
{-9} Mem?(type_of(a′))
{-10} plain_memory?(pm_phy)
{-11} pm′`states = pm_phy`states
{-12} pm′`states(s′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)
{2} (singleton(expr_2_super (memory_read(pm_phy‘mem)(d′))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

Instantiating quantified variables, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Using lemma pm_linear_resolve_read_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-3 -4 -6 -7 -8 -9), Expanding the definition of subset?, Instantiating quantified variables, we get 3 subgoals:

linear_plain_unchanged_memory_invariant.2.1.2.3.2.1:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))

{-3} (d′ ∈ virt_to_phys_range (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⇒ (d′ ∈ restrict[Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-4} ∀ (x: Address):

(x ∈ extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

⇒ (x ∈ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} reg_base(min_linear)(a′`type_of) ≤ a′
{-9} a′`type_of = a′`type_of
{-10} a′`offset < max_linear_offset
{-11} Mem?(type_of(a′))
{-12} plain_memory?(pm_phy)
{-13} pm′`states = pm_phy`states
{-14} pm′`states(s′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

{2} ∀ (x: [Physical_memory → SuperResult[Physical_memory]]): (x ∈ singleton(expr_2_super (memory_read(pm_phy‘mem)(d′)))) ⇒ (x ∈ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

Expanding the definition of member,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.2.3.2.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))
{-3} restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(d′)

{-4} ∀ (x: Address):

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))))

(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} reg_base(min_linear)(a′`type_of) ≤ a′
{-9} a′`type_of = a′`type_of
{-10} a′`offset < max_linear_offset
{-11} Mem?(type_of(a′))
{-12} plain_memory?(pm_phy)
{-13} pm′`states = pm_phy`states
{-14} pm′`states(s′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

{2} ∀ (x: [Physical_memory → SuperResult[Physical_memory]]): x = expr_2_super(memory_read(pm_phy`mem)(d′)) ⇒ union((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))),

(memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))) (x)

Expanding the definition of restrict,

which is trivially true.

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.3.2.1.1.

linear_plain_unchanged_memory_invariant.2.1.2.3.2.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))

{-3} ∀ (x: Address):

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))))

(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} d′ = data(linear_resolve(a′, Read)(s′))
{-6} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-7} reg_base(min_linear)(a′`type_of) ≤ a′
{-8} a′`type_of = a′`type_of
{-9} a′`offset < max_linear_offset
{-10} Mem?(type_of(a′))
{-11} plain_memory?(pm_phy)
{-12} pm′`states = pm_phy`states
{-13} pm′`states(s′)

{1} virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(d′)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

{3} ∀ (x: [Physical_memory → SuperResult[Physical_memory]]): x = expr_2_super(memory_read(pm_phy`mem)(d′)) ⇒ union((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))),

(memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))) (x)

Expanding the definition of virt_to_phys_range,

Instantiating quantified variables,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.2.3.2.1.2.1:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))

{-3} ∀ (x: Address):

extend[Address, Memory_Address_4G, bool, false]

(λ (phy_a: Memory_Address_4G):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))), ac: ((singleton(Read) ∪ singleton(Execute)))):

OK?(linear_resolve(lin_a, ac)(s′)) ∧ data(linear_resolve(lin_a, ac)(s′)) = phy_a)

(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} d′ = data(linear_resolve(a′, Read)(s′))
{-6} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-7} reg_base(min_linear)(a′`type_of) ≤ a′
{-8} a′`type_of = a′`type_of
{-9} a′`offset < max_linear_offset
{-10} Mem?(type_of(a′))
{-11} plain_memory?(pm_phy)
{-12} pm′`states = pm_phy`states
{-13} pm′`states(s′)
{1} OK?(linear_resolve(a′, Read)(s′)) ∧ data(linear_resolve(a′, Read)(s′)) = d′
{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

{3} ∀ (x: [Physical_memory → SuperResult[Physical_memory]]):

x = expr_2_super(memory_read(pm_phy`mem)(d′)) ⇒ union((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))),

(memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))) (x)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.3.2.1.2.1.

linear_plain_unchanged_memory_invariant.2.1.2.3.2.1.2.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))

{-3} ∀ (x: Address):

extend[Address, Memory_Address_4G, bool, false]

(λ (phy_a: Memory_Address_4G):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))), ac: ((singleton(Read) ∪ singleton(Execute)))):

OK?(linear_resolve(lin_a, ac)(s′)) ∧ data(linear_resolve(lin_a, ac)(s′)) = phy_a)

(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} d′ = data(linear_resolve(a′, Read)(s′))
{-6} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-7} reg_base(min_linear)(a′`type_of) ≤ a′
{-8} a′`type_of = a′`type_of
{-9} a′`offset < max_linear_offset
{-10} Mem?(type_of(a′))
{-11} plain_memory?(pm_phy)
{-12} pm′`states = pm_phy`states
{-13} pm′`states(s′)

{1} union[Memory_Address_4G]

(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr), restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

(a′)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

{3} ∀ (x: [Physical_memory → SuperResult[Physical_memory]]): x = expr_2_super(memory_read(pm_phy`mem)(d′)) ⇒ union((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))),

(memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))) (x)

Keeping (-6 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.3.2.1.2.2.

linear_plain_unchanged_memory_invariant.2.1.2.3.2.2:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))

{-3} ∀ (x: Address):

(x ∈ extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

⇒ (x ∈ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} d′ = data(linear_resolve(a′, Read)(s′))
{-6} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-7} reg_base(min_linear)(a′`type_of) ≤ a′
{-8} a′`type_of = a′`type_of
{-9} a′`offset < max_linear_offset
{-10} Mem?(type_of(a′))
{-11} plain_memory?(pm_phy)
{-12} pm′`states = pm_phy`states
{-13} pm′`states(s′)
{1} Mem?(d′`type_of) ∧ 0 ≤ d′`offset ∧ d′`offset < max_linear_offset
{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

{3} ∀ (x: [Physical_memory → SuperResult[Physical_memory]]): (x ∈ singleton(expr_2_super (memory_read(pm_phy‘mem)(d′)))) ⇒ (x ∈ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

Using lemma linear_resolve_memory_address,

Expanding the definition of every,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.3.2.2.

linear_plain_unchanged_memory_invariant.2.1.2.3.2.3:

{-1} is_linear_plain_memory?(pm′)
{-2} OK?(linear_resolve(a′, Read)(s′))

{-3} ∀ (x: Memory_Address_4G):

(x ∈ virt_to_phys_range (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))))

⇒

(x ∈ restrict[Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-4} ∀ (x: Address):

(x ∈ extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

⇒ (x ∈ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} d′ = data(linear_resolve(a′, Read)(s′))
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} reg_base(min_linear)(a′`type_of) ≤ a′
{-9} a′`type_of = a′`type_of
{-10} a′`offset < max_linear_offset
{-11} Mem?(type_of(a′))
{-12} plain_memory?(pm_phy)
{-13} pm′`states = pm_phy`states
{-14} pm′`states(s′)
{1} Mem?(d′`type_of) ∧ 0 ≤ d′`offset ∧ d′`offset < max_linear_offset
{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(d′)

{3} ∀ (x: [Physical_memory → SuperResult[Physical_memory]]): (x ∈ singleton(expr_2_super (memory_read(pm_phy‘mem)(d′)))) ⇒ (x ∈ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

Using lemma linear_resolve_memory_address, Expanding the definition of every, Using lemma pm_linear_resolve_read_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.2.3.2.3.
linear_plain_unchanged_memory_invariant.2.1.3:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} plain_memory?(pm_phy)

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} memory_read_side_effect_super_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)
{-7} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q′),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Expanding the definition of memory_read_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -8, Hiding formulas: (-1 -8), Rewriting using pm_read_side_effect_linear, matching in *, Expanding the definition of linear_read_side_effect, Case splitting on Mem?(type_of(a!1)), we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.1:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Case splitting on null?(bl!1),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.1.1:

{-1} null?(bl′)
{-2} Mem?(type_of(a′))
{-3} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-4} plain_memory?(pm_phy)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of apply_side_effects, Expanding the definition of ok_result, Expanding the definition of reduce, Using lemma split_null, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.1.1.
linear_plain_unchanged_memory_invariant.2.1.3.1.2:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} pm′`states(s′)
{1} null?(bl′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.1.2.1:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-10} pm′`states(s′)
{1} null?(bl′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma address_block_split_type,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1:

{-1} is_linear_plain_memory?(pm′) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ⊃ every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-2} Mem?(type_of(a′))
{-3} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-4} plain_memory?(pm_phy)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} reg_base(min_linear)(type_of(a′)) ≤ a′
{-10} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-11} pm′`states(s′)
{1} null?(bl′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma apply_side_effects_unchanged,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-6} plain_memory?(pm_phy)

{-7} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-8} pm′`states = pm_phy`states
{-9} reg_base(min_linear)(type_of(a′)) ≤ a′
{-10} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-11} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects(split (min_page, a′, bl′), lin-

ear_read_side_effect_in_page))),

extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{3} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

extend[Address, Mem-

ory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))))

(split(min_page, a′, bl′))

{4} null?(bl′)

Hiding formulas: (-7 1 2), Using lemma split_linear_read_side_effects_unchanged_memory, we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.1.1:

{-1} is_linear_plain_memory?(pm′) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-5} Mem?(type_of(a′))
{-6} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} reg_base(min_linear)(type_of(a′)) ≤ a′
{-10} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-11} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

extend[Address, Mem-

ory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))))

(split(min_page, a′, bl′))

{2} null?(bl′)

Simplifying, rewriting, and recording with decision procedures, Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 2), Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.1.1.

linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-6} plain_memory?(pm_phy)
{-7} pm′`states = pm_phy`states
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-10} pm′`states(s′)
{1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

extend[Address, Mem-

ory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))))

(split(min_page, a′, bl′))

{3} null?(bl′)

Keeping (-8 -9 1 3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.1.2.

linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects(split (min_page, a′, bl′), lin-

ear_read_side_effect_in_page))),

extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-5} Mem?(type_of(a′))
{-6} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-7} plain_memory?(pm_phy)

{-8} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-9} pm′`states = pm_phy`states
{-10} reg_base(min_linear)(type_of(a′)) ≤ a′
{-11} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-12} pm′`states(s′)
{1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ extend [Address, Memory_Address_4G , bool, false](restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{3} null?(bl′)

Keeping (-6 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (x!1), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.2.

linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.3:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects(split (min_page, a′, bl′), lin-

ear_read_side_effect_in_page))),

extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-5} Mem?(type_of(a′))
{-6} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-7} plain_memory?(pm_phy)

{-8} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-9} pm′`states = pm_phy`states
{-10} reg_base(min_linear)(type_of(a′)) ≤ a′
{-11} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-12} pm′`states(s′)
{1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : apply_side_effects (split(min_page, a′, bl′), linear_read_side_effect_in_page )(s))) ⊆ singleton(expr_2_super (apply_side_effects (split(min_page, a′, bl′), linear_read_side_effect_in_page ))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{3} null?(bl′)

Keeping (1) and hiding *,

Expanding the definition of expr_2_super,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.1.3.

linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.2:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-10} pm′`states(s′)
{1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{2} null?(bl′)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Keeping (-8 -9 1 2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.1.2.1.2.

linear_plain_unchanged_memory_invariant.2.1.3.1.2.2:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} pm′`states(s′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): Fatal)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Keeping (3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.1.2.2.

linear_plain_unchanged_memory_invariant.2.1.3.1.2.3:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} pm′`states(s′)
{1} null?(bl′)
{2} reg_base(min_linear)(type_of(a′)) ≤ a′

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): Fatal)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Keeping (-7 1 2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.1.2.3.

linear_plain_unchanged_memory_invariant.2.1.3.2:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} plain_memory?(pm_phy)

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} pm′`states(s′)
{1} Mem?(type_of(a′))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory [Physical_memory, pm_phy]):

if null?(bl′) ∨

(reg_base (min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma unchanged_memory_invariant_mono, Case splitting on subset?(singleton(expr_2_super(LAMBDA (s: Linear_memory [Physical_memory,

pm_phy]): memory_read_side_effect(pm_phy‘mem) (a!1, bl!1, cp!1)(s))), union(union(pm_phy‘other_actions, memory_read_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr))), union(memory_read_side_effect_super_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr)), memory_write_side_effect_super_transformers(pm_phy‘mem,

C Proof scripts

pm_phy‘rw_addr)))),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.2.1:

{-1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{-2} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr)))) ∧ (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∧ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{-3} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-4} plain_memory?(pm_phy)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)
{1} Mem?(type_of(a′))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

1443

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.2.1.1:

{-1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{-5} plain_memory?(pm_phy)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)
{1} Mem?(type_of(a′))
{2} null?(bl′)

{3} a′ + length(bl′) ≤

reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)) {4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): Fatal)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Keeping (4) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.2.1.1.

linear_plain_unchanged_memory_invariant.2.1.3.2.1.2:

{-1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{-5} plain_memory?(pm_phy)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)
{1} Mem?(type_of(a′))
{2} null?(bl′)
{3} reg_base(min_linear)(type_of(a′)) ≤ a′

{4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): Fatal)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Keeping (-8 1 3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.2.1.2.

linear_plain_unchanged_memory_invariant.2.1.3.2.2:

{-1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr)))) ∧ (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∧ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} pm′`states(s′)
{1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{2} Mem?(type_of(a′))

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_read_side_effect_in_page)

(s)

else mem-

ory_read_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

1446

Hiding formulas: (-1 -4 3), Case splitting on memory_read_side_effect_super_transformers(pm_phy‘mem, union (pm_phy‘ro_addr,

pm_phy‘rw_addr)) (expr_2_super (LAMBDA (s: Linear_memory [Physical_memory, pm_phy]): memory_read_side_effect (pm_phy‘mem) (a!1, bl!1, cp!1)(s))),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.3.2.2.1:

{-1} memory_read_side_effect_super_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

(expr_2_super(λ (s: Linear_memory [Physical_memory, pm_phy]):

mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} pm′`states(s′)
{1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{2} Mem?(type_of(a′))

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.2.2.1.
linear_plain_unchanged_memory_invariant.2.1.3.2.2.2:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} plain_memory?(pm_phy)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} pm′`states(s′)

{1} memory_read_side_effect_super_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

(expr_2_super(λ (s: Linear_memory [Physical_memory, pm_phy]):

mem-

ory_read_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)))
{2} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_read_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{3} Mem?(type_of(a′))

Hiding formulas: 2, Expanding the definition of memory_read_side_effect_super_transformers, Instantiating quantified variables, Expanding the definition of expr_2_super, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of member, Expanding the definition of address_block,

C Proof scripts

Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.3.2.2.2.
linear_plain_unchanged_memory_invariant.2.1.4:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} plain_memory?(pm_phy)

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} memory_write_side_effect_super_transformers(pm′`mem, pm′`rw_addr)(q′)
{-7} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q′),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Expanding the definition of memory_write_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -8, Hiding formulas: (-1 -8), Rewriting using pm_write_side_effect_linear, matching in *, Expanding the definition of linear_write_side_effect, Installing automatic rewrites from: union_right Case splitting on Mem?(type_of(a!1)), we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.1:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Case splitting on null?(bl!1),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.1.1:

{-1} null?(bl′)
{-2} Mem?(type_of(a′))
{-3} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-4} plain_memory?(pm_phy)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of apply_side_effects, Expanding the definition of ok_result, Expanding the definition of reduce, Using lemma split_null, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.1.
linear_plain_unchanged_memory_invariant.2.1.4.1.2:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)
{1} null?(bl′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-10} pm′`states(s′)
{1} null?(bl′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma address_block_split_type,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1:

{-1} is_linear_plain_memory?(pm′) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ⊃ every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-2} Mem?(type_of(a′))
{-3} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-4} plain_memory?(pm_phy)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} reg_base(min_linear)(type_of(a′)) ≤ a′
{-10} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-11} pm′`states(s′)
{1} null?(bl′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1:

{-1} is_linear_plain_memory?(pm′)

{-2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-3} Mem?(type_of(a′))
{-4} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-5} plain_memory?(pm_phy)

{-6} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} reg_base(min_linear)(type_of(a′)) ≤ a′
{-10} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-11} pm′`states(s′)
{1} null?(bl′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma apply_side_effects_unchanged,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.1:

{-1} is_linear_plain_memory?(pm′)

{-2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-3} Mem?(type_of(a′))
{-4} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-5} plain_memory?(pm_phy)

{-6} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} reg_base(min_linear)(type_of(a′)) ≤ a′
{-10} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-11} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects(split (min_page, a′, bl′), lin-

ear_write_side_effect_in_page))),

extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{3} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_write_side_effect_in_page (e))),

extend[Address, Mem-

ory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))))

(split(min_page, a′, bl′))

{4} null?(bl′)

Hiding formulas: (-7 1 2), Using lemma split_linear_write_side_effects_unchanged_memory, we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.1.1:

{-1} is_linear_plain_memory?(pm′) ∧ (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr) ⊃

every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page (e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

{-2} is_linear_plain_memory?(pm′)

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-6} plain_memory?(pm_phy)

{-7} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} reg_base(min_linear)(type_of(a′)) ≤ a′
{-10} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-11} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_write_side_effect_in_page (e))),

extend[Address, Mem-

ory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))))

(split(min_page, a′, bl′))

{2} null?(bl′)

Simplifying, rewriting, and recording with decision procedures, Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 2), Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.1.1.

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′)

{-2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-3} Mem?(type_of(a′))
{-4} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-5} plain_memory?(pm_phy)

{-6} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-10} pm′`states(s′)
{1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_write_side_effect_in_page (e))),

extend[Address, Mem-

ory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))))

(split(min_page, a′, bl′))

{3} null?(bl′)

Keeping (-8 -9 1 3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.1.2.

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects(split (min_page, a′, bl′), lin-

ear_write_side_effect_in_page))),

extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

{-2} is_linear_plain_memory?(pm′)

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-6} plain_memory?(pm_phy)

{-7} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-8} pm′`states = pm_phy`states
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-10} reg_base(min_linear)(type_of(a′)) ≤ a′
{-11} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-12} pm′`states(s′)
{1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ extend [Address, Memory_Address_4G , bool, false](restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{3} null?(bl′)

Keeping (-5 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (x!1), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.2.

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.3:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects(split (min_page, a′, bl′), lin-

ear_write_side_effect_in_page))),

extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

{-2} is_linear_plain_memory?(pm′)

{-3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-4} Mem?(type_of(a′))
{-5} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-6} plain_memory?(pm_phy)

{-7} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-8} pm′`states = pm_phy`states
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-10} reg_base(min_linear)(type_of(a′)) ≤ a′
{-11} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-12} pm′`states(s′)
{1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : apply_side_effects (split(min_page, a′, bl′), linear_write_side_effect_in_page )(s))) ⊆ singleton(expr_2_super (apply_side_effects (split(min_page, a′, bl′), linear_write_side_effect_in_page ))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{3} null?(bl′)

Keeping (1) and hiding *,

Expanding the definition of expr_2_super,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.1.3.

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} Mem?(type_of(a′))
{-3} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-4} plain_memory?(pm_phy)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-10} pm′`states(s′)
{1} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{2} null?(bl′)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Keeping (-7 1) and hiding *,

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets pm!1‘rw_addr, c gets union(pm!1‘ro_addr, pm!1‘rw_addr),

Rewriting using union_subset3, matching in *,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.1.2.

linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.2:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)
{-10} pm′`states(s′)
{1} 0 ≤ a′`offset ∧ a′`offset < max_linear_offset
{2} null?(bl′)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): apply_side_effects(split

(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Keeping (-8 -9 1 2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.2.1.2.

linear_plain_unchanged_memory_invariant.2.1.4.1.2.2:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ (#type_of := type_of(a′), offset := max_linear_offset#)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): Fatal)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Keeping (3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.2.2.

linear_plain_unchanged_memory_invariant.2.1.4.1.2.3:

{-1} Mem?(type_of(a′))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)
{1} null?(bl′)
{2} reg_base(min_linear)(type_of(a′)) ≤ a′

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): Fatal)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Keeping (-7 1 2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.1.2.3.

linear_plain_unchanged_memory_invariant.2.1.4.2:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} plain_memory?(pm_phy)

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} pm′`states(s′)
{1} Mem?(type_of(a′))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory [Physical_memory, pm_phy]):

if null?(bl′) ∨

(reg_base (min_linear)(type_of(a′)) ≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma unchanged_memory_invariant_mono, Case splitting on subset?(singleton(expr_2_super(LAMBDA (s: Linear_memory [Physical_memory,

pm_phy]): memory_write_side_effect(pm_phy‘mem) (a!1, bl!1, cp!1)(s))), union(union(pm_phy‘other_actions, memory_read_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr))), union(memory_read_side_effect_super_transformers(pm_phy‘mem, union (pm_phy‘ro_addr, pm_phy‘rw_addr)), memory_write_side_effect_super_transformers(pm_phy‘mem,

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

pm_phy‘rw_addr)))),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.2.1:

{-1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{-2} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr)))) ∧ (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∧ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{-3} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-4} plain_memory?(pm_phy)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)
{1} Mem?(type_of(a′))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

1466

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.2.1.1:

{-1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{-5} plain_memory?(pm_phy)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)
{1} Mem?(type_of(a′))
{2} null?(bl′)

{3} a′ + length(bl′) ≤

reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)) {4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): Fatal)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Keeping (4) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.2.1.1.

linear_plain_unchanged_memory_invariant.2.1.4.2.1.2:

{-1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{-5} plain_memory?(pm_phy)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)
{1} Mem?(type_of(a′))
{2} null?(bl′)
{3} reg_base(min_linear)(type_of(a′)) ≤ a′

{4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): Fatal)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Keeping (-8 1 3) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.2.1.2.

linear_plain_unchanged_memory_invariant.2.1.4.2.2:

{-1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr)))) ∧ (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∧ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)
{1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{2} Mem?(type_of(a′))

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): if null?(bl′) ∨ (reg_base

(min_linear)(type_of(a′))

≤ a′ ∧ a′ + length(bl′) ≤ reg_size (max_linear)(type_of(a′)))

then if Mem?(type_of(a′))

then ap-

ply_side_effects

(split(min_page, a′, bl′),

lin-

ear_write_side_effect_in_page)

(s)

else mem-

ory_write_side_effect (pm_phy`mem) (a′, bl′, cp′)(s)

endif else Fatal endif)),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

1469

Hiding formulas: (-1 -4 3), Case splitting on memory_write_side_effect_super_transformers(pm_phy‘mem, pm_phy‘rw_addr)

(expr_2_super (LAMBDA (s: Linear_memory [Physical_memory, pm_phy]): memory_write_side_effect (pm_phy‘mem) (a!1, bl!1, cp!1)(s))),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.1.4.2.2.1:

{-1} memory_write_side_effect_super_transformers(pm_phy`mem, pm_phy`rw_addr)

(expr_2_super(λ (s:

Lin-

ear_memory

[Physical_memory, pm_phy]): mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)))
{-2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} plain_memory?(pm_phy)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} pm′`states(s′)
{1} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{2} Mem?(type_of(a′))

Keeping (-1 -6 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.2.2.1.
linear_plain_unchanged_memory_invariant.2.1.4.2.2.2:

{-1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} plain_memory?(pm_phy)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states = pm_phy`states
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-6} pm′`states(s′)

{1} memory_write_side_effect_super_transformers(pm_phy`mem, pm_phy`rw_addr)

(expr_2_super(λ (s:

Lin-

ear_memory

[Physical_memory, pm_phy]): mem-

ory_write_side_effect(pm_phy`mem)

(a′, bl′, cp′)(s)))
{2} (singleton(expr_2_super (λ (s : Linear_memory[Physical_memory, pm_phy]) : memory_write_side_effect (pm_phy‘mem)(a′, bl′, cp′)(s))) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))
{3} Mem?(type_of(a′))

Hiding formulas: 2, Expanding the definition of memory_write_side_effect_super_transformers, Instantiating quantified variables, Expanding the definition of expr_2_super, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of member, Expanding the definition of address_block, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.1.4.2.2.2.
linear_plain_unchanged_memory_invariant.2.2:

{-1} plain_memory?(pm_phy) ⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′) ⊃ pm′`states = pm_phy`states
{-3} is_linear_plain_memory?(pm′) ⊃ plain_memory?(pm_phy)

{-4} (pm′`other_actions(q′) ∨

memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′)) ∨ memory_read_side_effect_super_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr))(q′) ∨ memory_write_side_effect_super_transformers(pm′`mem, pm′`rw_addr)(q′)

{-5} pm′`states(s′)
{-6} is_linear_plain_memory?(pm′)
{1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q′),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: (-1 -2 -3 -4 2), Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Case splitting on union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)) = restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr)),

we get 2 subgoals:

linear_plain_unchanged_memory_invariant.2.2.1:

{-1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))

{-2} (virt_to_phys_range (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))) ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))
{1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Replacing using formula -1, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.2.1.
linear_plain_unchanged_memory_invariant.2.2.2:

{-1} (virt_to_phys_range (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))

{2} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant.2.2.2.

Q.E.D.

C.116.3 Linear_Memory_Blessing_Properties.linear_plain_unchanged_memory_invariant_write

Terse proof for linear_plain_unchanged_memory_invariant_write.
linear_plain_unchanged_memory_invariant_write:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ unchanged_memory_invariant?(pm`mem, pm`states, mem-

ory_write_transformers(pm`mem, pm`rw_addr),

pm`ro_addr)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: has_next_state singleton subset_reflexive pm_write_linear lin-

ear_write Mem in_memory Mem reg_size union_left max_linear < min_linear Address_Helpers.<= reg_base

Using lemma linear_unchanged_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

linear_plain_unchanged_memory_invariant_write.1:

{-1} is_linear_plain_memory?(pm′)

{-2} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr)))

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), pm′`ro_addr)

Case splitting on extend[Address, Memory_Address_4G, bool, FALSE] (restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr)) = pm!1‘ro_addr,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant_write.1.1:

{-1} extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr)) = pm′`ro_addr

{-2} is_linear_plain_memory?(pm′)

{-3} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr)))

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), pm′`ro_addr)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.1.1.
linear_plain_unchanged_memory_invariant_write.1.2:

{-1} is_linear_plain_memory?(pm′)

{-2} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr)))

{1} extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr)) = pm′`ro_addr

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), pm′`ro_addr)

Hiding formulas: (-2 2), Expanding the definition of extend, Expanding the definition of restrict, Applying decompose-equality, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.1.2.
linear_plain_unchanged_memory_invariant_write.2:

{-1} is_linear_plain_memory?(pm′)
{1} ∀ (s: (pm′`states)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm′`mem, pm′`rw_addr), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), pm′`ro_addr)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using unchanged_memory_invariant_all_transformers, matching in * where pm gets

pm_phy‘mem, Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of linear_write, Hiding formulas: (-3), Using lemma pm_memory_addr, Installing automatic rewrites from: union_right Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_plain_phy, Rewriting using plain_memory_unchanged_composition[Physical_memory, Address, Unit], match-

ing in * where pm gets pm_phy, addresses gets extend[Address, Memory_Address_4G, bool, FALSE] (virt_to_phys_range(s!1, restrict[Address, Memory_Address_4G, boolean] (pm!1‘ro_addr), union(singleton(Read), singleton(Execute)))), P gets LAMBDA (a: Address): FORALL (s: (pm_phy‘states)): OK?(linear_resolve(a!1, Write)(s)) IMPLIES data(linear_resolve(a!1, Write)(s)) = a,

we get 4 subgoals:

linear_plain_unchanged_memory_invariant_write.2.1:

{-1} plain_memory?(pm_phy)
{-2} is_linear_plain_memory?(pm′)
{-3} Mem?(type_of(a′))
{-4} 0 ≤ a′`offset
{-5} a′`type_of = a′`type_of
{-6} a′`offset < max_linear_offset
{-7} b′ < max_byte
{-8} pm′`rw_addr(a′)
{-9} pm′`states(s′)
{1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)

(pa, b′)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Installing automatic rewrites from: subset? member extend restrict Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -1 with the terms: (x!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.1.
linear_plain_unchanged_memory_invariant_write.2.2:

{-1} plain_memory?(pm_phy)
{-2} is_linear_plain_memory?(pm′)
{-3} Mem?(type_of(a′))
{-4} 0 ≤ a′`offset
{-5} a′`type_of = a′`type_of
{-6} a′`offset < max_linear_offset
{-7} b′ < max_byte
{-8} pm′`rw_addr(a′)
{-9} pm′`states(s′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(linear_resolve(a′, Write)(s_1)) ⊃ (∀ (s: (pm_phy`states)):

OK?(linear_resolve(a′, Write)(s)) ⊃ data(linear_resolve(a′, Write)(s)) = data(linear_resolve(a′, Write)(s_1)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)

(pa, b′)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma linear_resolve_same_result, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.2.

linear_plain_unchanged_memory_invariant_write.2.3:

{-1} plain_memory?(pm_phy)
{-2} is_linear_plain_memory?(pm′)
{-3} Mem?(type_of(a′))
{-4} 0 ≤ a′`offset
{-5} a′`type_of = a′`type_of
{-6} a′`offset < max_linear_offset
{-7} b′ < max_byte
{-8} pm′`rw_addr(a′)
{-9} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(linear_resolve(a′, Write))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)

(pa, b′)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2, Using lemma linear_resolve_unchanged_pm_phy, Using lemma pm_states, Using lemma unchanged_memory_invariant_mono[Physical_memory], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 2), Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Expanding the definition of member, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_resolve_address, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-6 1) and hiding *, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 2 subgoals:

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_unchanged_memory_invariant_write.2.3.1:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{1} OK?(linear_resolve(lin_a′, ac′)(s′)) ∧

data(linear_resolve(lin_a′, ac′)(s′)) = x′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.3.1.
linear_plain_unchanged_memory_invariant_write.2.3.2:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = x′
{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(lin_a′)

Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.3.2.

linear_plain_unchanged_memory_invariant_write.2.4:

{-1} plain_memory?(pm_phy)
{-2} is_linear_plain_memory?(pm′)
{-3} Mem?(type_of(a′))
{-4} 0 ≤ a′`offset
{-5} a′`type_of = a′`type_of
{-6} a′`offset < max_linear_offset
{-7} b′ < max_byte
{-8} pm′`rw_addr(a′)
{-9} pm′`states(s′)
{1} ∀ (d:
(λ (a: Address):

∀ (s: (pm_phy`states)): OK?(linear_resolve(a′, Write)(s)) ⊃ data(linear_resolve(a′, Write)(s)) = a)): unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm_phy`mem)(d, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(a′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)

(pa, b′)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Installing automatic rewrites from: pm_linear_resolve_write_ok Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_unchanged_memory_invariant_write, Using lemma plain_memory_unchanged_memory_write_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of unchanged_memory_write_invariant?, Instantiating quantified variables, Case splitting on pm_phy‘rw_addr(d!1), we get 2 subgoals:

linear_plain_unchanged_memory_invariant_write.2.4.1:

{-1} pm_phy`rw_addr(d′)
{-2} plain_memory?(pm_phy)

{-3} pm_phy`rw_addr(d′) ⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} data(linear_resolve(a′, Write)(s′)) = d′
{-8} Mem?(type_of(a′))
{-9} 0 ≤ a′`offset
{-10} a′`type_of = a′`type_of
{-11} a′`offset < max_linear_offset
{-12} b′ < max_byte
{-13} pm′`rw_addr(a′)
{-14} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

Simplifying, rewriting, and recording with decision procedures,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_plain_unchanged_memory_invariant_write.2.4.1.1:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), pm_phy`ro_addr)

{-3} pm_phy`rw_addr(d′)
{-4} plain_memory?(pm_phy)

{-5} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} data(linear_resolve(a′, Write)(s′)) = d′
{-9} Mem?(type_of(a′))
{-10} 0 ≤ a′`offset
{-11} a′`type_of = a′`type_of
{-12} a′`offset < max_linear_offset
{-13} b′ < max_byte
{-14} pm′`rw_addr(a′)
{-15} pm′`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: -1, Using lemma unchanged_memory_invariant_union_addresses, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2), Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 2), Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -4 -5 -6), Installing automatic rewrites from: subset? member union remove Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Expanding the definition of extend, Instantiating quantified variables, we get 2 subgoals:

linear_plain_unchanged_memory_invariant_write.2.4.1.1.1:

{-1} virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x′)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x′) {-2} ∀ (a_{1}, a_{2}: Memory_Address_4G):

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a_{1}) ∧ (restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr)(a_{2}) ∨ restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a_{2}))

⊃ ¬ linear_shared?(s′)(a_{1}, a_{2})

{-3} if Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset

then virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))

(x′)

else false endif

{-4} pm_phy`rw_addr(d′)
{-5} plain_memory?(pm_phy)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} data(linear_resolve(a′, Write)(s′)) = d′
{-9} Mem?(type_of(a′))
{-10} 0 ≤ a′`offset
{-11} a′`type_of = a′`type_of
{-12} a′`offset < max_linear_offset
{-13} b′ < max_byte
{-14} pm′`rw_addr(a′)
{-15} pm′`states(s′)
{1} pm_phy`ro_addr(x′)
{2} d′ ≠ x′ ∧ pm_phy`rw_addr(x′)

Expanding the definition of restrict,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

C Proof scripts

linear_plain_unchanged_memory_invariant_write.2.4.1.1.1.1:

{-1} pm_phy`rw_addr(x′)

{-2} ∀ (a_{1}, a_{2}: Memory_Address_4G):

pm′`rw_addr(a_{1}) ∧ (pm′`ro_addr(a_{2}) ∨ pm′`rw_addr(a_{2})) ⊃

¬ linear_shared?(s′)(a_{1}, a_{2})
{-3} Mem?(x′`type_of)
{-4} 0 ≤ x′`offset
{-5} x′`offset < max_linear_offset

{-6} virt_to_phys_range(s′, λ (s: Memory_Address_4G): pm′`ro_addr(s),

(singleton(Read) ∪ singleton(Execute))) (x′)

{-7} pm_phy`rw_addr(d′)
{-8} plain_memory?(pm_phy)
{-9} is_linear_plain_memory?(pm′)
{-10} pm′`states = pm_phy`states
{-11} data(linear_resolve(a′, Write)(s′)) = d′
{-12} Mem?(type_of(a′))
{-13} 0 ≤ a′`offset
{-14} a′`type_of = a′`type_of
{-15} a′`offset < max_linear_offset
{-16} b′ < max_byte
{-17} pm′`rw_addr(a′)
{-18} pm′`states(s′)
{1} pm_phy`ro_addr(x′)
{2} d′ ≠ x′

Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -7 with the terms: (a!1 lin_a!1), Expanding the definition of linear_shared?, Instantiating the top quantifier in 2 with the terms: (Write ac!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.4.1.1.1.1.

linear_plain_unchanged_memory_invariant_write.2.4.1.1.1.2:

{-1} ∀ (a_{1}, a_{2}: Memory_Address_4G):

pm′`rw_addr(a_{1}) ∧ (pm′`ro_addr(a_{2}) ∨ pm′`rw_addr(a_{2})) ⊃

¬ linear_shared?(s′)(a_{1}, a_{2})
{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < max_linear_offset

{-5} virt_to_phys_range(s′, λ (s: Memory_Address_4G): pm′`ro_addr(s),

(singleton(Read) ∪ singleton(Execute))) (x′)

{-6} pm_phy`rw_addr(d′)
{-7} plain_memory?(pm_phy)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states = pm_phy`states
{-10} data(linear_resolve(a′, Write)(s′)) = d′
{-11} Mem?(type_of(a′))
{-12} 0 ≤ a′`offset
{-13} a′`type_of = a′`type_of
{-14} a′`offset < max_linear_offset
{-15} b′ < max_byte
{-16} pm′`rw_addr(a′)
{-17} pm′`states(s′)

{1} virt_to_phys_range(s′, (λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s)), (singleton(Read) ∪ singleton(Execute)))

(x′)

{2} pm_phy`ro_addr(x′)
{3} pm_phy`rw_addr(x′)

Keeping (-5 1) and hiding *,

Expanding the definition of virt_to_phys_range,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.4.1.1.1.2.

linear_plain_unchanged_memory_invariant_write.2.4.1.1.1.3:

{-1} ∀ (a_{1}, a_{2}: Memory_Address_4G):

pm′`rw_addr(a_{1}) ∧ (pm′`ro_addr(a_{2}) ∨ pm′`rw_addr(a_{2})) ⊃

¬ linear_shared?(s′)(a_{1}, a_{2})
{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < max_linear_offset

{-5} virt_to_phys_range(s′, λ (s: Memory_Address_4G): pm′`ro_addr(s),

(singleton(Read) ∪ singleton(Execute))) (x′)

{-6} pm_phy`rw_addr(d′)
{-7} plain_memory?(pm_phy)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states = pm_phy`states
{-10} data(linear_resolve(a′, Write)(s′)) = d′
{-11} Mem?(type_of(a′))
{-12} 0 ≤ a′`offset
{-13} a′`type_of = a′`type_of
{-14} a′`offset < max_linear_offset
{-15} b′ < max_byte
{-16} pm′`rw_addr(a′)
{-17} pm′`states(s′)

{1} virt_to_phys_range(s′, (λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s)), (singleton(Read) ∪ singleton(Execute)))

(x′)

{2} pm_phy`ro_addr(x′)
{3} d′ ≠ x′

Keeping (-5 1) and hiding *,

Expanding the definition of virt_to_phys_range,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.4.1.1.1.3.

linear_plain_unchanged_memory_invariant_write.2.4.1.1.2:

{-1} ∀ (a_{1}, a_{2}: Memory_Address_4G):

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a_{1}) ∧ (restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr)(a_{2}) ∨ restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a_{2}))

⊃ ¬ linear_shared?(s′)(a_{1}, a_{2})

{-2} if Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset

then virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))

(x′)

else false endif

{-3} pm_phy`rw_addr(d′)
{-4} plain_memory?(pm_phy)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} data(linear_resolve(a′, Write)(s′)) = d′
{-8} Mem?(type_of(a′))
{-9} 0 ≤ a′`offset
{-10} a′`type_of = a′`type_of
{-11} a′`offset < max_linear_offset
{-12} b′ < max_byte
{-13} pm′`rw_addr(a′)
{-14} pm′`states(s′)
{1} Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset
{2} pm_phy`ro_addr(x′)
{3} d′ ≠ x′ ∧ pm_phy`rw_addr(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.4.1.1.2.

linear_plain_unchanged_memory_invariant_write.2.4.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-2} pm_phy`rw_addr(d′)
{-3} plain_memory?(pm_phy)

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states = pm_phy`states
{-7} data(linear_resolve(a′, Write)(s′)) = d′
{-8} Mem?(type_of(a′))
{-9} 0 ≤ a′`offset
{-10} a′`type_of = a′`type_of
{-11} a′`offset < max_linear_offset
{-12} b′ < max_byte
{-13} pm′`rw_addr(a′)
{-14} pm′`states(s′)
{1} (singleton(expr_2_super (memory_write(pm_phy‘mem)(d′, b′))) ⊆ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

Keeping (-2 1) and hiding *,

Expanding the definition of subset?,

Repeatedly Skolemizing and flattening,

Expanding the definition of member,

Expanding the definition of singleton,

Replacing using formula -1,

Expanding the definition of memory_write_transformers,

Instantiating quantified variables,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.4.1.2.

linear_plain_unchanged_memory_invariant_write.2.4.2:

{-1} plain_memory?(pm_phy)

{-2} pm_phy`rw_addr(d′) ⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} data(linear_resolve(a′, Write)(s′)) = d′
{-7} Mem?(type_of(a′))
{-8} 0 ≤ a′`offset
{-9} a′`type_of = a′`type_of
{-10} a′`offset < max_linear_offset
{-11} b′ < max_byte
{-12} pm′`rw_addr(a′)
{-13} pm′`states(s′)
{1} pm_phy`rw_addr(d′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

(pm′`ro_addr), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: (-2 -3 2), Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -4 -11 -17 1) and hiding *, Expanding the definition of subset?, Instantiating quantified variables, Instantiating the top quantifier in -2 with the terms: d′, we get 2 subgoals:

linear_plain_unchanged_memory_invariant_write.2.4.2.1:

{-1} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′) ⊃

OK?(linear_resolve(a′, Write)(s′)) {-2} (d′ ∈ virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr), singleton(Write)))

⇒ (d′ ∈ restrict[Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-3} data(linear_resolve(a′, Write)(s′)) = d′
{-4} pm′`rw_addr(a′)
{1} pm_phy`rw_addr(d′)

Expanding the definition of member, Expanding the definition of restrict, Expanding the definition of virt_to_phys_range, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.4.2.1.
linear_plain_unchanged_memory_invariant_write.2.4.2.2:

{-1} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′) ⊃

OK?(linear_resolve(a′, Write)(s′))

{-2} data(linear_resolve(a′, Write)(s′)) = d′
{-3} pm′`rw_addr(a′)
{1} Mem?(d′`type_of) ∧ 0 ≤ d′`offset ∧ d′`offset < max_linear_offset
{2} pm_phy`rw_addr(d′)

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.2.4.2.2.
linear_plain_unchanged_memory_invariant_write.3:

{-1} is_linear_plain_memory?(pm′)
{1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ⊆ restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr), pm′`ro_addr)

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_invariant_write.3.

Q.E.D.

C.116.4 Linear_Memory_Blessing_Properties.linear_plain_unchanged_memory_write_invariant

Terse proof for linear_plain_unchanged_memory_write_invariant.
linear_plain_unchanged_memory_write_invariant:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ unchanged_memory_write_invariant?(pm`mem, pm`states, pm`rw_addr)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: (expr_2_super! expr_2_super_res! ##! has_next_state!

singleton! max_linear! min_linear! Address_Helpers.<=! reg_size! reg_base! Mem! <! pm_phy_read_after_resolve_ok! pm_resolve_address! union_right! in_memory! subset_reflexive!)

Expanding the definition of unchanged_memory_write_invariant?, Repeatedly Skolemizing and flattening, Using lemma linear_unchanged_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

linear_plain_unchanged_memory_write_invariant.1:

{-1} is_linear_plain_memory?(pm′)

{-2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(memory_write(pm′`mem)(waddr′, b′))), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′}))))

{-3} b′ < max_byte
{-4} pm′`rw_addr(waddr′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(memory_write(pm′`mem)(waddr′, b′))), (pm′‘rw_addr\ {waddr′}))

Case splitting on extend[Address, Memory_Address_4G, bool, FALSE] (restrict[Address, Memory_Address_4G, boolean] (remove(waddr!1, pm!1‘rw_addr))) = remove(waddr!1, pm!1‘rw_addr),

we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.1.1:

{-1} extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Memory_Address_4G, boolean]((pm′‘rw_addr\ {waddr′}))) = (pm′‘rw_addr\ {waddr′})

{-2} is_linear_plain_memory?(pm′)

{-3} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(memory_write(pm′`mem)(waddr′, b′))), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′}))))

{-4} b′ < max_byte
{-5} pm′`rw_addr(waddr′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(memory_write(pm′`mem)(waddr′, b′))), (pm′‘rw_addr\ {waddr′}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.1.1.
linear_plain_unchanged_memory_write_invariant.1.2:

{-1} is_linear_plain_memory?(pm′)

{-2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(memory_write(pm′`mem)(waddr′, b′))), extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′}))))

{-3} b′ < max_byte
{-4} pm′`rw_addr(waddr′)

{1} extend[Address, Memory_Address_4G, bool, false]

(restrict[Address, Memory_Address_4G, boolean]((pm′‘rw_addr\ {waddr′}))) = (pm′‘rw_addr\ {waddr′})

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(memory_write(pm′`mem)(waddr′, b′))), (pm′‘rw_addr\ {waddr′}))

Applying decompose-equality, Using lemma pm_memory_addr, Simplifying, rewriting, and recording with decision procedures, Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.1.2.
linear_plain_unchanged_memory_write_invariant.2:

{-1} is_linear_plain_memory?(pm′)
{-2} b′ < max_byte
{-3} pm′`rw_addr(waddr′)
{1} ∀ (s: (pm′`states)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(memory_write(pm′`mem)

(waddr′, b′))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(memory_write(pm′`mem)(waddr′, b′))), (pm′‘rw_addr\ {waddr′}))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using pm_write_linear, matching in *, Using lemma pm_plain_phy, Using lemma pm_states, Expanding the definition of linear_write, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using plain_memory_unchanged_composition[Physical_memory, Address, Unit],

matching in * where pm gets pm_phy, addresses gets extend[Address, Memory_Address_4G, bool, FALSE] (virt_to_phys_range(s!1, restrict[Address, Memory_Address_4G, boolean] (remove(waddr!1, pm!1‘rw_addr)), union(singleton(Read), singleton(Execute)))), P gets LAMBDA (a: Address): FORALL (s: (pm_phy‘states)): OK?(linear_resolve(waddr!1, Write)(s)) IMPLIES data(linear_resolve(waddr!1, Write)(s)) = a,

we get 4 subgoals:

linear_plain_unchanged_memory_write_invariant.2.1:

{-1} is_linear_plain_memory?(pm′)
{-2} Mem?(type_of(waddr′))
{-3} 0 ≤ waddr′`offset
{-4} waddr′`type_of = waddr′`type_of
{-5} waddr′`offset < max_linear_offset
{-6} pm′`states = pm_phy`states
{-7} plain_memory?(pm_phy)
{-8} pm′`states(s′)
{-9} b′ < max_byte
{-10} pm′`rw_addr(waddr′)
{1} (extend [Address, Memory_Address_4G , bool, false](virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(waddr′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)

(pa, b′)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 -8 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Expanding the definition of member, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.1.1:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x′)
{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < max_linear_offset

{-5} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))

(x′)

{-6} is_linear_plain_memory?(pm′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Expanding the definition of restrict, which is trivially true.

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.1.1.
linear_plain_unchanged_memory_write_invariant.2.1.2:

{-1} Mem?(x′`type_of)
{-2} 0 ≤ x′`offset
{-3} x′`offset < max_linear_offset

{-4} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))

(x′)

{-5} is_linear_plain_memory?(pm′)

{1} virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x′)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Keeping (-4 1) and hiding *, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.1.2.1:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} restrict[Address, Memory_Address_4G, boolean]((pm′‘rw_addr\ {waddr′}))(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{1} OK?(linear_resolve(lin_a′, ac′)(s′)) ∧ data(linear_resolve(lin_a′, ac′)(s′)) = x′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.1.2.1.
linear_plain_unchanged_memory_write_invariant.2.1.2.2:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} restrict[Address, Memory_Address_4G, boolean]((pm′‘rw_addr\ {waddr′}))(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{1} union[Memory_Address_4G]

(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr), restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

(lin_a′)

Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.1.2.2.

linear_plain_unchanged_memory_write_invariant.2.2:

{-1} is_linear_plain_memory?(pm′)
{-2} Mem?(type_of(waddr′))
{-3} 0 ≤ waddr′`offset
{-4} waddr′`type_of = waddr′`type_of
{-5} waddr′`offset < max_linear_offset
{-6} pm′`states = pm_phy`states
{-7} plain_memory?(pm_phy)
{-8} pm′`states(s′)
{-9} b′ < max_byte
{-10} pm′`rw_addr(waddr′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(linear_resolve(waddr′, Write)(s_1)) ⊃ (∀ (s: (pm_phy`states)):

OK?(linear_resolve(waddr′, Write)(s)) ⊃ data(linear_resolve(waddr′, Write)(s)) = data(linear_resolve(waddr′, Write)(s_1)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(waddr′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)

(pa, b′)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma linear_resolve_same_result,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.2.

linear_plain_unchanged_memory_write_invariant.2.3:

{-1} is_linear_plain_memory?(pm′)
{-2} Mem?(type_of(waddr′))
{-3} 0 ≤ waddr′`offset
{-4} waddr′`type_of = waddr′`type_of
{-5} waddr′`offset < max_linear_offset
{-6} pm′`states = pm_phy`states
{-7} plain_memory?(pm_phy)
{-8} pm′`states(s′)
{-9} b′ < max_byte
{-10} pm′`rw_addr(waddr′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(linear_resolve(waddr′, Write))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(waddr′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)

(pa, b′)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2, Using lemma linear_resolve_unchanged_pm_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -7, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 2), Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 -6 1) and hiding *, Installing automatic rewrites from: (empty?! member! subset?! extend! difference! disjoint?!

intersection!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.3.1:

{-1} virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x′)

⇒ restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x′) {-2} ∀ (x: Memory_Address_4G):

¬ (virt_to_phys_range(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (x)

∧

address_in_pt_range?(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (x))

{-3} if Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset

then virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))

(x′)

else false endif

{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′) ∧

¬ if Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset

then address_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (x′)

else false endif

Expanding the definition of restrict, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.3.1.1:

{-1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

{-2} ∀ (x: Memory_Address_4G):

¬ (virt_to_phys_range(s′,

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))) (x)

∧

address_in_pt_range?(s′,

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))) (x))

{-3} Mem?(x′`type_of)
{-4} 0 ≤ x′`offset
{-5} x′`offset < max_linear_offset

{-6} virt_to_phys_range(s′, λ (s: Memory_Address_4G): remove(waddr′, pm′`rw_addr)(s),

(singleton(Read) ∪ singleton(Execute))) (x′)

{-7} address_in_pt_range?(s′, λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s)) (x′)

C Proof scripts

Instantiating quantified variables, Applying propositional simplification, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.3.1.1.1:

{-1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)
{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < max_linear_offset

{-5} virt_to_phys_range(s′, λ (s: Memory_Address_4G): remove(waddr′, pm′`rw_addr)(s), (singleton(Read) ∪ singleton(Execute)))

(x′)

{-6} address_in_pt_range?(s′, λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s))

(x′)

{1} virt_to_phys_range(s′,

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))) (x′)

Expanding the definition of virt_to_phys_range, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 3 subgoals:

linear_plain_unchanged_memory_write_invariant.2.3.1.1.1.1:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} remove(waddr′, pm′`rw_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)
{-7} Mem?(x′`type_of)
{-8} 0 ≤ x′`offset
{-9} x′`offset < max_linear_offset
{-10} OK?(linear_resolve(lin_a′, ac′)(s′))
{-11} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{-12} address_in_pt_range?(s′, λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s))

(x′)

{1} OK?(linear_resolve(lin_a′, ac′)(s′)) ∧

data(linear_resolve(lin_a′, ac′)(s′)) = x′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.3.1.1.1.1.

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_unchanged_memory_write_invariant.2.3.1.1.1.2:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} remove(waddr′, pm′`rw_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)
{-7} Mem?(x′`type_of)
{-8} 0 ≤ x′`offset
{-9} x′`offset < max_linear_offset
{-10} OK?(linear_resolve(lin_a′, ac′)(s′))
{-11} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{-12} address_in_pt_range?(s′, λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s))

(x′)

{1} fullset[Memory_access](ac′)

Expanding the definition of fullset, which is trivially true.

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.3.1.1.1.2.
linear_plain_unchanged_memory_write_invariant.2.3.1.1.1.3:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} remove(waddr′, pm′`rw_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)
{-7} Mem?(x′`type_of)
{-8} 0 ≤ x′`offset
{-9} x′`offset < max_linear_offset
{-10} OK?(linear_resolve(lin_a′, ac′)(s′))
{-11} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{-12} address_in_pt_range?(s′, λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s))

(x′)

{1} union[Memory_Address_4G]

(λ (s: Memory_Address_4G): pm′`ro_addr(s), λ (s: Memory_Address_4G): pm′`rw_addr(s))

(lin_a′)

Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.3.1.1.1.3.

linear_plain_unchanged_memory_write_invariant.2.3.1.1.2:

{-1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)
{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < max_linear_offset

{-5} virt_to_phys_range(s′, λ (s: Memory_Address_4G): remove(waddr′, pm′`rw_addr)(s), (singleton(Read) ∪ singleton(Execute)))

(x′)

{-6} address_in_pt_range?(s′, λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s))

(x′)

{1} address_in_pt_range?(s′,

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))) (x′)

Keeping (-6 1) and hiding *,

Case splitting on (LAMBDA (s: Memory_Address_4G): union(pm!1‘ro_addr, pm!1‘rw_addr)(s)) = union(LAMBDA (s: Memory_Address_4G): pm!1‘ro_addr(s), LAMBDA (s: Memory_Address_4G): pm!1‘rw_addr(s)),

we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.3.1.1.2.1:

{-1} (λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s)) =

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s)) {-2} address_in_pt_range?(s′, λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s))

(x′)

{1} address_in_pt_range?(s′,

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))) (x′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.3.1.1.2.1.
linear_plain_unchanged_memory_write_invariant.2.3.1.1.2.2:

{-1} address_in_pt_range?(s′, λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s))

(x′)

{1} (λ (s: Memory_Address_4G): union(pm′`ro_addr, pm′`rw_addr)(s)) =

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s)) {2} address_in_pt_range?(s′,

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))) (x′)

Applying decompose-equality,

Hiding formulas: (-1 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.3.1.1.2.2.

linear_plain_unchanged_memory_write_invariant.2.3.1.2:

{-1} ∀ (x: Memory_Address_4G):

¬ (virt_to_phys_range(s′,

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))) (x)

∧

address_in_pt_range?(s′,

(λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s))) (x))

{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < max_linear_offset

{-5} virt_to_phys_range(s′, λ (s: Memory_Address_4G): remove(waddr′, pm′`rw_addr)(s),

(singleton(Read) ∪ singleton(Execute))) (x′)

{1} virt_to_phys_range(s′, (λ (s : Memory_Address_4G ) : pm′‘ro_addr(s) ∪ λ (s : Memory_Address_4G ) : pm′‘rw_addr(s)), (singleton(Read) ∪ singleton(Execute)))

(x′)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Keeping (-5 1) and hiding *, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.3.1.2.1:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} remove(waddr′, pm′`rw_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{1} OK?(linear_resolve(lin_a′, ac′)(s′)) ∧ data(linear_resolve(lin_a′, ac′)(s′)) = x′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.3.1.2.1.
linear_plain_unchanged_memory_write_invariant.2.3.1.2.2:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} remove(waddr′, pm′`rw_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{1} union[Memory_Address_4G]

(λ (s: Memory_Address_4G): pm′`ro_addr(s), λ (s: Memory_Address_4G): pm′`rw_addr(s))

(lin_a′)

Keeping (-4 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.3.1.2.2.

linear_plain_unchanged_memory_write_invariant.2.3.2:

{-1} ∀ (x: Memory_Address_4G):

¬ (virt_to_phys_range(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (x)

∧

address_in_pt_range?(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (x)) {-2} if Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset

then virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))

(x′)

else false endif

{1} Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′) ∧

¬ if Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset

then address_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (x′)

else false endif

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.3.2.

linear_plain_unchanged_memory_write_invariant.2.4:

{-1} is_linear_plain_memory?(pm′)
{-2} Mem?(type_of(waddr′))
{-3} 0 ≤ waddr′`offset
{-4} waddr′`type_of = waddr′`type_of
{-5} waddr′`offset < max_linear_offset
{-6} pm′`states = pm_phy`states
{-7} plain_memory?(pm_phy)
{-8} pm′`states(s′)
{-9} b′ < max_byte
{-10} pm′`rw_addr(waddr′)
{1} ∀ (d:
(λ (a: Address):

∀ (s: (pm_phy`states)): OK?(linear_resolve(waddr′, Write)(s)) ⊃ data(linear_resolve(waddr′, Write)(s)) = a)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(linear_resolve(waddr′, Write) ##

(λ (pa: Address): mem-

ory_write(pm_phy`mem)

(pa, b′)))),

extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: s′, Using lemma pm_linear_resolve_write_ok, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_unchanged_memory_invariant_write, Using lemma plain_memory_unchanged_memory_write_invariant, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of unchanged_memory_write_invariant?, Instantiating quantified variables, Using lemma unchanged_memory_invariant_union_addresses, Case splitting on pm_phy‘rw_addr(d!1), we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.4.1:

{-1} pm_phy`rw_addr(d′)

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

∧

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), pm_phy`ro_addr)

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), ((pm_phy‘rw_addr\ {d′}) ∪ pm_phy‘ro_addr))

{-3} pm_phy`rw_addr(d′) ⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-5} OK?(linear_resolve(waddr′, Write)(s′))
{-6} data(linear_resolve(waddr′, Write)(s′)) = d′
{-7} is_linear_plain_memory?(pm′)
{-8} Mem?(type_of(waddr′))
{-9} 0 ≤ waddr′`offset
{-10} waddr′`type_of = waddr′`type_of
{-11} waddr′`offset < max_linear_offset
{-12} pm′`states = pm_phy`states
{-13} plain_memory?(pm_phy)
{-14} pm′`states(s′)
{-15} b′ < max_byte
{-16} pm′`rw_addr(waddr′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.4.1.1:

{-1} pm_phy`rw_addr(d′)

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), ((pm_phy‘rw_addr\ {d′}) ∪ pm_phy‘ro_addr))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-5} OK?(linear_resolve(waddr′, Write)(s′))
{-6} data(linear_resolve(waddr′, Write)(s′)) = d′
{-7} is_linear_plain_memory?(pm′)
{-8} Mem?(type_of(waddr′))
{-9} 0 ≤ waddr′`offset
{-10} waddr′`type_of = waddr′`type_of
{-11} waddr′`offset < max_linear_offset
{-12} pm′`states = pm_phy`states
{-13} plain_memory?(pm_phy)
{-14} pm′`states(s′)
{-15} b′ < max_byte
{-16} pm′`rw_addr(waddr′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: (-1 -3), Using lemma unchanged_memory_invariant_mono, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 2), Hiding formulas: (-1 -5 -6 -7 -12), Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 -7 -8 -9 -10 -15 1) and hiding *, Installing automatic rewrites from: subset? member Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.4.1.1.1:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x′)
{-2} ∀ (a_{1}, a_{2}: Memory_Address_4G):

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a_{1}) ∧ union(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)) (a_{2})

⊃ ¬ linear_shared?(s′)(a_{1}, a_{2})
{-3} Mem?(x′`type_of)
{-4} 0 ≤ x′`offset
{-5} x′`offset < max_linear_offset

{-6} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))

(x′)

{-7} OK?(linear_resolve(waddr′, Write)(s′))
{-8} data(linear_resolve(waddr′, Write)(s′)) = d′
{-9} is_linear_plain_memory?(pm′)
{1} union((pm_phy‘rw_addr\ {d′}), pm_phy`ro_addr)(x′)

Expanding the definition of restrict, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -7 with the terms: (waddr!1 lin_a!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.4.1.1.1.1:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} remove(waddr′, pm′`rw_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)
{-7} Mem?(x′`type_of)
{-8} 0 ≤ x′`offset
{-9} x′`offset < max_linear_offset
{-10} OK?(linear_resolve(lin_a′, ac′)(s′))
{-11} data(linear_resolve(lin_a′, ac′)(s′)) = x′
{-12} OK?(linear_resolve(waddr′, Write)(s′))
{-13} data(linear_resolve(waddr′, Write)(s′)) = d′
{-14} is_linear_plain_memory?(pm′)
{1} linear_shared?(s′)(waddr′, lin_a′)
{2} union((pm_phy‘rw_addr\ {d′}), pm_phy`ro_addr)(x′)

Expanding the definition of linear_shared?, Instantiating the top quantifier in 1 with the terms: (Write ac!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -12, Replacing using formula -13, Keeping (-6 1 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.4.1.1.1.1.
linear_plain_unchanged_memory_write_invariant.2.4.1.1.1.2:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} remove(waddr′, pm′`rw_addr)(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)
{-7} Mem?(x′`type_of)
{-8} 0 ≤ x′`offset
{-9} x′`offset < max_linear_offset
{-10} OK?(linear_resolve(lin_a′, ac′)(s′))
{-11} data(linear_resolve(lin_a′, ac′)(s′)) = x′
{-12} OK?(linear_resolve(waddr′, Write)(s′))
{-13} data(linear_resolve(waddr′, Write)(s′)) = d′
{-14} is_linear_plain_memory?(pm′)

{1} union(λ (s: Memory_Address_4G): pm′`ro_addr(s),

λ (s: Memory_Address_4G): pm′`rw_addr(s)) (lin_a′)

{2} union((pm_phy‘rw_addr\ {d′}), pm_phy`ro_addr)(x′)

Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.4.1.1.1.2.
linear_plain_unchanged_memory_write_invariant.2.4.1.1.2:

{-1} ∀ (a_{1}, a_{2}: Memory_Address_4G):

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a_{1}) ∧ union(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)) (a_{2})

⊃ ¬ linear_shared?(s′)(a_{1}, a_{2})
{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < max_linear_offset

{-5} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))

(x′)

{-6} OK?(linear_resolve(waddr′, Write)(s′))
{-7} data(linear_resolve(waddr′, Write)(s′)) = d′
{-8} is_linear_plain_memory?(pm′)

{1} virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x′)

{2} union((pm_phy‘rw_addr\ {d′}), pm_phy`ro_addr)(x′)

Keeping (-5 1) and hiding *, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables,

C Proof scripts

we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.4.1.1.2.1:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} restrict[Address, Memory_Address_4G, boolean]((pm′‘rw_addr\ {waddr′}))(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{1} OK?(linear_resolve(lin_a′, ac′)(s′)) ∧

data(linear_resolve(lin_a′, ac′)(s′)) = x′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.4.1.1.2.1.
linear_plain_unchanged_memory_write_invariant.2.4.1.1.2.2:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} restrict[Address, Memory_Address_4G, boolean]((pm′‘rw_addr\ {waddr′}))(lin_a′)
{-5} union(singleton(Read), singleton(Execute))(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = x′

{1} union[Memory_Address_4G]

(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr), restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

(lin_a′)

Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.4.1.1.2.2.

linear_plain_unchanged_memory_write_invariant.2.4.1.2:

{-1} pm_phy`rw_addr(d′)

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-4} OK?(linear_resolve(waddr′, Write)(s′))
{-5} data(linear_resolve(waddr′, Write)(s′)) = d′
{-6} is_linear_plain_memory?(pm′)
{-7} Mem?(type_of(waddr′))
{-8} 0 ≤ waddr′`offset
{-9} waddr′`type_of = waddr′`type_of
{-10} waddr′`offset < max_linear_offset
{-11} pm′`states = pm_phy`states
{-12} plain_memory?(pm_phy)
{-13} pm′`states(s′)
{-14} b′ < max_byte
{-15} pm′`rw_addr(waddr′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), pm_phy`ro_addr)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: (-2 2),

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: (-1 2),

Expanding the definition of subset?,

Repeatedly Skolemizing and flattening,

Expanding the definition of member,

Expanding the definition of memory_write_transformers,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.4.1.2.

linear_plain_unchanged_memory_write_invariant.2.4.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

∧

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), pm_phy`ro_addr)

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), ((pm_phy‘rw_addr\ {d′}) ∪ pm_phy‘ro_addr))

{-2} pm_phy`rw_addr(d′) ⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), (pm_phy‘rw_addr\ {d′}))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-4} OK?(linear_resolve(waddr′, Write)(s′))
{-5} data(linear_resolve(waddr′, Write)(s′)) = d′
{-6} is_linear_plain_memory?(pm′)
{-7} Mem?(type_of(waddr′))
{-8} 0 ≤ waddr′`offset
{-9} waddr′`type_of = waddr′`type_of
{-10} waddr′`offset < max_linear_offset
{-11} pm′`states = pm_phy`states
{-12} plain_memory?(pm_phy)
{-13} pm′`states(s′)
{-14} b′ < max_byte
{-15} pm′`rw_addr(waddr′)
{1} pm_phy`rw_addr(d′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(memory_write(pm_phy`mem)(d′, b′))), extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s′,

restrict

[Address, Mem-

ory_Address_4G, boolean]

((pm′‘rw_addr\ {waddr′})), (singleton(Read) ∪ singleton(Execute)))))

Hiding formulas: (-1 -2 -3 2), Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-4 -8 -9 -18 1) and hiding *, Expanding the definition of subset?, Expanding the definition of member, Instantiating quantified variables, we get 2 subgoals:

linear_plain_unchanged_memory_write_invariant.2.4.2.1:

{-1} virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (d′)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(d′)

{-2} OK?(linear_resolve(waddr′, Write)(s′))
{-3} data(linear_resolve(waddr′, Write)(s′)) = d′
{-4} b′ < max_byte
{1} pm_phy`rw_addr(d′)

Expanding the definition of restrict, Expanding the definition of virt_to_phys_range, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.4.2.1.
linear_plain_unchanged_memory_write_invariant.2.4.2.2:

{-1} OK?(linear_resolve(waddr′, Write)(s′))
{-2} data(linear_resolve(waddr′, Write)(s′)) = d′
{-3} b′ < max_byte
{1} Mem?(d′`type_of) ∧ 0 ≤ d′`offset ∧ d′`offset < max_linear_offset
{2} pm_phy`rw_addr(d′)

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.2.4.2.2.
linear_plain_unchanged_memory_write_invariant.3:

{-1} is_linear_plain_memory?(pm′)
{-2} b′ < max_byte
{-3} pm′`rw_addr(waddr′)
{1} (restrict[Address, Memory_Address_4G , boolean]((pm′‘rw_addr\ {waddr′})) ⊆ restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(memory_write(pm′`mem)(waddr′, b′))), (pm′‘rw_addr\ {waddr′}))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_unchanged_memory_write_invariant.3.

Q.E.D.

C.116.5 Linear_Memory_Blessing_Properties.linear_plain_transformer_invariant

Terse proof for linear_plain_transformer_invariant.
linear_plain_transformer_invariant:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ transformer_invariant?(pm`states,

((pm‘other_actions∪ (memory_read_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_transformers (pm‘mem, pm‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))))

Repeatedly Skolemizing and flattening, Using lemma linear_plain_unchanged_memory_invariant, Using lemma unchanged_memory_invariant_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma linear_plain_unchanged_memory_invariant_write, Using lemma unchanged_memory_invariant_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -5 1) and hiding *, Using lemma transformer_invariant_union_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on union(memory_write_transformers(pm!1‘mem, pm!1‘rw_addr), union(union(pm!1‘other_actions,

memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr))), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr)))) = union(union(pm!1‘other_actions, union(memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_transformers(pm!1‘mem, pm!1‘rw_addr))), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr))),

we get 2 subgoals:

linear_plain_transformer_invariant.1:

{-1} (memory_write_transformers (pm′‘mem, pm′‘rw_addr) ∪ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))) = ((pm′‘other_actions∪ (memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))

{-2} transformer_invariant?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr))

{-3} transformer_invariant?(pm′`states,

((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

{-4} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, pm′‘rw_addr) ∪ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))))

{1} transformer_invariant?(pm′`states, ((pm′‘other_actions∪ (memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_transformer_invariant.1.
linear_plain_transformer_invariant.2:

{-1} transformer_invariant?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr))

{-2} transformer_invariant?(pm′`states,

((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

{-3} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, pm′‘rw_addr) ∪ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))))

{1} (memory_write_transformers (pm′‘mem, pm′‘rw_addr) ∪ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))) = ((pm′‘other_actions∪ (memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))

{2} transformer_invariant?(pm′`states, ((pm′‘other_actions∪ (memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_transformer_invariant.2.

Q.E.D.

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

C.116.6 Linear_Memory_Blessing_Properties.linear_plain_changed_memory_invariant

Terse proof for linear_plain_changed_memory_invariant.
linear_plain_changed_memory_invariant:

{1} ∀ (pm: Plain_Memory[Physical_memory]):

is_linear_plain_memory?(pm) ⊃ changed_memory_invariant?(pm`mem, pm`states, pm`rw_addr)

Installing automatic rewrites from: has_next_state fatal_result singleton Expanding the definition of changed_memory_invariant?, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

linear_plain_changed_memory_invariant.1:

{-1} is_linear_plain_memory?(pm′)

{1} ∀ (s: Physical_memory, a: Address, b: Byte): pm′`states(s) ∧ pm′`rw_addr(a) ∧ OK?(memory_write(pm′`mem)(a, b)(s)) ∧ OK?(memory_read(pm′`mem)(a)(state(memory_write(pm′`mem)(a, b)(s))))

⊃

data(memory_read(pm′`mem)(a)(state(memory_write(pm′`mem)(a, b)(s)))) = b

Repeatedly Skolemizing and flattening, Rewriting using pm_read_linear, matching in *, Rewriting using pm_write_linear, matching in *, Expanding the definition of linear_read, Installing automatic rewrites from: (expr_2_super! expr_2_super_res! ##!) Expanding the definition of linear_write, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_changed_memory_invariant.1.1:

{-1} b′ < max_byte
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} pm′`rw_addr(a′)
{-5} in_memory(min_linear, max_linear)(a′)
{-6} Mem?(type_of(a′))
{-7} OK?(linear_resolve(a′, Write)(s′))

{-8} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-9} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-10} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

Using lemma linear_resolve_states,

Using lemma pm_plain_phy,

Using lemma pm_states,

Case splitting on union(pm!1‘ro_addr, pm!1‘rw_addr)(a!1),

we get 2 subgoals:

linear_plain_changed_memory_invariant.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} is_linear_plain_memory?(pm′) ⊃ pm′`states = pm_phy`states
{-3} is_linear_plain_memory?(pm′) ⊃ plain_memory?(pm_phy)

{-4} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Write)(s′)) ⊃ pm_phy`states(state(linear_resolve(a′, Write)(s′)))

{-5} b′ < max_byte
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)
{-8} pm′`rw_addr(a′)
{-9} in_memory(min_linear, max_linear)(a′)
{-10} Mem?(type_of(a′))
{-11} OK?(linear_resolve(a′, Write)(s′))

{-12} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-13} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-14} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

Using lemma super_transformer_invariant_next_ok,

Case splitting on pm_phy‘rw_addr(data(linear_resolve(a!1, Write)(s!1))),

we get 2 subgoals:

linear_plain_changed_memory_invariant.1.1.1.1:

{-1} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

{-2} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr)) ∧ pm_phy`states(state(linear_resolve(a′, Write)(s′))) ∧ memory_write_transformers(pm_phy`mem, pm_phy`rw_addr)

(expr_2_super(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)),

b′)))

∧

has_next_state(expr_2_super(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′)) (state(linear_resolve(a′, Write)(s′))))

⊃

pm_phy`states

(state(expr_2_super(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′)) (state(linear_resolve(a′, Write)(s′)))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-4} is_linear_plain_memory?(pm′) ⊃ pm′`states = pm_phy`states
{-5} is_linear_plain_memory?(pm′) ⊃ plain_memory?(pm_phy)

{-6} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Write)(s′)) ⊃ pm_phy`states(state(linear_resolve(a′, Write)(s′)))

{-7} b′ < max_byte
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states(s′)
{-10} pm′`rw_addr(a′)
{-11} in_memory(min_linear, max_linear)(a′)
{-12} Mem?(type_of(a′))
{-13} OK?(linear_resolve(a′, Write)(s′))

{-14} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-15} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-16} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

1514

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_changed_memory_invariant, Expanding the definition of changed_memory_invariant?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_plain_changed_memory_invariant.1.1.1.1.1:

{-1} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-2} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))

{-3} ∀ (s: Physical_memory, a: Address, b: Byte):

pm_phy`states(s) ∧ pm_phy`rw_addr(a) ∧ OK?(memory_write(pm_phy`mem)(a, b)(s)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(memory_write(pm_phy`mem)(a, b)(s))))

⊃

data(memory_read(pm_phy`mem)(a)(state(memory_write(pm_phy`mem)(a, b)(s)))) = b

{-4} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))
{-5} pm_phy`states(state(linear_resolve(a′, Write)(s′)))

{-6} pm_phy`states

(state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} pm′`states = pm_phy`states
{-9} plain_memory?(pm_phy)
{-10} b′ < max_byte
{-11} is_linear_plain_memory?(pm′)
{-12} pm′`states(s′)
{-13} pm′`rw_addr(a′)
{-14} in_memory(min_linear, max_linear)(a′)
{-15} Mem?(type_of(a′))
{-16} OK?(linear_resolve(a′, Write)(s′))

{-17} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-18} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-19} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Instantiating the top quantifier in -3 with the terms: (state(linear_resolve(a!1, Write)(s!1)) data(linear_resolve(a!1, Write)(s!1)) b!1),

Using lemma linear_resolve_unchanged_pm_phy, Using lemma unchanged_memory_invariant_unchanged, Case splitting on data(linear_resolve(a!1, Read) (state(memory_write(pm_phy‘mem) (data(linear_resolve(a!1,

Write)(s!1)), b!1) (state(linear_resolve (a!1, Write)(s!1)))))) = data(linear_resolve(a!1, Write)(s!1)), we get 2 subgoals:

linear_plain_changed_memory_invariant.1.1.1.1.1.1:

{-1} data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= data(linear_resolve(a′, Write)(s′)) {-2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧

pm′`states

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

∧

singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Write)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

∧

OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

∧

OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(expr_2_super(linear_resolve(a′, Read))

(state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)),

b′) (state(linear_resolve(a′, Write)

(s′))))))))

⊃

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

=

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-4} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-5} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))

{-6} pm_phy`states(state(linear_resolve(a′, Write)(s′))) ∧ pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′))) ∧ OK?(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

∧

OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

⊃

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= b′

{-7} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))
{-8} pm_phy`states(state(linear_resolve(a′, Write)(s′)))

{-9} pm_phy`states

(state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

{-10} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-11} pm′`states = pm_phy`states
{-12} plain_memory?(pm_phy)
{-13} b′ < max_byte
{-14} is_linear_plain_memory?(pm′)
{-15} pm′`states(s′)
{-16} pm′`rw_addr(a′)
{-17} in_memory(min_linear, max_linear)(a′)
{-18} Mem?(type_of(a′))
{-19} OK?(linear_resolve(a′, Write)(s′))

{-20} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-21} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-22} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

1518

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

linear_plain_changed_memory_invariant.1.1.1.1.1.1.1:

{-1} data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= data(linear_resolve(a′, Write)(s′)) {-2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-7} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))
{-8} pm_phy`states(state(linear_resolve(a′, Write)(s′)))
{-9} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

{-10} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-11} pm_phy`states

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

{-12} pm′`states = pm_phy`states
{-13} plain_memory?(pm_phy)
{-14} b′ < max_byte
{-15} pm′`rw_addr(a′)
{-16} in_memory(min_linear, max_linear)(a′)
{-17} Mem?(type_of(a′))
{-18} OK?(linear_resolve(a′, Write)(s′))

{-19} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-20} OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{2} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Using lemma plain_memory_transformers_ok_read_ro_rw, Using lemma expr_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using memory_read_transformers_memory_read, matching in *, Keeping (-12 1) and hiding *, Rewriting using union_right, matching in *,

This completes the proof of linear_plain_changed_memory_invariant.1.1.1.1.1.1.1.

linear_plain_changed_memory_invariant.1.1.1.1.1.1.2:

{-1} data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= data(linear_resolve(a′, Write)(s′)) {-2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-7} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))
{-8} pm_phy`states(state(linear_resolve(a′, Write)(s′)))
{-9} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

{-10} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-11} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= b′

{-12} pm_phy`states

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

{-13} pm′`states = pm_phy`states
{-14} plain_memory?(pm_phy)
{-15} b′ < max_byte
{-16} pm′`rw_addr(a′)
{-17} in_memory(min_linear, max_linear)(a′)
{-18} Mem?(type_of(a′))
{-19} OK?(linear_resolve(a′, Write)(s′))

{-20} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-21} OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Write)(s′)))

{2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

1522

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma pm_resolve_address_write, we get 2 subgoals:

linear_plain_changed_memory_invariant.1.1.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (data(linear_resolve(a′, Write)(s′)))

⊃

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Write)(s′)))

{-2} data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= data(linear_resolve(a′, Write)(s′)) {-3} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-4} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′)
{-7} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-8} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))
{-9} pm_phy`states(state(linear_resolve(a′, Write)(s′)))
{-10} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

{-11} OK?(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-12} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= b′

{-13} pm_phy`states

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

{-14} pm′`states = pm_phy`states
{-15} plain_memory?(pm_phy)
{-16} b′ < max_byte
{-17} pm′`rw_addr(a′)
{-18} in_memory(min_linear, max_linear)(a′)
{-19} Mem?(type_of(a′))
{-20} OK?(linear_resolve(a′, Write)(s′))

{-21} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-22} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Write)(s′)))

1524

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of virt_to_phys_range, Instantiating quantified variables, Expanding the definition of singleton, Expanding the definition of restrict, which is trivially true.

This completes the proof of linear_plain_changed_memory_invariant.1.1.1.1.1.1.2.1.

linear_plain_changed_memory_invariant.1.1.1.1.1.1.2.2:

{-1} data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= data(linear_resolve(a′, Write)(s′)) {-2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-7} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))
{-8} pm_phy`states(state(linear_resolve(a′, Write)(s′)))
{-9} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

{-10} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-11} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= b′

{-12} pm_phy`states

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

{-13} pm′`states = pm_phy`states
{-14} plain_memory?(pm_phy)
{-15} b′ < max_byte
{-16} pm′`rw_addr(a′)
{-17} in_memory(min_linear, max_linear)(a′)
{-18} Mem?(type_of(a′))
{-19} OK?(linear_resolve(a′, Write)(s′))

{-20} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-21} OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} Mem?(data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Write)(s′))`type_of)

∧ 0 ≤ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Write)(s′))`offset ∧ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Write)(s′))`offset < max_linear_offset

{2} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Write)(s′)))

1526

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Using lemma linear_resolve_memory_address, Expanding the definition of every, which is trivially true.

This completes the proof of linear_plain_changed_memory_invariant.1.1.1.1.1.1.2.2.

linear_plain_changed_memory_invariant.1.1.1.1.1.1.3:

{-1} data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= data(linear_resolve(a′, Write)(s′)) {-2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-7} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))
{-8} pm_phy`states(state(linear_resolve(a′, Write)(s′)))
{-9} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

{-10} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-11} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= b′

{-12} pm_phy`states

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

{-13} pm′`states = pm_phy`states
{-14} plain_memory?(pm_phy)
{-15} b′ < max_byte
{-16} pm′`rw_addr(a′)
{-17} in_memory(min_linear, max_linear)(a′)
{-18} Mem?(type_of(a′))
{-19} OK?(linear_resolve(a′, Write)(s′))

{-20} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-21} OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} expr_2_super(linear_resolve(a′, Read)) =

expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)) {2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′ 1528

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_changed_memory_invariant.1.1.1.1.1.1.3.

linear_plain_changed_memory_invariant.1.1.1.1.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧

pm′`states

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

∧

singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Write)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

∧

OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

∧

OK?(memory_read(pm_phy`mem) (data(linear_resolve(a′, Write)(s′))) (state(expr_2_super(linear_resolve(a′, Read))

(state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)),

b′) (state(linear_resolve(a′, Write)

(s′))))))))

⊃

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

=

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-2} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-3} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-4} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))

{-5} pm_phy`states(state(linear_resolve(a′, Write)(s′))) ∧ pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′))) ∧ OK?(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

∧

OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

⊃

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′))) (state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= b′

{-6} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))
{-7} pm_phy`states(state(linear_resolve(a′, Write)(s′)))

{-8} pm_phy`states

(state(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))

{-9} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-10} pm′`states = pm_phy`states
{-11} plain_memory?(pm_phy)
{-12} b′ < max_byte
{-13} is_linear_plain_memory?(pm′)
{-14} pm′`states(s′)
{-15} pm′`rw_addr(a′)
{-16} in_memory(min_linear, max_linear)(a′)
{-17} Mem?(type_of(a′))
{-18} OK?(linear_resolve(a′, Write)(s′))

{-19} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-20} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-21} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

= data(linear_resolve(a′, Write)(s′)) {2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

1530

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma linear_resolve_same_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_changed_memory_invariant.1.1.1.1.1.2.

linear_plain_changed_memory_invariant.1.1.1.1.2:

{-1} transformer_invariant?(pm_phy`states, memory_read_transformers(pm_phy`mem, pm_phy`rw_addr))
{-2} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr))

{-3} ∀ (s: Physical_memory, a: Address, b: Byte):

pm_phy`states(s) ∧ pm_phy`rw_addr(a) ∧ OK?(memory_write(pm_phy`mem)(a, b)(s)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(memory_write(pm_phy`mem)(a, b)(s))))

⊃

data(memory_read(pm_phy`mem)(a)(state(memory_write(pm_phy`mem)(a, b)(s)))) = b

{-4} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))
{-5} pm_phy`states(state(linear_resolve(a′, Write)(s′)))
{-6} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-7} pm′`states = pm_phy`states
{-8} plain_memory?(pm_phy)
{-9} b′ < max_byte
{-10} is_linear_plain_memory?(pm′)
{-11} pm′`states(s′)
{-12} pm′`rw_addr(a′)
{-13} in_memory(min_linear, max_linear)(a′)
{-14} Mem?(type_of(a′))
{-15} OK?(linear_resolve(a′, Write)(s′))

{-16} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-17} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-18} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} memory_write_transformers(pm_phy`mem, pm_phy`rw_addr)

(expr_2_super(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)),

b′)))

{2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

Rewriting using memory_write_transformers_memory_write, matching in *,

This completes the proof of linear_plain_changed_memory_invariant.1.1.1.1.2.

linear_plain_changed_memory_invariant.1.1.1.2:

{-1} transformer_invariant?(pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr)) ∧ pm_phy`states(state(linear_resolve(a′, Write)(s′))) ∧ memory_write_transformers(pm_phy`mem, pm_phy`rw_addr)

(expr_2_super(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)),

b′)))

∧

has_next_state(expr_2_super(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′)) (state(linear_resolve(a′, Write)(s′))))

⊃

pm_phy`states

(state(expr_2_super(memory_write(pm_phy`mem)

(data(linear_resolve(a′, Write)(s′)), b′)) (state(linear_resolve(a′, Write)(s′)))))

{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} is_linear_plain_memory?(pm′) ⊃ pm′`states = pm_phy`states
{-4} is_linear_plain_memory?(pm′) ⊃ plain_memory?(pm_phy)

{-5} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Write)(s′)) ⊃ pm_phy`states(state(linear_resolve(a′, Write)(s′)))

{-6} b′ < max_byte
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} pm′`rw_addr(a′)
{-10} in_memory(min_linear, max_linear)(a′)
{-11} Mem?(type_of(a′))
{-12} OK?(linear_resolve(a′, Write)(s′))

{-13} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-14} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-15} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

{2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

1534

Hiding formulas: 2,

Using lemma pm_linear_blessed,

Expanding the definition of linear_blessed?,

Hiding formulas: (-2 -6),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: (-1 -2 -3 -5 -6 -7),

Expanding the definition of subset?,

Expanding the definition of member,

Expanding the definition of restrict,

Instantiating quantified variables,

we get 2 subgoals:

linear_plain_changed_memory_invariant.1.1.1.2.1:

{-1} virt_to_phys_range(s′, λ (s: Memory_Address_4G): pm′`rw_addr(s), singleton(Write))

(data(linear_resolve(a′, Write)(s′)))

⇒ pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states = pm_phy`states
{-5} plain_memory?(pm_phy)
{-6} b′ < max_byte
{-7} pm′`states(s′)
{-8} pm′`rw_addr(a′)
{-9} in_memory(min_linear, max_linear)(a′)
{-10} Mem?(type_of(a′))
{-11} OK?(linear_resolve(a′, Write)(s′))

{-12} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-13} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-14} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

Expanding the definition of virt_to_phys_range,

Instantiating quantified variables,

This completes the proof of linear_plain_changed_memory_invariant.1.1.1.2.1.

linear_plain_changed_memory_invariant.1.1.1.2.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states = pm_phy`states
{-4} plain_memory?(pm_phy)
{-5} b′ < max_byte
{-6} pm′`states(s′)
{-7} pm′`rw_addr(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} OK?(linear_resolve(a′, Write)(s′))

{-11} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-12} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-13} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} Mem?(data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Write)(s′))`type_of)

∧ 0 ≤ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Write)(s′))`offset ∧ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Write)(s′))`offset < max_linear_offset

{2} pm_phy`rw_addr(data(linear_resolve(a′, Write)(s′)))

Using lemma linear_resolve_memory_address,

Expanding the definition of every,

which is trivially true.

This completes the proof of linear_plain_changed_memory_invariant.1.1.1.2.2.

linear_plain_changed_memory_invariant.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ pm′`states = pm_phy`states
{-2} is_linear_plain_memory?(pm′) ⊃ plain_memory?(pm_phy)

{-3} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Write)(s′)) ⊃ pm_phy`states(state(linear_resolve(a′, Write)(s′)))

{-4} b′ < max_byte
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′)
{-7} pm′`rw_addr(a′)
{-8} in_memory(min_linear, max_linear)(a′)
{-9} Mem?(type_of(a′))
{-10} OK?(linear_resolve(a′, Write)(s′))

{-11} OK?(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))

{-12} OK?(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′))))))

{-13} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

{1} union(pm′`ro_addr, pm′`rw_addr)(a′)

{2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′)))))))

(state(linear_resolve(a′, Read)

(state(memory_write(pm_phy`mem) (data(linear_resolve(a′, Write)(s′)), b′) (state(linear_resolve(a′, Write)

(s′))))))))

= b′

Rewriting using union_right, matching in *,

This completes the proof of linear_plain_changed_memory_invariant.1.1.2.

linear_plain_changed_memory_invariant.1.2:

{-1} b′ < max_byte
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} pm′`rw_addr(a′)
{-5} in_memory(min_linear, max_linear)(a′)
{-6} OK?(memory_write(pm_phy`mem)(a′, b′)(s′))
{-7} OK?(memory_read(pm_phy`mem)(a′)(state(memory_write(pm_phy`mem)(a′, b′)(s′))))
{1} Mem?(type_of(a′))

{2} data(memory_read(pm_phy`mem)(a′)(state(memory_write(pm_phy`mem)(a′, b′)(s′))))

= b′

Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using union_right, matching in *,

This completes the proof of linear_plain_changed_memory_invariant.1.2.
linear_plain_changed_memory_invariant.2:

{-1} is_linear_plain_memory?(pm′)
{1} transformer_invariant?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr))

Using lemma linear_plain_transformer_invariant, Simplifying, rewriting, and recording with decision procedures, Rewriting using transformer_invariant_mono_transformers, matching in * where trans-

formers_1 gets memory_write_transformers(pm!1‘mem, pm!1‘rw_addr), transformers_2 gets union(union(pm!1‘other_actions, union(memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_transformers(pm!1‘mem, pm!1‘rw_addr))), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr))),

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_changed_memory_invariant.2.
linear_plain_changed_memory_invariant.3:

{-1} is_linear_plain_memory?(pm′)
{1} transformer_invariant?(pm′`states, memory_read_transformers(pm′`mem, pm′`rw_addr))

Using lemma linear_plain_transformer_invariant, Simplifying, rewriting, and recording with decision procedures, Rewriting using transformer_invariant_mono_transformers, matching in * where trans-

formers_1 gets memory_read_transformers(pm!1‘mem, pm!1‘rw_addr), transformers_2 gets union(union(pm!1‘other_actions, union(memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_transformers(pm!1‘mem, pm!1‘rw_addr))), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr))),

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_changed_memory_invariant.3.

Q.E.D.

C.116.7 Linear_Memory_Blessing_Properties.linear_plain_read_side_effect_unchanged

Terse proof for linear_plain_read_side_effect_unchanged.

linear_plain_read_side_effect_unchanged:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ side_effect_content_unchanged((pm‘ro_addr∪ pm‘rw_addr), pm`states,

memory_read_side_effect(pm`mem))

Expanding the definition of side_effect_content_unchanged,

Repeatedly Skolemizing and flattening,

Hiding formulas: -1,

Rewriting using pm_read_side_effect_linear, matching in *,

Expanding the definition of linear_read_side_effect,

Case splitting on Mem?(type_of(a!1)),

we get 2 subgoals:

linear_plain_read_side_effect_unchanged.1:

{-1} Mem?(type_of(a′))
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-5} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′) else memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′))

else data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Case splitting on null?(bl!1),

we get 2 subgoals:

linear_plain_read_side_effect_unchanged.1.1:

{-1} null?(bl′)
{-2} Mem?(type_of(a′))
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-6} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′) else memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′))

else data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of apply_side_effects,

Expanding the definition of ok_result,

Expanding the definition of reduce,

Using lemma split_null,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.1.1.

linear_plain_read_side_effect_unchanged.1.2:

{-1} Mem?(type_of(a′))
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-5} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′) else memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} null?(bl′)

{2} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′))

else data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma apply_side_effects_same_result,

Case splitting on offset(a!1) < max_linear_offset,

we get 2 subgoals:

linear_plain_read_side_effect_unchanged.1.2.1:

{-1} offset(a′) < max_linear_offset

{-2} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ (∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′)))

∧

(∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s_{1})) ⊃ data(linear_read_side_effect_in_page(e)(s_{1})) = e`2)

(split(min_page, a′, bl′)))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e)))))

(split(min_page, a′, bl′))

⊃

data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(split(min_page, a′, bl′))

{-3} Mem?(type_of(a′))
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} reg_base(min_linear)(type_of(a′)) ≤ a′
{-8} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-9} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{1} null?(bl′)

{2} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_read_side_effect_unchanged.1.2.1.1:

{-1} offset(a′) < max_linear_offset
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)

{-4} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(split(min_page, a′, bl′))

{-5} Mem?(type_of(a′))
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} reg_base(min_linear)(type_of(a′)) ≤ a′
{-8} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-9} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{1} null?(bl′)

{2} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))

= bl′

Replacing using formula -4, Using lemma split_pair_concat, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.1.2.1.1.
linear_plain_read_side_effect_unchanged.1.2.1.2:

{-1} offset(a′) < max_linear_offset
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} Mem?(type_of(a′))
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} reg_base(min_linear)(type_of(a′)) ≤ a′
{-7} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-8} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))

= bl′

Rewriting using split_linear_read_side_effects_states, matching in *, Keeping (-4 -6 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.1.2.1.2.

linear_plain_read_side_effect_unchanged.1.2.1.3:

{-1} offset(a′) < max_linear_offset
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} Mem?(type_of(a′))
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} reg_base(min_linear)(type_of(a′)) ≤ a′
{-7} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-8} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))

{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s_{1})) ⊃ data(linear_read_side_effect_in_page(e)(s_{1})) = e`2)

(split(min_page, a′, bl′))

{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = bl′

Repeatedly Skolemizing and flattening,

Using lemma split_linear_read_side_effects_data,

we get 2 subgoals:

linear_plain_read_side_effect_unchanged.1.2.1.3.1:

{-1} is_linear_plain_memory?(pm′) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ∧ pm′`states(s′_{1}) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′_{1})) ⊃ data(linear_read_side_effect_in_page(e)(s′_{1})) = e`2)

(split(min_page, a′, bl′))

{-2} pm′`states(s′_{1})
{-3} offset(a′) < max_linear_offset
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} Mem?(type_of(a′))
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-10} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′_{1})) ⊃ data(linear_read_side_effect_in_page(e)(s′_{1})) = e`2)

(split(min_page, a′, bl′))

{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.1.2.1.3.1.

linear_plain_read_side_effect_unchanged.1.2.1.3.2:

{-1} pm′`states(s′_{1})
{-2} offset(a′) < max_linear_offset
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} Mem?(type_of(a′))
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} reg_base(min_linear)(type_of(a′)) ≤ a′
{-8} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-9} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{1} 0 ≤ a′`offset

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′_{1})) ⊃ data(linear_read_side_effect_in_page(e)(s′_{1})) = e`2)

(split(min_page, a′, bl′))

{3} null?(bl′)

{4} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = bl′

Keeping (-5 -7 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.1.2.1.3.2.
linear_plain_read_side_effect_unchanged.1.2.1.4:

{-1} offset(a′) < max_linear_offset
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} Mem?(type_of(a′))
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} reg_base(min_linear)(type_of(a′)) ≤ a′
{-7} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-8} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))

{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′))

{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = bl′

Repeatedly Skolemizing and flattening,

Using lemma split_linear_read_side_effects_ok,

we get 2 subgoals:

linear_plain_read_side_effect_unchanged.1.2.1.4.1:

{-1} is_linear_plain_memory?(pm′) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ∧ pm′`states(s′_{1}) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′_{1}))) (split(min_page, a′, bl′))

{-2} pm′`states(s′_{1})
{-3} offset(a′) < max_linear_offset
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} Mem?(type_of(a′))
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} reg_base(min_linear)(type_of(a′)) ≤ a′
{-9} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-10} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′_{1}))) (split(min_page, a′, bl′))

{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.1.2.1.4.1.
linear_plain_read_side_effect_unchanged.1.2.1.4.2:

{-1} pm′`states(s′_{1})
{-2} offset(a′) < max_linear_offset
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} Mem?(type_of(a′))
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} reg_base(min_linear)(type_of(a′)) ≤ a′
{-8} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-9} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{1} 0 ≤ a′`offset

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′_{1}))) (split(min_page, a′, bl′))

{3} null?(bl′)

{4} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = bl′

Keeping (-5 -7 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.1.2.1.4.2.

linear_plain_read_side_effect_unchanged.1.2.2:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ (∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′)))

∧

(∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s_{1})) ⊃ data(linear_read_side_effect_in_page(e)(s_{1})) = e`2)

(split(min_page, a′, bl′)))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e)))))

(split(min_page, a′, bl′))

⊃

data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(split(min_page, a′, bl′))

{-2} Mem?(type_of(a′))
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} reg_base(min_linear)(type_of(a′)) ≤ a′
{-7} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-8} OK?(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′))
{1} offset(a′) < max_linear_offset
{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_read_side_effect_in_page)(s′)) = bl′

Keeping (-2 -5 -6 -7 1 2) and hiding *,

Expanding the definition of length,

Installing automatic rewrites from: Mem max_linear reg_size

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.1.2.2.

linear_plain_read_side_effect_unchanged.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′) else memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} Mem?(type_of(a′))

{2} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′))

else data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Using lemma pm_memory_addr,

Case splitting on null?(bl!1),

we get 2 subgoals:

linear_plain_read_side_effect_unchanged.2.1:

{-1} null?(bl′)

{-2} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃ in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-6} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′) else memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} Mem?(type_of(a′))

{2} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′))

else data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Simplifying, rewriting, and recording with decision procedures,

Using lemma pm_plain_phy,

Using lemma pm_states,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma plain_memory_side_effect_content_unchanged_read_block,

Expanding the definition of side_effect_content_unchanged,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

C Proof scripts

linear_plain_read_side_effect_unchanged.2.1.1:

{-1} ∀ (s: Physical_memory, a: Address, bl: list[Byte], cp: bool): pm_phy`states(s) ∧ (address_block(a, length(bl)) ⊆ address_block(a′, length(bl′))) ∧ OK?(memory_read_side_effect(pm_phy`mem)(a, bl, cp)(s)) ⊃ data(memory_read_side_effect(pm_phy`mem)(a, bl, cp)(s)) = bl

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states = pm_phy`states
{-4} plain_memory?(pm_phy)
{-5} null?(bl′)
{-6} pm′`states(s′)
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} OK?(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′))
{1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{2} Mem?(type_of(a′))
{3} data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) = bl′

Instantiating quantified variables, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.2.1.1.
linear_plain_read_side_effect_unchanged.2.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states = pm_phy`states
{-3} plain_memory?(pm_phy)
{-4} null?(bl′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} OK?(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′))
{1} (address_block(a′, length(bl′)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{3} Mem?(type_of(a′))
{4} data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) = bl′

Hiding formulas: (-1 -2 -3 -7 4), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.2.1.2.

linear_plain_read_side_effect_unchanged.2.2:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃ in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-5} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′) else memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} null?(bl′)
{2} Mem?(type_of(a′))

{3} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_read_side_effect_in_page) (s′))

else data(memory_read_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_read_side_effect_unchanged.2.2.

Q.E.D.

C.116.8 Linear_Memory_Blessing_Properties.linear_plain_write_side_effect_unchanged

Terse proof for linear_plain_write_side_effect_unchanged.
linear_plain_write_side_effect_unchanged:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ side_effect_content_unchanged(pm`rw_addr, pm`states, mem-

ory_write_side_effect(pm`mem))

Expanding the definition of side_effect_content_unchanged, Repeatedly Skolemizing and flattening, Hiding formulas: -1, Rewriting using pm_write_side_effect_linear, matching in *,

Expanding the definition of linear_write_side_effect,

Case splitting on Mem?(type_of(a!1)),

we get 2 subgoals:

linear_plain_write_side_effect_unchanged.1:

{-1} Mem?(type_of(a′))
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-5} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′) else memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′)) else data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Case splitting on null?(bl!1),

we get 2 subgoals:

linear_plain_write_side_effect_unchanged.1.1:

{-1} null?(bl′)
{-2} Mem?(type_of(a′))
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-6} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′) else memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′)) else data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of apply_side_effects,

Expanding the definition of ok_result,

Expanding the definition of reduce,

Using lemma split_null,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_write_side_effect_unchanged.1.1.

linear_plain_write_side_effect_unchanged.1.2:

{-1} Mem?(type_of(a′))
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-5} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′) else memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} null?(bl′)

{2} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′)) else data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Expanding the definition of reg_base,

Expanding the definition of <=,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of min_linear,

Expanding the definition of Mem,

Using lemma apply_side_effects_same_result,

Case splitting on offset(a!1) < max_linear_offset,

we get 2 subgoals:

linear_plain_write_side_effect_unchanged.1.2.1:

{-1} offset(a′) < max_linear_offset

{-2} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ (∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′)))

∧

(∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s_{1})) ⊃ data(linear_write_side_effect_in_page(e)(s_{1})) = e`2)

(split(min_page, a′, bl′)))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page

(e)))))

(split(min_page, a′, bl′))

⊃

data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)

(s′))

=

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(split(min_page, a′, bl′))

{-3} Mem?(type_of(a′))
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} Mem_= a′`type_of
{-8} 0 ≤ a′`offset
{-9} (a′ + length(bl′))`type_of = reg_size(max_linear)(type_of(a′))`type_of
{-10} (a′ + length(bl′))`offset ≤ reg_size(max_linear)(type_of(a′))`offset
{-11} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))
{1} null?(bl′)

{2} data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′)) = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

linear_plain_write_side_effect_unchanged.1.2.1.1:

{-1} offset(a′) < max_linear_offset
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)

{-4} data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′)) = reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(split(min_page, a′, bl′))

{-5} Mem?(type_of(a′))
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} 0 ≤ a′`offset
{-8} (a′ + length(bl′))`type_of = reg_size(max_linear)(type_of(a′))`type_of
{-9} (a′ + length(bl′))`offset ≤ reg_size(max_linear)(type_of(a′))`offset
{-10} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))
{1} null?(bl′)

{2} data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′)) = bl′

Replacing using formula -4,

Using lemma split_pair_concat,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_write_side_effect_unchanged.1.2.1.1.
linear_plain_write_side_effect_unchanged.1.2.1.2:

{-1} offset(a′) < max_linear_offset
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} Mem?(type_of(a′))
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-6} 0 ≤ a′`offset
{-7} (a′ + length(bl′))`type_of = reg_size(max_linear)(type_of(a′))`type_of
{-8} (a′ + length(bl′))`offset ≤ reg_size(max_linear)(type_of(a′))`offset
{-9} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′)) = bl′

Rewriting using split_linear_write_side_effects_states, matching in *,

This completes the proof of linear_plain_write_side_effect_unchanged.1.2.1.2.

linear_plain_write_side_effect_unchanged.1.2.1.3:

{-1} offset(a′) < max_linear_offset
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} Mem?(type_of(a′))
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-6} 0 ≤ a′`offset
{-7} (a′ + length(bl′))`type_of = reg_size(max_linear)(type_of(a′))`type_of
{-8} (a′ + length(bl′))`offset ≤ reg_size(max_linear)(type_of(a′))`offset
{-9} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))

{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s_{1})) ⊃ data(linear_write_side_effect_in_page(e)(s_{1})) = e`2)

(split(min_page, a′, bl′))

{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))

= bl′

Repeatedly Skolemizing and flattening, Using lemma split_linear_write_side_effects_data, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_write_side_effect_unchanged.1.2.1.3.
linear_plain_write_side_effect_unchanged.1.2.1.4:

{-1} offset(a′) < max_linear_offset
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} Mem?(type_of(a′))
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-6} 0 ≤ a′`offset
{-7} (a′ + length(bl′))`type_of = reg_size(max_linear)(type_of(a′))`type_of
{-8} (a′ + length(bl′))`offset ≤ reg_size(max_linear)(type_of(a′))`offset
{-9} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))

{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′))

{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))

= bl′

Repeatedly Skolemizing and flattening, Using lemma split_linear_write_side_effects_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_write_side_effect_unchanged.1.2.1.4.

linear_plain_write_side_effect_unchanged.1.2.2:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ (∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s_{1}))) (split(min_page, a′, bl′)))

∧

(∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s_{1})) ⊃ data(linear_write_side_effect_in_page(e)(s_{1})) = e`2)

(split(min_page, a′, bl′)))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page

(e)))))

(split(min_page, a′, bl′))

⊃

data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)

(s′))

=

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(split(min_page, a′, bl′))

{-2} Mem?(type_of(a′))
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-6} Mem_= a′`type_of
{-7} 0 ≤ a′`offset
{-8} (a′ + length(bl′))`type_of = reg_size(max_linear)(type_of(a′))`type_of
{-9} (a′ + length(bl′))`offset ≤ reg_size(max_linear)(type_of(a′))`offset
{-10} OK?(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′))
{1} offset(a′) < max_linear_offset
{2} null?(bl′)

{3} data(apply_side_effects(split(min_page, a′, bl′), linear_write_side_effect_in_page)(s′)) = bl′

Keeping (-6 -9 1 2) and hiding *,

Expanding the definition of length,

Installing automatic rewrites from: Mem max_linear

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_write_side_effect_unchanged.1.2.2.

linear_plain_write_side_effect_unchanged.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-4} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′) else memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} Mem?(type_of(a′))

{2} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′)) else data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Using lemma pm_memory_addr,

Case splitting on null?(bl!1),

we get 2 subgoals:

linear_plain_write_side_effect_unchanged.2.1:

{-1} null?(bl′)

{-2} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃ in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-6} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′) else memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} Mem?(type_of(a′))

{2} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′)) else data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Simplifying, rewriting, and recording with decision procedures,

Using lemma pm_plain_phy,

Using lemma pm_states,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma plain_memory_side_effect_content_unchanged_write_block,

Expanding the definition of side_effect_content_unchanged,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

C.116 Proofs for Linear_Memory_Blessing_Properties (challenge-linear.pvs)

linear_plain_write_side_effect_unchanged.2.1.1:

{-1} ∀ (s: Physical_memory, a: Address, bl: list[Byte], cp: bool): pm_phy`states(s) ∧ (address_block(a, length(bl)) ⊆ address_block(a′, length(bl′))) ∧ OK?(memory_write_side_effect(pm_phy`mem)(a, bl, cp)(s)) ⊃ data(memory_write_side_effect(pm_phy`mem)(a, bl, cp)(s)) = bl

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states = pm_phy`states
{-4} plain_memory?(pm_phy)
{-5} null?(bl′)
{-6} pm′`states(s′)
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} OK?(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′))
{1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{2} Mem?(type_of(a′))
{3} data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) = bl′

Instantiating quantified variables, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_plain_write_side_effect_unchanged.2.1.1.
linear_plain_write_side_effect_unchanged.2.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states = pm_phy`states
{-3} plain_memory?(pm_phy)
{-4} null?(bl′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′))
{1} (address_block(a′, length(bl′)) ⊆ pm_phy‘rw_addr)
{2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{3} Mem?(type_of(a′))
{4} data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) = bl′

Hiding formulas: (-1 -2 -3 -7 4), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_write_side_effect_unchanged.2.1.2.

linear_plain_write_side_effect_unchanged.2.2:

{-1} is_linear_plain_memory?(pm′) ∧ union(pm′`ro_addr, pm′`rw_addr)(a′) ⊃ in_memory(min_linear, max_linear)(a′) ∧ Mem?(type_of(a′))

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-5} OK?(if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′) else memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′) endif

else Fatal endif)

{1} null?(bl′)
{2} Mem?(type_of(a′))

{3} if null?(bl′) ∨

(reg_base(min_linear)(type_of(a′)) ≤ a′ ∧

a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))) then if Mem?(type_of(a′))

then data(apply_side_effects(split(min_page, a′, bl′),

linear_write_side_effect_in_page) (s′)) else data(memory_write_side_effect(pm_phy`mem)(a′, bl′, cp′)(s′)) endif

else data(Fatal)

endif = bl′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_plain_write_side_effect_unchanged.2.2.

Q.E.D.

C.116.9 Linear_Memory_Blessing_Properties.linear_memory_plain_memory

Terse proof for linear_memory_plain_memory.
linear_memory_plain_memory:

{1} ∀ (pm: Plain_Memory[Physical_memory]): is_linear_plain_memory?(pm) ⊃ plain_memory?(pm)

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: (linear_plain_transformers_ok! linear_plain_unchanged_memory_invariant!

linear_plain_unchanged_memory_invariant_write! linear_plain_unchanged_memory_write_invariant! linear_plain_changed_memory_invariant! linear_plain_read_side_effect_unchanged! linear_plain_write_side_effect_unchanged!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

This completes the proof of linear_memory_plain_memory.

Q.E.D.

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

C.117.1 Linear_Memory_Properties.pm_read_linear

Terse proof for pm_read_linear.
pm_read_linear:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address):

is_linear_plain_memory?(pm) ⊃ memory_read(pm`mem)(a) = linear_read(a)

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Expanding the definition of linear_pm, Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_read_linear. Q.E.D.

C.117.2 Linear_Memory_Properties.pm_write_linear

Terse proof for pm_write_linear.
pm_write_linear:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address, b: Byte): is_linear_plain_memory?(pm) ⊃ memory_write(pm`mem)(a, b) = linear_write(a, b)

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Replacing using formula -2, Expanding the definition of linear_pm, which is trivially true. This completes the proof of pm_write_linear. Q.E.D.

C.117.3 Linear_Memory_Properties.pm_read_side_effect_linear

Terse proof for pm_read_side_effect_linear.
pm_read_side_effect_linear:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address, bl: list[Byte], cp: bool): is_linear_plain_memory?(pm) ⊃ memory_read_side_effect(pm`mem)(a, bl, cp) = linear_read_side_effect(a, bl, cp)

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Replacing using formula -2, Expanding the definition of linear_pm, which is trivially true.

This completes the proof of pm_read_side_effect_linear.

Q.E.D.

C.117.4 Linear_Memory_Properties.pm_write_side_effect_linear

Terse proof for pm_write_side_effect_linear.
pm_write_side_effect_linear:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address, bl: list[Byte], cp: bool):

is_linear_plain_memory?(pm) ⊃

memory_write_side_effect(pm`mem)(a, bl, cp) = linear_write_side_effect(a, bl, cp)

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Expanding the definition of linear_pm, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pm_write_side_effect_linear.

Q.E.D.

C.117.5 Linear_Memory_Properties.pm_states

Terse proof for pm_states.

pm_states:

{1} ∀ (pm: Plain_Memory[Linear_memory]):

is_linear_plain_memory?(pm) ⊃ pm`states = pm_phy`states

Expanding the definition of is_linear_plain_memory?, Repeatedly Skolemizing and flattening, This completes the proof of pm_states. Q.E.D.

C.117.6 Linear_Memory_Properties.pm_plain_phy

Terse proof for pm_plain_phy.

pm_plain_phy:

{1} ∀ (pm: Plain_Memory[Linear_memory]): is_linear_plain_memory?(pm) ⊃ plain_memory?(pm_phy)

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_plain_phy. Q.E.D.

C.117.7 Linear_Memory_Properties.pm_memory_addr_TCC1

Terse proof for pm_memory_addr_TCC1.
pm_memory_addr_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address): is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(a) ⊃ Mem?(min_linear`type_of)

Repeatedly Skolemizing and flattening, Expanding the definition of min_linear, Expanding the definition of Mem, which is trivially true. This completes the proof of pm_memory_addr_TCC1. Q.E.D.

C.117.8 Linear_Memory_Properties.pm_memory_addr_TCC2

Terse proof for pm_memory_addr_TCC2.
pm_memory_addr_TCC2:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address): is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(a) ⊃ Mem?(max_linear`type_of)

Repeatedly Skolemizing and flattening, Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true. This completes the proof of pm_memory_addr_TCC2. Q.E.D.

C.117.9 Linear_Memory_Properties.pm_memory_addr

Terse proof for pm_memory_addr.
pm_memory_addr:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address): is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(a) ⊃ in_memory(min_linear, max_linear)(a) ∧ Mem?(type_of(a))

Expanding the definition of is_linear_plain_memory?, Repeatedly Skolemizing and flattening, Expanding the definition of max_linear, Expanding the definition of Mem, Instantiating quantified variables, Keeping (-13 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_memory_addr. Q.E.D.

C.117.10 Linear_Memory_Properties.pm_linear_blessed

Terse proof for pm_linear_blessed.
pm_linear_blessed:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy]): is_linear_plain_memory?(pm) ∧ pm`states(s) ⊃ linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm`rw_addr))

Expanding the definition of is_linear_plain_memory?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of pm_linear_blessed. Q.E.D.

C.117.11 Linear_Memory_Properties.pm_linear_resolve_read_ok_TCC1

Terse proof for pm_linear_resolve_read_ok_TCC1.
pm_linear_resolve_read_ok_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: (pm`states),

a: ((pm‘ro_addr∪ pm‘rw_addr))): is_linear_plain_memory?(pm) ⊃ Mem?(a`type_of) ∧ 0 ≤ a`offset ∧ a`offset < max_linear_offset

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables,

This completes the proof of pm_linear_resolve_read_ok_TCC1.

Q.E.D.

C.117.12 Linear_Memory_Properties.pm_linear_resolve_read_ok

Terse proof for pm_linear_resolve_read_ok.
pm_linear_resolve_read_ok:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: (pm`states),

a: ((pm‘ro_addr∪ pm‘rw_addr))): is_linear_plain_memory?(pm) ⊃ OK?(linear_resolve(a, Read)(s))

Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of linear_blessed?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-9 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_linear_resolve_read_ok.

Q.E.D.

C.117.13 Linear_Memory_Properties.pm_linear_resolve_write_ok_TCC1

Terse proof for pm_linear_resolve_write_ok_TCC1.
pm_linear_resolve_write_ok_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: (pm`states), a: (pm`rw_addr)): is_linear_plain_memory?(pm) ⊃ Mem?(a`type_of) ∧ 0 ≤ a`offset ∧ a`offset < max_linear_offset

Expanding the definition of is_linear_plain_memory?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_linear_resolve_write_ok_TCC1.

Q.E.D.

C.117.14 Linear_Memory_Properties.pm_linear_resolve_write_ok

Terse proof for pm_linear_resolve_write_ok.
pm_linear_resolve_write_ok:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: (pm`states), a: (pm`rw_addr)): is_linear_plain_memory?(pm) ⊃ OK?(linear_resolve(a, Write)(s))

Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of linear_blessed?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-9 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_linear_resolve_write_ok.

Q.E.D.

C.117.15 Linear_Memory_Properties.pm_linear_resolve_reg_transformers_other

Terse proof for pm_linear_resolve_reg_transformers_other.
pm_linear_resolve_reg_transformers_other:

{1} ∀ (pm: Plain_Memory[Linear_memory]): is_linear_plain_memory?(pm) ⊃ (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

C Proof scripts

Expanding the definition of is_linear_plain_memory?, Repeatedly Skolemizing and flattening,

This completes the proof of pm_linear_resolve_reg_transformers_other.

Q.E.D.

C.117.16 Linear_Memory_Properties.pm_unchanged_singleton_linear_resolve_reg_transformers

Terse proof for pm_unchanged_singleton_linear_resolve_reg_transformers.
pm_unchanged_singleton_linear_resolve_reg_transformers:

{1} ∀ (pm: Plain_Memory[Linear_memory],

q: [Physical_memory → SuperResult[Physical_memory]]): is_linear_plain_memory?(pm) ∧ linear_resolve_register_transformers(q) ⊃ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Repeatedly Skolemizing and flattening, Using lemma pm_states, Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

pm_unchanged_singleton_linear_resolve_reg_transformers.1:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} pm′`mem = linear_pm
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-8} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-10} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-11} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-12} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-13} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-14} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-15} unchanged_memory_write_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)
{-16} changed_memory_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)

{-17} transformers_ok?(pm_phy`states,

((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{-18} side_effect_content_unchanged((pm_phy‘ro_addr∪ pm_phy‘rw_addr), pm_phy`states,

memory_read_side_effect(pm_phy`mem))

{-19} side_effect_content_unchanged(pm_phy`rw_addr, pm_phy`states,

memory_write_side_effect(pm_phy`mem))

{-20} pm′`states = pm_phy`states
{-21} linear_resolve_register_transformers(q′)
{1} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q′), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

1569 C Proof scripts

Rewriting using subset_reflexive, matching in *,

This completes the proof of pm_unchanged_singleton_linear_resolve_reg_transformers.1.

pm_unchanged_singleton_linear_resolve_reg_transformers.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} pm′`mem = linear_pm
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-8} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-10} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-11} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-12} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-13} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-14} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, memory_write_transformers(pm_phy`mem, pm_phy`rw_addr), pm_phy`ro_addr)

{-15} unchanged_memory_write_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)
{-16} changed_memory_invariant?(pm_phy`mem, pm_phy`states, pm_phy`rw_addr)

{-17} transformers_ok?(pm_phy`states,

((memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_transformers (pm_phy‘mem, pm_phy‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{-18} side_effect_content_unchanged((pm_phy‘ro_addr∪ pm_phy‘rw_addr), pm_phy`states,

memory_read_side_effect(pm_phy`mem))

{-19} side_effect_content_unchanged(pm_phy`rw_addr, pm_phy`states,

memory_write_side_effect(pm_phy`mem))

{-20} pm′`states = pm_phy`states
{-21} linear_resolve_register_transformers(q′)
{1} (singleton(q′) ⊆ ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(q′), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

1571

Keeping (-11 -21 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_unchanged_singleton_linear_resolve_reg_transformers.2.

Q.E.D.

C.117.17 Linear_Memory_Properties.pm_address_in_pt_range_in_rw_addr

Terse proof for pm_address_in_pt_range_in_rw_addr.
pm_address_in_pt_range_in_rw_addr:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ⊃ (address_in_pt_range? (s, restrict [Address, Memory_Address_4G , boolean]((pm‘ro_addr∪ pm‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-7 1) and hiding *, Case splitting on union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)) = restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr)),

we get 2 subgoals:

pm_address_in_pt_range_in_rw_addr.1:

{-1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))

{-2} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))
{1} (address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pm_address_in_pt_range_in_rw_addr.1.
pm_address_in_pt_range_in_rw_addr.2:

{-1} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))

{2} (address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_address_in_pt_range_in_rw_addr.2.

Q.E.D.

C.117.18 Linear_Memory_Properties.address_block_in_memory_TCC1

Terse proof for address_block_in_memory_TCC1.

address_block_in_memory_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address, bl: list[Byte]): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl) ⊃ Mem?(max_linear`type_of)

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of address_block_in_memory_TCC1.

Q.E.D.

C.117.19 Linear_Memory_Properties.address_block_in_memory

Terse proof for address_block_in_memory.
address_block_in_memory:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address, bl: list[Byte]): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl) ⊃ a + length(bl) ≤ reg_size(max_linear)(type_of(a))

Repeatedly Skolemizing and flattening, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

address_block_in_memory.1:

{-1} is_linear_plain_memory?(pm′)
{-2} in_memory(min_linear, max_linear)(a′ + (length(bl′) − 1))
{-3} Mem?(type_of(a′ + (length(bl′) − 1)))

{-4} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} cons?(bl′)
{1} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

Expanding the definition of +, Keeping (-2 -3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_in_memory.1.

address_block_in_memory.2:

{-1} is_linear_plain_memory?(pm′)

{-2} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} cons?(bl′)
{1} union(pm′`ro_addr, pm′`rw_addr)(a′ + (length(bl′) − 1))
{2} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

Keeping (-3 -4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_in_memory.2.

Q.E.D.

C.117.20 Linear_Memory_Properties.address_block_in_memory2

Terse proof for address_block_in_memory2.
address_block_in_memory2:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Address, bl: list[Byte]): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ cons?(bl) ⊃ 0 ≤ a`offset

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of subset?, Expanding the definition of member, Instantiating the top quantifier in -2 with the terms: (a!1), Expanding the definition of address_block, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_memory_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_in_memory2.

Q.E.D.

C.117.21 Linear_Memory_Properties.raise_fault_transformer_invariant

Terse proof for raise_fault_transformer_invariant.

raise_fault_transformer_invariant:

{1} ∀ (pm: Plain_Memory[Linear_memory], priv: Memory_privilege, access: Mem-

ory_access,

present: bool, pfa: Memory_Address_4G): is_linear_plain_memory?(pm) ⊃ transformer_invariant?(pm_phy`states,

singleton(expr_2_super(raise_fault(priv, ac-

cess, present, pfa))))

Repeatedly Skolemizing and flattening,

Expanding the definition of raise_fault,

Rewriting using expr_composition_transformer_invariant, matching in *,

we get 3 subgoals:

raise_fault_transformer_invariant.1:

{-1} Mem?(pfa′`type_of)
{-2} 0 ≤ pfa′`offset
{-3} pfa′`offset < max_linear_offset
{-4} is_linear_plain_memory?(pm′)

{1} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′))))

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

##

exception_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))))

Hiding formulas: 2,

Using lemma pm_states,

Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers,

Using lemma unchanged_memory_invariant_invariant,

Expanding the definition of linear_resolve_register_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Instantiating quantified variables,

This completes the proof of raise_fault_transformer_invariant.1.

raise_fault_transformer_invariant.2:

{-1} Mem?(pfa′`type_of)
{-2} 0 ≤ pfa′`offset
{-3} pfa′`offset < max_linear_offset
{-4} is_linear_plain_memory?(pm′)

{1} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(exception_result(Page_fault

((#reserved_bit_violation := false, privi-

lege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))))

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

## exception_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))))

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of raise_fault_transformer_invariant.2.

raise_fault_transformer_invariant.3:

{-1} Mem?(pfa′`type_of)
{-2} 0 ≤ pfa′`offset
{-3} pfa′`offset < max_linear_offset
{-4} is_linear_plain_memory?(pm′)
{1} (Read ∈ (singleton[Memory_access](access′) ∪ {Read}))

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

##

exception_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of raise_fault_transformer_invariant.3.

Q.E.D.

C.117.22 Linear_Memory_Properties.raise_fault_unchanged_memory_invariant

Terse proof for raise_fault_unchanged_memory_invariant.
raise_fault_unchanged_memory_invariant:

{1} ∀ (pm: Plain_Memory[Linear_memory], priv: Memory_privilege, access: Mem- ory_access, present: bool, pfa: Memory_Address_4G): is_linear_plain_memory?(pm) ⊃ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(raise_fault(priv, ac- cess, present, pfa))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Repeatedly Skolemizing and flattening, Expanding the definition of raise_fault, Using lemma plain_memory_unchanged_composition[Physical_memory, Unit, [bool, Address]], we get 2 subgoals:

raise_fault_unchanged_memory_invariant.1:

{-1} (plain_memory?(pm_phy) ∧ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∧ (∀ (s: (pm_phy`states)): true) ∧ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

∧

(∀ (d: (λ (u: Unit): true)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(exception_result

[Physical_memory, [bool, Ad-

dress]]

(Page_fault

((#reserved_bit_violation := false, privi-

lege := priv′, access := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))))

⊃ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

##

(λ (u: Unit): exception_result [Physical_memory, [bool, Ad-

dress]]

(Page_fault

((#reserved_bit_violation := false,

privi-

lege := priv′, access := (singleton [Memory_access](access′) ∪ {Read}), present := present′#)))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} Mem?(pfa′`type_of)
{-3} 0 ≤ pfa′`offset
{-4} pfa′`offset < max_linear_offset
{-5} is_linear_plain_memory?(pm′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

## excep-

tion_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

1578

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 5 subgoals:

raise_fault_unchanged_memory_invariant.1.1:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

##

(λ (u: Unit):

exception_result

[Physical_memory, [bool, Ad-

dress]]

(Page_fault

((#reserved_bit_violation := false, privi-

lege := priv′, access := (singleton [Memory_access](access′) ∪ {Read}), present := present′#)))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} Mem?(pfa′`type_of)
{-3} 0 ≤ pfa′`offset
{-4} pfa′`offset < max_linear_offset
{-5} is_linear_plain_memory?(pm′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

## excep-

tion_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of ##,

Expanding the definition of ##,

which is trivially true.

This completes the proof of raise_fault_unchanged_memory_invariant.1.1.

raise_fault_unchanged_memory_invariant.1.2:

{-1} Mem?(pfa′`type_of)
{-2} 0 ≤ pfa′`offset
{-3} pfa′`offset < max_linear_offset
{-4} is_linear_plain_memory?(pm′)
{1} ∀ (d: (λ (u: Unit): true)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(exception_result

[Physical_memory, [bool, Ad-

dress]]

(Page_fault

((#reserved_bit_violation := false,

privi-

lege := priv′, access := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

## excep-

tion_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of raise_fault_unchanged_memory_invariant.1.2.

raise_fault_unchanged_memory_invariant.1.3:

{-1} Mem?(pfa′`type_of)
{-2} 0 ≤ pfa′`offset
{-3} pfa′`offset < max_linear_offset
{-4} is_linear_plain_memory?(pm′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

## excep-

tion_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Hiding formulas: 2,

Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of linear_resolve_register_transformers,

Applying disjunctive simplification to flatten sequent,

Instantiating quantified variables,

This completes the proof of raise_fault_unchanged_memory_invariant.1.3.

raise_fault_unchanged_memory_invariant.1.4:

{-1} Mem?(pfa′`type_of)
{-2} 0 ≤ pfa′`offset
{-3} pfa′`offset < max_linear_offset
{-4} is_linear_plain_memory?(pm′)
{1} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

## excep-

tion_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Rewriting using subset_reflexive, matching in *,

This completes the proof of raise_fault_unchanged_memory_invariant.1.4.
raise_fault_unchanged_memory_invariant.1.5:

{-1} Mem?(pfa′`type_of)
{-2} 0 ≤ pfa′`offset
{-3} pfa′`offset < max_linear_offset
{-4} is_linear_plain_memory?(pm′)
{1} plain_memory?(pm_phy)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

## excep-

tion_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of raise_fault_unchanged_memory_invariant.1.5.
raise_fault_unchanged_memory_invariant.2:

{-1} Mem?(pfa′`type_of)
{-2} 0 ≤ pfa′`offset
{-3} pfa′`offset < max_linear_offset
{-4} is_linear_plain_memory?(pm′)
{1} (Read ∈ (singleton[Memory_access](access′) ∪ {Read}))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, ad-

dress_data_type)

(CR2, pfa′)

## excep-

tion_result(Page_fault

((#reserved_bit_violation := false, priv-

ilege := priv′,

ac-

cess := (singleton [Memory_access](access′) ∪ {Read}), present := present′#))))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of raise_fault_unchanged_memory_invariant.2.

Q.E.D.

C.117.23 Linear_Memory_Properties.apply_side_effects_pm_states

Terse proof for apply_side_effects_pm_states.
apply_side_effects_pm_states:

{1} ∀ (pm: Plain_Memory[Linear_memory], l: list[[Memory_Address_4G, list[Byte]]],

              f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (l)

⊃ transformer_invariant?(pm`states, singleton(expr_2_super(apply_side_effects(l, f))))

Expanding the definition of transformer_invariant?, Inducting on l on formula 1, we get 2 subgoals:

apply_side_effects_pm_states.1:

{1} ∀ (pm: Plain_Memory[Linear_memory],

              f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

∀ (s: Linear_memory[Physical_memory, pm_phy],

                          q:

[Linear_memory[Physical_memory, pm_phy] →

SuperResult[Physical_memory]]): pm`states(s) ∧ singleton(expr_2_super(f(e)))(q) ⊃ result_pred(pm`states)(q(s)))

(null) ⊃ (∀ (s: Linear_memory[Physical_memory, pm_phy],

q: [Linear_memory[Physical_memory, pm_phy] → SuperRe-

sult[Physical_memory]]): pm`states(s) ∧ singleton(expr_2_super(apply_side_effects(null, f)))(q) ⊃ result_pred(pm`states)(q(s)))

Repeatedly Skolemizing and flattening,

Expanding the definition of apply_side_effects,

Expanding the definition of singleton,

Replacing using formula -4,

Expanding the definition of reduce,

Installing automatic rewrites from: result_pred expr_2_super expr_2_super_res ok_result

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of apply_side_effects_pm_states.1.

apply_side_effects_pm_states.2:

{1} ∀ (cons1_var: [Memory_Address_4G, list[Byte]],

cons2_var: list[[Memory_Address_4G, list[Byte]]]): (∀ (pm: Plain_Memory[Linear_memory],

f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

∀ (s: Linear_memory[Physical_memory, pm_phy],

         q:

[Linear_memory[Physical_memory, pm_phy] →

SuperResult[Physical_memory]]): pm`states(s) ∧ singleton(expr_2_super(f(e)))(q) ⊃ result_pred(pm`states)(q(s)))

(cons2_var) ⊃ (∀ (s: Linear_memory[Physical_memory, pm_phy],

q: [Linear_memory[Physical_memory, pm_phy] → SuperRe-

sult[Physical_memory]]): pm`states(s) ∧ singleton(expr_2_super(apply_side_effects(cons2_var, f)))(q) ⊃ result_pred(pm`states)(q(s))))

⊃ (∀ (pm: Plain_Memory[Linear_memory],

f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

∀ (s: Linear_memory[Physical_memory, pm_phy],

          q:

[Linear_memory[Physical_memory, pm_phy] →

SuperResult[Physical_memory]]): pm`states(s) ∧ singleton(expr_2_super(f(e)))(q) ⊃ result_pred(pm`states)(q(s)))

(cons(cons1_var, cons2_var)) ⊃ (∀ (s: Linear_memory[Physical_memory, pm_phy],

   q:

[Linear_memory[Physical_memory, pm_phy] → SuperRe-

sult[Physical_memory]]): pm`states(s) ∧ singleton(expr_2_super(apply_side_effects(cons(cons1_var, cons2_var), f)))

(q)

⊃ result_pred(pm`states)(q(s))))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: (s!1 expr_2_super(apply_side_effects(cons2_var!1,

f!1))), Expanding the definition of singleton, Replacing using formula -6, Hiding formulas: -6, Keeping (-3 -4 -5 1) and hiding *, Expanding the definition of apply_side_effects, Expanding the definition of reduce, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of apply_side_effects_pm_states.2.

Q.E.D.

C.117.24 Linear_Memory_Properties.apply_side_effects_ok

Terse proof for apply_side_effects_ok.
apply_side_effects_ok:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy], l: list[[Memory_Address_4G, list[Byte]]],

              f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(l)) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (l)

⊃ OK?(apply_side_effects(l, f)(s))

Inducting on l on formula 1, we get 2 subgoals:

apply_side_effects_ok.1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

              f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(null)) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (null)

⊃ OK?(apply_side_effects(null, f)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of apply_side_effects,

Expanding the definition of ok_result,

Expanding the definition of reduce,

which is trivially true.

This completes the proof of apply_side_effects_ok.1.

apply_side_effects_ok.2:

{1} ∀ (cons1_var: [Memory_Address_4G, list[Byte]],

cons2_var: list[[Memory_Address_4G, list[Byte]]]): (∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

                  f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))

(cons2_var))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (cons2_var)

⊃ OK?(apply_side_effects(cons2_var, f)(s))) ⊃ (∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

                   f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧

pm`states(s) ∧

(∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))

(cons(cons1_var, cons2_var)))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (cons(cons1_var, cons2_var))

⊃ OK?(apply_side_effects(cons(cons1_var, cons2_var), f)(s)))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of every,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

apply_side_effects_ok.2.1:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-4} OK?(apply_side_effects(cons2_var′, f′)(s′))
{-5} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))

(cons(cons1_var′, cons2_var′))

{-6} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))
{1} OK?(apply_side_effects(cons(cons1_var′, cons2_var′), f′)(s′))

Using lemma apply_side_effects_pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma expr_transformer_invariant_next_ok, Installing automatic rewrites from: (has_next_state! singleton!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of apply_side_effects, Expanding the definition of reduce, Expanding the definition of ##, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in -7 with the terms: (state(reduce(ok_result(null), LAMBDA (e:

[Memory_Address_4G, list[Byte]], r: [Linear_memory[Physical_memory, pm_phy] -> ExprResult [Linear_memory[Physical_memory, pm_phy], list[Byte]]]): (r ## (LAMBDA (tail: list[Byte]): (f!1(e) ## (LAMBDA (head: list[Byte]): ok_result(append(head, tail))))))) (cons2_var!1)(s!1))),

Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using ok_result_ok, matching in *,

This completes the proof of apply_side_effects_ok.2.1.
apply_side_effects_ok.2.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-4} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))

(cons(cons1_var′, cons2_var′))

{-5} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))
{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))(cons2_var′)

{2} OK?(apply_side_effects(cons(cons1_var′, cons2_var′), f′)(s′))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of apply_side_effects_ok.2.2.

Q.E.D.

C.117.25 Linear_Memory_Properties.apply_side_effects_same_result_TCC1

Terse proof for apply_side_effects_same_result_TCC1.
apply_side_effects_same_result_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy], l: list[[Memory_Address_4G, list[Byte]]],

              f:

[Memory_Address_4G, list[Byte] →

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(l)) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2)

(l))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (l)

⊃

OK?[Physical_memory, list[Byte]] (apply_side_effects[Physical_memory, pm_phy](l, f)(s))

Repeatedly Skolemizing and flattening,

Using lemma apply_side_effects_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of apply_side_effects_same_result_TCC1.

Q.E.D.

C.117.26 Linear_Memory_Properties.apply_side_effects_same_result

Terse proof for apply_side_effects_same_result.

apply_side_effects_same_result:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy], l: list[[Memory_Address_4G, list[Byte]]],

f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(l)) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2)

(l))

∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (l)

⊃ data(apply_side_effects(l, f)(s)) = reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(l)

Inducting on l on formula 1,

we get 4 subgoals:

apply_side_effects_same_result.1:

{-1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(l′)) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2)

(l′))

∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (l′)

⊃ data(apply_side_effects(l′, f)(s)) = reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(l′)

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(l′)) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2)

(l′))

∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (l′)

⊃ data(apply_side_effects(l′, f)(s)) = reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(l′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of apply_side_effects_same_result.1.

apply_side_effects_same_result.2:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

              f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(null)) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2) (null))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (null)

⊃

data(apply_side_effects(null, f)(s)) = reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(null)

Repeatedly Skolemizing and flattening,

Expanding the definition of apply_side_effects,

Expanding the definition of reduce,

Expanding the definition of ok_result,

which is trivially true.

This completes the proof of apply_side_effects_same_result.2.

apply_side_effects_same_result.3:

{1} ∀ (cons1_var: [Memory_Address_4G, list[Byte]],

cons2_var: list[[Memory_Address_4G, list[Byte]]]): (∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))

(cons2_var))

∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2) (cons2_var))

∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (cons2_var)

⊃ data(apply_side_effects(cons2_var, f)(s)) = reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons2_var))

⊃ (∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

 f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))

(cons(cons1_var, cons2_var)))

∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2) (cons(cons1_var, cons2_var)))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, single-

ton(expr_2_super(f(e)))))

(cons(cons1_var, cons2_var))

⊃ data(apply_side_effects(cons(cons1_var, cons2_var), f)(s)) = reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons(cons1_var, cons2_var)))

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Expanding the definition of every,

Case splitting on FORALL (s1: (pm!1‘states)): every(LAMBDA (e: [Memory_Address_4G, list[Byte]]): OK?(f!1(e)(s1))) (cons2_var!1),

we get 2 subgoals:

apply_side_effects_same_result.3.1:

{-1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))(cons2_var′)

{-2} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ (∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))

(cons2_var′))

∧

(∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(s_{1})) ⊃ data(f′(e)(s_{1})) = e`2)

(cons2_var′))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

⊃

data(apply_side_effects(cons2_var′, f′)(s′)) =

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))

(cons(cons1_var′, cons2_var′))

{-6} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(s_{1})) ⊃ data(f′(e)(s_{1})) = e`2) (cons(cons1_var′, cons2_var′))

{-7} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′)))) ∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{1} data(apply_side_effects(cons(cons1_var′, cons2_var′), f′)(s′)) =

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons(cons1_var′, cons2_var′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

apply_side_effects_same_result.3.1.1:

{-1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))(cons2_var′)

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)

{-4} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-5} data(apply_side_effects(cons2_var′, f′)(s′)) =

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-6} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))

(cons(cons1_var′, cons2_var′))

{-7} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(s_{1})) ⊃ data(f′(e)(s_{1})) = e`2) (cons(cons1_var′, cons2_var′))

{-8} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} data(apply_side_effects(cons(cons1_var′, cons2_var′), f′)(s′)) =

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons(cons1_var′, cons2_var′))

Using lemma apply_side_effects_ok, Using lemma apply_side_effects_pm_states, Expanding the definition of apply_side_effects, Expanding the definition of reduce, Expanding the definition of ##, Expanding the definition of ##, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of every, Rewriting using forall_and, matching in *, Rewriting using forall_and, matching in *, Applying disjunctive simplification to flatten sequent, Replacing using formula -9, Expanding the definition of apply_side_effects, Simplifying, rewriting, and recording with decision procedures, Case splitting on pm!1‘states (state(reduce(ok_result(null), LAMBDA (e: [Memory_Address_4G,

list[Byte]], r: [Linear_memory[Physical_memory, pm_phy] -> ExprResult [Linear_memory [Physical_memory, pm_phy], list[Byte]]]): (r ## (LAMBDA (tail: list[Byte]): (f!1(e) ## (LAMBDA (head: list[Byte]): ok_result(append(head, tail))))))) (cons2_var!1)(s!1))),

we get 2 subgoals:

apply_side_effects_same_result.3.1.1.1:

{-1} pm′`states

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′)))

{-2} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                      r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]):

ok_result (append

(head, tail)))))))

(cons2_var′)(s))))

{-3} OK?(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                        r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-7} data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                         r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

=

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-8} ∀ (x: (pm′`states)): OK?(f′(cons1_var′)(x))

{-9} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(x)))(cons2_var′)

{-10} ∀ (x: (pm′`states)):

OK?(f′(cons1_var′)(x)) ⊃ data(f′(cons1_var′)(x)) = cons1_var′`2

{-11} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(x)) ⊃ data(f′(e)(x)) = e`2)

(cons2_var′)
{-12} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} data(cases f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                           r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))) of

OK(state_1, data_1):

ok_result(append(data_1,

data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                                      r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory [Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append

(head, tail)))))))

(cons2_var′)(s′))))

(state_1),

Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

=

append(cons1_var′`2,

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons2_var′))

1596

Instantiating the top quantifier in -8 with the terms: (state(reduce(ok_result(null), LAMBDA (e: [Memory_Address_4G, list[Byte]], r: [Linear_memory[Physical_memory, pm_phy] -> ExprResult [Linear_memory[Physical_memory, pm_phy], list[Byte]]]): (r ## (LAMBDA (tail: list[Byte]): (f!1(e) ## (LAMBDA (head: list[Byte]): ok_result(append(head, tail))))))) (cons2_var!1)(s!1))),

we get 2 subgoals:

apply_side_effects_same_result.3.1.1.1.1:

{-1} pm′`states

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′)))

{-2} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                      r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]):

ok_result (append

(head, tail)))))))

(cons2_var′)(s))))

{-3} OK?(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                        r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-7} data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                         r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

=

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-8} OK?(f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                    r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))))

{-9} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(x)))(cons2_var′)

{-10} ∀ (x: (pm′`states)):

OK?(f′(cons1_var′)(x)) ⊃ data(f′(cons1_var′)(x)) = cons1_var′`2

{-11} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(x)) ⊃ data(f′(e)(x)) = e`2)

(cons2_var′)
{-12} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} data(cases f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                           r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))) of

OK(state_1, data_1):

ok_result(append(data_1,

data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                                      r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory [Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append

(head, tail)))))))

(cons2_var′)(s′))))

(state_1),

Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

=

append(cons1_var′`2,

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons2_var′))

1598

Instantiating the top quantifier in -10 with the terms: (state(reduce(ok_result(null), LAMBDA (e: [Memory_Address_4G, list[Byte]], r: [Linear_memory[Physical_memory, pm_phy] -> ExprResult [Linear_memory[Physical_memory, pm_phy], list[Byte]]]): (r ## (LAMBDA (tail: list[Byte]): (f!1(e) ## (LAMBDA (head: list[Byte]): ok_result(append(head, tail))))))) (cons2_var!1)(s!1))),

we get 2 subgoals:

apply_side_effects_same_result.3.1.1.1.1.1:

{-1} pm′`states

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′)))

{-2} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                      r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]):

ok_result (append

(head, tail)))))))

(cons2_var′)(s))))

{-3} OK?(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                        r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-7} data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                         r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

=

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-8} OK?(f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                    r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))))

{-9} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(x)))(cons2_var′)

{-10} OK?(f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                    r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))))

⊃

data(f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                      r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))))

= cons1_var′`2

{-11} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(x)) ⊃ data(f′(e)(x)) = e`2)

(cons2_var′)
{-12} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} data(cases f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                           r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))) of

OK(state_1, data_1):

ok_result(append(data_1,

data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                                      r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory [Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append

(head, tail)))))))

(cons2_var′)(s′))))

(state_1),

Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

=

append(cons1_var′`2,

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons2_var′))

1600

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using ok_result_data, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of apply_side_effects_same_result.3.1.1.1.1.1.

apply_side_effects_same_result.3.1.1.1.1.2:

{-1} pm′`states

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′)))

{-2} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                      r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]):

ok_result (append

(head, tail)))))))

(cons2_var′)(s))))

{-3} OK?(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                        r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-7} data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                         r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

=

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-8} OK?(f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                    r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))))

{-9} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(x)))(cons2_var′)

{-10} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(x)) ⊃ data(f′(e)(x)) = e`2)

(cons2_var′)
{-11} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} pm′`states

(state[Physical_memory, list[Byte]]

(reduce

[[Memory_Address_4G, list[Byte]],

[Linear_memory[Physical_memory, pm_phy] → ExprResult[Physical_memory, list[Byte]]]]

(ok_result[Linear_memory[Physical_memory, pm_phy], list[Byte]]

(null[Byte]), λ (e: [Memory_Address_4G, list[Byte]],

                             r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(##[Physical_memory, list[Byte], list[Byte]]

(r,

(λ (tail: list[Byte]):

(##[Physical_memory, list[Byte], list[Byte]]

(f′(e),

(λ (head: list[Byte]): ok_result

[Linear_memory[Physical_memory, pm_phy],

list[Byte]] (append[Byte](head, tail)))))))))

(cons2_var′)(s′)))

{2} data(cases f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                           r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))) of

OK(state_1, data_1):

ok_result(append(data_1,

data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                                      r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory [Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append

(head, tail)))))))

(cons2_var′)(s′))))

(state_1),

Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

=

append(cons1_var′`2,

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons2_var′))

1602

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

which is trivially true.

This completes the proof of apply_side_effects_same_result.3.1.1.1.1.2.

apply_side_effects_same_result.3.1.1.1.2:

{-1} pm′`states

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′)))

{-2} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                      r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]):

ok_result (append

(head, tail)))))))

(cons2_var′)(s))))

{-3} OK?(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                        r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-7} data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                         r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

=

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-8} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(x)))(cons2_var′)

{-9} ∀ (x: (pm′`states)):

OK?(f′(cons1_var′)(x)) ⊃ data(f′(cons1_var′)(x)) = cons1_var′`2

{-10} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(x)) ⊃ data(f′(e)(x)) = e`2)

(cons2_var′)
{-11} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} pm′`states

(state[Physical_memory, list[Byte]]

(reduce

[[Memory_Address_4G, list[Byte]],

[Linear_memory[Physical_memory, pm_phy] → ExprResult[Physical_memory, list[Byte]]]]

(ok_result[Linear_memory[Physical_memory, pm_phy], list[Byte]]

(null[Byte]), λ (e: [Memory_Address_4G, list[Byte]],

                             r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(##[Physical_memory, list[Byte], list[Byte]]

(r,

(λ (tail: list[Byte]):

(##[Physical_memory, list[Byte], list[Byte]]

(f′(e),

(λ (head: list[Byte]): ok_result

[Linear_memory[Physical_memory, pm_phy],

list[Byte]] (append[Byte](head, tail)))))))))

(cons2_var′)(s′)))

{2} data(cases f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                           r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))) of

OK(state_1, data_1):

ok_result(append(data_1,

data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                                      r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory [Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append

(head, tail)))))))

(cons2_var′)(s′))))

(state_1),

Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

=

append(cons1_var′`2,

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons2_var′))

1604

This completes the proof of apply_side_effects_same_result.3.1.1.1.2.

apply_side_effects_same_result.3.1.1.2:

{-1} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                      r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]):

ok_result (append

(head, tail)))))))

(cons2_var′)(s))))

{-2} OK?(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                        r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-6} data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                         r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

=

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-7} ∀ (x: (pm′`states)): OK?(f′(cons1_var′)(x))

{-8} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(x)))(cons2_var′)

{-9} ∀ (x: (pm′`states)):

OK?(f′(cons1_var′)(x)) ⊃ data(f′(cons1_var′)(x)) = cons1_var′`2

{-10} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(x)) ⊃ data(f′(e)(x)) = e`2)

(cons2_var′)
{-11} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} pm′`states

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′)))

{2} data(cases f′(cons1_var′)

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                           r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))) of

OK(state_1, data_1):

ok_result(append(data_1,

data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                                      r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory [Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append

(head, tail)))))))

(cons2_var′)(s′))))

(state_1),

Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

=

append(cons1_var′`2,

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons2_var′))

1606

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma expr_transformer_invariant_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

apply_side_effects_same_result.3.1.1.2.1:

{-1} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                      r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]):

ok_result (append

(head, tail)))))))

(cons2_var′)(s))))

{-2} pm′`states(s′)

{-3} OK?(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                        r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{-4} is_linear_plain_memory?(pm′)

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-6} data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                         r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

=

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-7} ∀ (x: (pm′`states)): OK?(f′(cons1_var′)(x))

{-8} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(x)))(cons2_var′)

{-9} ∀ (x: (pm′`states)):

OK?(f′(cons1_var′)(x)) ⊃ data(f′(cons1_var′)(x)) = cons1_var′`2

{-10} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(x)) ⊃ data(f′(e)(x)) = e`2)

(cons2_var′)
{-11} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} has_next_state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                   r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{2} pm′`states

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′)))

1608

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of has_next_state, which is trivially true.

This completes the proof of apply_side_effects_same_result.3.1.1.2.1.

apply_side_effects_same_result.3.1.1.2.2:

{-1} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                      r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]):

ok_result (append

(head, tail)))))))

(cons2_var′)(s))))

{-2} pm′`states(s′)

{-3} OK?(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                        r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

{-4} is_linear_plain_memory?(pm′)

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-6} data(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                         r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]): ok_result(append(head, tail)))))))

(cons2_var′)(s′))

=

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-7} ∀ (x: (pm′`states)): OK?(f′(cons1_var′)(x))

{-8} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(x)))(cons2_var′)

{-9} ∀ (x: (pm′`states)):

OK?(f′(cons1_var′)(x)) ⊃ data(f′(cons1_var′)(x)) = cons1_var′`2

{-10} ∀ (x: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(x)) ⊃ data(f′(e)(x)) = e`2)

(cons2_var′)
{-11} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))

{1} singleton(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                              r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s)))

(expr_2_super(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                            r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy],

list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)))

{2} pm′`states

(state(reduce(ok_result(null),

λ (e: [Memory_Address_4G, list[Byte]],

                                r:

[Linear_memory[Physical_memory, pm_phy] →

ExprResult

[Linear_memory[Physical_memory, pm_phy], list[Byte]]]):

(r ##

(λ (tail: list[Byte]): (f′(e) ##

(λ (head: list[Byte]):

ok_result(append(head, tail)))))))

(cons2_var′)(s′)))

1610

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of singleton, Applying decompose-equality, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of apply_side_effects_same_result.3.1.1.2.2.
apply_side_effects_same_result.3.1.2:

{-1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))(cons2_var′)

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)

{-4} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{-5} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))

(cons(cons1_var′, cons2_var′))

{-6} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(s_{1})) ⊃ data(f′(e)(s_{1})) = e`2) (cons(cons1_var′, cons2_var′))

{-7} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′))))
{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(s_{1})) ⊃ data(f′(e)(s_{1})) = e`2)

(cons2_var′)

{2} data(apply_side_effects(cons(cons1_var′, cons2_var′), f′)(s′)) =

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons(cons1_var′, cons2_var′))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of apply_side_effects_same_result.3.1.2.

apply_side_effects_same_result.3.2:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ (∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))

(cons2_var′))

∧

(∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(s_{1})) ⊃ data(f′(e)(s_{1})) = e`2)

(cons2_var′))

∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

⊃

data(apply_side_effects(cons2_var′, f′)(s′)) =

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(cons2_var′)

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))

(cons(cons1_var′, cons2_var′))

{-5} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f′(e)(s_{1})) ⊃ data(f′(e)(s_{1})) = e`2) (cons(cons1_var′, cons2_var′))

{-6} transformer_invariant?(pm′`states, singleton(expr_2_super(f′(cons1_var′)))) ∧

every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states, singleton(expr_2_super(f′(e))))) (cons2_var′)

{1} ∀ (s_{1}: (pm′`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f′(e)(s_{1})))(cons2_var′) {2} data(apply_side_effects(cons(cons1_var′, cons2_var′), f′)(s′)) =

reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (cons(cons1_var′, cons2_var′))

Repeatedly Skolemizing and flattening,

Expanding the definition of every,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of apply_side_effects_same_result.3.2.

apply_side_effects_same_result.4:

{1} ∀ (l: list[[Memory_Address_4G, list[Byte]]], pm: Plain_Memory[Linear_memory[Physical_memory, pm_phy]], s: Linear_memory[Physical_memory, pm_phy],

f:

[Memory_Address_4G, list[Byte] →

[Linear_memory[Physical_memory, pm_phy] →

ExprResult[Linear_memory[Physical_memory, pm_phy], list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(l)) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2)

(l))

∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (l)

⊃ OK?[Physical_memory, list[Byte]]

(apply_side_effects[Physical_memory, pm_phy](l, f)(s))

{2} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]]):

is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(f(e)(s_{1})))(l′)) ∧ (∀ (s_{1}: (pm`states)):

every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(f(e)(s_{1})) ⊃ data(f(e)(s_{1})) = e`2)

(l′))

∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm`states, singleton(expr_2_super(f(e))))) (l′)

⊃ data(apply_side_effects(l′, f)(s)) = reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(l′)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma apply_side_effects_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of apply_side_effects_same_result.4.

Q.E.D.

C.117.27 Linear_Memory_Properties.apply_side_effects_unchanged

Terse proof for apply_side_effects_unchanged.

apply_side_effects_unchanged:

{1} ∀ (pm: Plain_Memory[Linear_memory], l: list[[Memory_Address_4G, list[Byte]]],

              f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]], addresses: PRED[Memory_Address_4G]):

is_linear_plain_memory?(pm) ∧ (addresses ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses)))

(l) ⊃ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects(l, f))), extend[Address, Mem-

ory_Address_4G, bool, false](addresses))

Inducting on l on formula 1,

we get 2 subgoals:

apply_side_effects_unchanged.1:

{1} ∀ (pm: Plain_Memory[Linear_memory],

              f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]], addresses: PRED[Memory_Address_4G]):

is_linear_plain_memory?(pm) ∧ (addresses ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses)))

(null) ⊃ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects(null, f))), extend[Address, Mem-

ory_Address_4G, bool, false](addresses))

Repeatedly Skolemizing and flattening,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of apply_side_effects_unchanged.1.

apply_side_effects_unchanged.2:

{1} ∀ (cons1_var: [Memory_Address_4G, list[Byte]],

cons2_var: list[[Memory_Address_4G, list[Byte]]]): (∀ (pm: Plain_Memory[Linear_memory],

 f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]], addresses: PRED[Memory_Address_4G]):

is_linear_plain_memory?(pm) ∧ (addresses ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses)))

(cons2_var) ⊃ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects

(cons2_var, f))),

extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses)))

⊃ (∀ (pm: Plain_Memory[Linear_memory],

  f:

[Memory_Address_4G, list[Byte] →

[Linear_memory → ExprResult[Linear_memory, list[Byte]]]], addresses: PRED[Memory_Address_4G]):

is_linear_plain_memory?(pm) ∧ (addresses ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses)))

(cons(cons1_var, cons2_var)) ⊃ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(apply_side_effects

(cons(cons1_var, cons2_var),

f))),

extend[Address, Mem-

ory_Address_4G, bool, false] (addresses)))

Repeatedly Skolemizing and flattening,

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Instantiating quantified variables, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of apply_side_effects, Expanding the definition of reduce, Using lemma pm_plain_phy, Using lemma pm_states, Using lemma plain_memory_unchanged_composition[Linear_memory, list[Byte], list[Byte]], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

apply_side_effects_unchanged.2.1:

{-1} plain_memory?(pm_phy)

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]): (f′(e)

##

(λ (head: list[Byte]): ok_result (append

(head, tail)))))))

(cons2_var′) ## (λ (tail_1: list[Byte]):

(f′(cons1_var′) ## (λ

(head_1: list[Byte]): ok_result (append

(head_1, tail_1))))))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states = pm_phy`states
{-5} (addresses′ ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses′)))

(cons2_var′)

{-7} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(apply_side_effects(cons2_var′, f′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{-8} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(cons1_var′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory [Physical_memory, pm_phy]):

(reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

  r:

[Linear_memory

[Physical_memory, pm_phy] →

Ex-

prResult

[Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]): ok_result (append (head,

tail)))))))

(cons2_var′) ## (λ

(tail_1: list[Byte]): (f′(cons1_var′)

## (λ

(head_1: list[Byte]): ok_result (append

(head_1, tail_1)))))) (s))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

1618

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of expr_2_super, which is trivially true.

This completes the proof of apply_side_effects_unchanged.2.1.

apply_side_effects_unchanged.2.2:

{-1} plain_memory?(pm_phy)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states = pm_phy`states
{-4} (addresses′ ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses′)))

(cons2_var′)

{-6} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(apply_side_effects(cons2_var′, f′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{-7} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(cons1_var′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{1} ∀ (d: (λ (l: list[Byte]): true)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((f′(cons1_var′) ##

(λ (head_1: list[Byte]): ok_result (append(head_1, d)))))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): (reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                          r:

[Linear_memory

[Physical_memory, pm_phy] →

Ex-

prResult

[Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]): (f′(e) ## (λ

(head: list[Byte]): ok_result (append (head,

tail)))))))

(cons2_var′) ## (λ

(tail_1: list[Byte]):

(f′(cons1_var′)

## (λ

(head_1: list[Byte]):

ok_result (append

(head_1, tail_1)))))) (s))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

1620

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma plain_memory_unchanged_composition[Linear_memory, list[Byte], list[Byte]],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

apply_side_effects_unchanged.2.2.1:

{-1} plain_memory?(pm_phy)

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(cons1_var′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{-3} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(d′)

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} (addresses′ ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-7} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses′)))

(cons2_var′)

{-8} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(apply_side_effects(cons2_var′, f′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{1} ∀ (d: (λ (l: list[Byte]): true)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(ok_result(append(d, d′)))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((f′(cons1_var′) ##

(λ (head_1: list[Byte]): ok_result (append(head_1, d′)))))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

Repeatedly Skolemizing and flattening,

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of apply_side_effects_unchanged.2.2.1.

apply_side_effects_unchanged.2.2.2:

{-1} plain_memory?(pm_phy)

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(cons1_var′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{-3} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(d′)

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} (addresses′ ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-7} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses′)))

(cons2_var′)

{-8} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(apply_side_effects(cons2_var′, f′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{1} (extend[Address, Memory_Address_4G , bool, false](addresses′) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((f′(cons1_var′) ##

(λ (head_1: list[Byte]): ok_result (append(head_1, d′)))))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

Keeping (-6 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of apply_side_effects_unchanged.2.2.2.

apply_side_effects_unchanged.2.3:

{-1} plain_memory?(pm_phy)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states = pm_phy`states
{-4} (addresses′ ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses′)))

(cons2_var′)

{-6} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(apply_side_effects(cons2_var′, f′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{-7} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(cons1_var′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

r:

[Linear_memory [Physical_memory, pm_phy] → ExprResult [Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]): (f′(e)

##

(λ (head: list[Byte]): ok_result (append

(head, tail)))))))

(cons2_var′))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory [Physical_memory, pm_phy]):

(reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

  r:

[Linear_memory

[Physical_memory, pm_phy] →

Ex-

prResult

[Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]):

(f′(e) ## (λ

(head: list[Byte]): ok_result (append (head,

tail)))))))

(cons2_var′) ## (λ

(tail_1: list[Byte]): (f′(cons1_var′)

## (λ

(head_1: list[Byte]): ok_result (append

(head_1, tail_1)))))) (s))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

1623 C Proof scripts

Hiding formulas: 2, Expanding the definition of apply_side_effects, Expanding the definition of expr_2_super, which is trivially true.

This completes the proof of apply_side_effects_unchanged.2.3.

apply_side_effects_unchanged.2.4:

{-1} plain_memory?(pm_phy)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states = pm_phy`states
{-4} (addresses′ ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(e))), extend[Address, Mem-

ory_Address_4G, bool, false]

(addresses′)))

(cons2_var′)

{-6} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(apply_side_effects(cons2_var′, f′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{-7} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, singleton(expr_2_super(f′(cons1_var′))), extend[Address, Memory_Address_4G, bool, false](addresses′))

{1} (extend[Address, Memory_Address_4G , bool, false](addresses′) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): (reduce(ok_result(null), λ (e:

[Memory_Address_4G,

list[Byte]],

                                                                          r:

[Linear_memory

[Physical_memory, pm_phy] →

Ex-

prResult

[Linear_memory

[Physical_memory, pm_phy], list[Byte]]]):

(r ## (λ

(tail: list[Byte]): (f′(e) ## (λ

(head: list[Byte]): ok_result (append (head,

tail)))))))

(cons2_var′) ## (λ

(tail_1: list[Byte]):

(f′(cons1_var′)

## (λ

(head_1: list[Byte]):

ok_result (append

(head_1, tail_1)))))) (s))),

extend[Address, Memory_Address_4G, bool, false](addresses′))

1625

Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of apply_side_effects_unchanged.2.4.

Q.E.D.

C.117.28 Linear_Memory_Properties.subset_ptab_address_rw_addr

Terse proof for subset_ptab_address_rw_addr.
subset_ptab_address_rw_addr:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

base: Memory_Address_4G): (address_in_pt_range? (s, (restrict [Address, Memory_Address_4G , bool](pm‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr)) ∧ (address_block(base, expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s, restrict [Address, Memory_Address_4G , bool]((pm‘ro_addr∪ pm‘rw_addr))))) ⊃ (address_block(base, expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

Repeatedly Skolemizing and flattening, Case splitting on union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)) = restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr)),

we get 2 subgoals:

subset_ptab_address_rw_addr.1:

{-1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))

{-2} Mem?(base′`type_of)
{-3} 0 ≤ base′`offset
{-4} base′`offset < max_linear_offset
{-5} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr))
{-6} (address_block(base′, expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{1} (address_block(base′, expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

Replacing using formula -1, Using lemma subset_transitive, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-6 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -2 with the terms: (x!1), we get 2 subgoals:

subset_ptab_address_rw_addr.1.1:

{-1} (x′ ∈ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{-2} (x′ ∈ address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))

⇒ (x′ ∈ restrict[Address, Memory_Address_4G , bool](pm_phy‘rw_addr))

{1} (x′ ∈ pm_phy‘rw_addr)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subset_ptab_address_rw_addr.1.1.

subset_ptab_address_rw_addr.1.2:

{-1} (x′ ∈ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{1} Mem?(x′`type_of) ∧ 0 ≤ x′`offset ∧ x′`offset < max_linear_offset
{2} (x′ ∈ pm_phy‘rw_addr)

Expanding the definition of member, Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of subset_ptab_address_rw_addr.1.2.
subset_ptab_address_rw_addr.2:

{-1} Mem?(base′`type_of)
{-2} 0 ≤ base′`offset
{-3} base′`offset < max_linear_offset
{-4} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr))
{-5} (address_block(base′, expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))

{2} (address_block(base′, expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subset_ptab_address_rw_addr.2.

Q.E.D.

C.117.29 Linear_Memory_Properties.translate_transformer_invariant

Terse proof for translate_transformer_invariant.
translate_transformer_invariant:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], base: PTab_Address, lin_a: Mem-

ory_Address_4G,

access: Memory_access, priv: Memory_privilege): union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ (address_block(xlat_idx(lvl, base, lin_a), expt(2, pe_size)) ⊆ pm_phy‘rw_addr) ⊃ transformer_invariant?(pm`states,

singleton(expr_2_super(translate(lvl, base, lin_a, access, priv))))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Rewriting using fexpr_composition_transformer_invariant [Physical_memory, (range_pt(lvl!1)), [bool,

Address]], matching in * where P gets LAMBDA (p: (range_pt(lvl!1))): TRUE, we get 3 subgoals:

translate_transformer_invariant.1:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states = pm_phy`states
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-8} Mem?(lin_a′`type_of)
{-9} 0 ≤ lin_a′`offset
{-10} lin_a′`offset < max_linear_offset
{-11} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-12} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{1} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(read_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx

(lvl′, base′, lin_a′)))))

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))

##

(λ (pe: (range_pt(lvl′))):

if pag-

ing_type?(lvl′, pe)

then if present?(pe) then if ac-

cessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data (pm_phy, pag-

ing_data_type

(lvl′)) (xlat_idx (lvl′,

base′, lin_a′), set_reference (pe, access′))

##

ok_result (is_leaf?(pe), base(pe))

else raise_fault (priv′,

access′, true, lin_a′)

endif else raise_fault (priv′,

access′, false, lin_a′)

endif else fatal_result endif)))))

1628

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma pm_plain_phy, Rewriting using plain_memory_transformer_invariant_read_data, matching in *, Expanding the definition of in_blessed_memory?, Rewriting using paging_data_type_size, matching in *, Keeping (-13 1) and hiding *, Rewriting using subset_transitive, matching in * where a gets address_block(xlat_idx(lvl!1, base!1,

lin_a!1), expt(2, pe_size)), b gets pm_phy‘rw_addr, Rewriting using union_subset3, matching in *,

This completes the proof of translate_transformer_invariant.1.

translate_transformer_invariant.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states = pm_phy`states
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-8} Mem?(lin_a′`type_of)
{-9} 0 ≤ lin_a′`offset
{-10} lin_a′`offset < max_linear_offset
{-11} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-12} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{1} ∀ (d: (λ (p: (range_pt(lvl′))): true)):

transformer_invariant?(pm_phy`states,

if paging_type?(lvl′, d) then if present?(d)

then if accessible?(d, access′) ∧ privi-

leged?(d, priv′)

then singleton(expr_2_super(write_data

(pm_phy, pag-

ing_data_type

(lvl′)) (xlat_idx (lvl′,

base′, lin_a′), set_reference (d, access′))

##

ok_result (is_leaf?(d), base(d))))

else singleton(expr_2_super(raise_fault

(priv′, access′, true, lin_a′)))

endif else singleton(expr_2_super(raise_fault

(priv′, access′, false, lin_a′)))

endif else singleton(expr_2_super(fatal_result)) endif)

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))

##

(λ (pe: (range_pt(lvl′))):

if pag-

ing_type?(lvl′, pe)

then if present?(pe) then if ac-

cessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data (pm_phy, pag-

ing_data_type

(lvl′)) (xlat_idx (lvl′,

base′, lin_a′), set_reference (pe, access′))

##

ok_result (is_leaf?(pe), base(pe))

else raise_fault (priv′,

access′, true, lin_a′)

endif else raise_fault (priv′,

access′, false, lin_a′)

endif else fatal_result endif)))))

1630

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 5 subgoals:

translate_transformer_invariant.2.1:

{-1} range_pt(lvl′)(d′)
{-2} paging_type?(lvl′, d′)
{-3} present?(d′)
{-4} accessible?(d′, access′)
{-5} privileged?(d′, priv′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} lvl′ < max_level
{-9} Mem?(base′`type_of)
{-10} 0 ≤ base′`offset
{-11} base′`offset < max_linear_offset
{-12} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-13} Mem?(lin_a′`type_of)
{-14} 0 ≤ lin_a′`offset
{-15} lin_a′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-17} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{1} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(d′, access′))

## ok_result(is_leaf?(d′), base(d′)))))

Rewriting using expr_composition_transformer_invariant, matching in *, we get 2 subgoals:

translate_transformer_invariant.2.1.1:

{-1} range_pt(lvl′)(d′)
{-2} paging_type?(lvl′, d′)
{-3} present?(d′)
{-4} accessible?(d′, access′)
{-5} privileged?(d′, priv′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} lvl′ < max_level
{-9} Mem?(base′`type_of)
{-10} 0 ≤ base′`offset
{-11} base′`offset < max_linear_offset
{-12} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-13} Mem?(lin_a′`type_of)
{-14} 0 ≤ lin_a′`offset
{-15} lin_a′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-17} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{1} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(d′, access′)))))

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(d′, access′))

## ok_result(is_leaf?(d′), base(d′)))))

Hiding formulas: 2,

Using lemma pm_plain_phy,

Rewriting using plain_memory_transformer_invariant_write_data, matching in *,

Expanding the definition of in_blessed_memory?,

Rewriting using paging_data_type_size, matching in *,

This completes the proof of translate_transformer_invariant.2.1.1.

translate_transformer_invariant.2.1.2:

{-1} range_pt(lvl′)(d′)
{-2} paging_type?(lvl′, d′)
{-3} present?(d′)
{-4} accessible?(d′, access′)
{-5} privileged?(d′, priv′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states = pm_phy`states
{-8} lvl′ < max_level
{-9} Mem?(base′`type_of)
{-10} 0 ≤ base′`offset
{-11} base′`offset < max_linear_offset
{-12} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-13} Mem?(lin_a′`type_of)
{-14} 0 ≤ lin_a′`offset
{-15} lin_a′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-17} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{1} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(ok_result(is_leaf?(d′), base(d′)))))

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(write_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(d′, access′))

## ok_result(is_leaf?(d′), base(d′)))))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of translate_transformer_invariant.2.1.2.
translate_transformer_invariant.2.2:

{-1} range_pt(lvl′)(d′)
{-2} paging_type?(lvl′, d′)
{-3} present?(d′)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-11} Mem?(lin_a′`type_of)
{-12} 0 ≤ lin_a′`offset
{-13} lin_a′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-15} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)
{1} privileged?(d′, priv′)

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(raise_fault(priv′, access′, true, lin_a′))))

Rewriting using raise_fault_transformer_invariant, matching in * where pm gets pm!1,

This completes the proof of translate_transformer_invariant.2.2.
translate_transformer_invariant.2.3:

{-1} range_pt(lvl′)(d′)
{-2} paging_type?(lvl′, d′)
{-3} present?(d′)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states = pm_phy`states
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-11} Mem?(lin_a′`type_of)
{-12} 0 ≤ lin_a′`offset
{-13} lin_a′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-15} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)
{1} accessible?(d′, access′)

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(raise_fault(priv′, access′, true, lin_a′))))

Rewriting using raise_fault_transformer_invariant, matching in * where pm gets pm!1,

This completes the proof of translate_transformer_invariant.2.3.
translate_transformer_invariant.2.4:

{-1} range_pt(lvl′)(d′)
{-2} paging_type?(lvl′, d′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states = pm_phy`states
{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-10} Mem?(lin_a′`type_of)
{-11} 0 ≤ lin_a′`offset
{-12} lin_a′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-14} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)
{1} present?(d′)

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super(raise_fault(priv′, access′, false, lin_a′))))

Rewriting using raise_fault_transformer_invariant, matching in * where pm gets pm!1,

This completes the proof of translate_transformer_invariant.2.4.

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

translate_transformer_invariant.2.5:

{-1} range_pt(lvl′)(d′)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states = pm_phy`states
{-4} lvl′ < max_level
{-5} Mem?(base′`type_of)
{-6} 0 ≤ base′`offset
{-7} base′`offset < max_linear_offset
{-8} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-9} Mem?(lin_a′`type_of)
{-10} 0 ≤ lin_a′`offset
{-11} lin_a′`offset < max_linear_offset
{-12} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-13} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)
{1} paging_type?(lvl′, d′)
{2} transformer_invariant?(pm_phy`states, singleton(expr_2_super(fatal_result)))

Keeping (2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of translate_transformer_invariant.2.5.

translate_transformer_invariant.3:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states = pm_phy`states
{-3} lvl′ < max_level
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-8} Mem?(lin_a′`type_of)
{-9} 0 ≤ lin_a′`offset
{-10} lin_a′`offset < max_linear_offset
{-11} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-12} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{1} ∀ (pe: (range_pt(lvl′))):

accessible?(pe, access′) ∧ privileged?(pe, priv′) ∧ present?(pe) ∧ paging_type?(lvl′, pe) ⊃ range_pt(lvl′)(set_reference(pe, access′))

{2} transformer_invariant?(pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))

##

(λ (pe: (range_pt(lvl′))):

if pag-

ing_type?(lvl′, pe)

then if present?(pe) then if ac-

cessible?(pe, access′) ∧ privi-

leged?(pe, priv′)

then write_data (pm_phy, pag-

ing_data_type

(lvl′)) (xlat_idx (lvl′,

base′, lin_a′), set_reference (pe, access′))

##

ok_result (is_leaf?(pe), base(pe))

else raise_fault (priv′,

access′, true, lin_a′)

endif else raise_fault (priv′,

access′, false, lin_a′)

endif else fatal_result endif)))))

1636

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of translate_transformer_invariant.3.

Q.E.D.

C.117.30 Linear_Memory_Properties.translate_unchanged_pm_phy_except_pe_TCC1

Terse proof for translate_unchanged_pm_phy_except_pe_TCC1.
translate_unchanged_pm_phy_except_pe_TCC1:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], base: PTab_Address[Physical_memory, pm_phy],

lin_a: Memory_Address_4G): (∀ (s: (pm`states)):

OK?(read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))(s))) ∧ (address_block(xlat_idx(lvl, base, lin_a), expt(2, pe_size)) ⊆ pm_phy‘rw_addr) ∧ is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(lin_a) ⊃ (∀ (s_{1}, s_{2}: (pm`states)):

OK?[Physical_memory, ((range_pt(lvl)))]

(read_data[Physical_memory, ((range_pt(lvl)))] (pm_phy, paging_data_type(lvl)) (xlat_idx[Physical_memory, pm_phy](lvl, base, lin_a))(s_{1})))

Repeatedly Skolemizing and flattening, Instantiating quantified variables,

This completes the proof of translate_unchanged_pm_phy_except_pe_TCC1.

Q.E.D.

C.117.31 Linear_Memory_Properties.translate_unchanged_pm_phy_except_pe_TCC2

Terse proof for translate_unchanged_pm_phy_except_pe_TCC2.
translate_unchanged_pm_phy_except_pe_TCC2:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], base: PTab_Address[Physical_memory, pm_phy],

lin_a: Memory_Address_4G): (∀ (s: (pm`states)):

OK?(read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))(s))) ∧ (address_block(xlat_idx(lvl, base, lin_a), expt(2, pe_size)) ⊆ pm_phy‘rw_addr) ∧ is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(lin_a) ⊃ (∀ (s_{1}, s_{2}: (pm`states)):

OK?[Physical_memory, ((range_pt(lvl)))]

(read_data[Physical_memory, ((range_pt(lvl)))] (pm_phy, paging_data_type(lvl)) (xlat_idx[Physical_memory, pm_phy](lvl, base, lin_a))(s_{2})))

Repeatedly Skolemizing and flattening, Instantiating quantified variables,

This completes the proof of translate_unchanged_pm_phy_except_pe_TCC2.

Q.E.D.

C.117.32 Linear_Memory_Properties.translate_unchanged_pm_phy_except_pe

Terse proof for translate_unchanged_pm_phy_except_pe.
translate_unchanged_pm_phy_except_pe:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], base: PTab_Address, lin_a: Mem-

ory_Address_4G,

access: Memory_access, priv: Memory_privilege): (union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ (address_block(xlat_idx(lvl, base, lin_a), expt(2, pe_size)) ⊆ pm_phy‘rw_addr) ∧ (∀ (s: (pm`states)):

OK?(read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))

(s)))

∧

(∀ (s_{1}, s_{2}: (pm`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))

(xlat_idx(lvl, base, lin_a))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl))

(xlat_idx(lvl, base, lin_a))(s_{2})),

Write)))

⊃

let pe_addr = xlat_idx(lvl, base, lin_a) in

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(lvl, base, lin_a, ac-

cess,

priv))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(pe_addr, expt(2, pe_size))))

Repeatedly Skolemizing and flattening, Letting addr_set name difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr), address_block(xlat_idx(lvl!1,

base!1, lin_a!1), expt(2, pe_size))), Using lemma pm_states, Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -4, Case splitting on subset?(addr_set, union(pm_phy‘ro_addr, pm_phy‘rw_addr)), we get 2 subgoals:

translate_unchanged_pm_phy_except_pe.1:

{-1} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states

{-5} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-11} Mem?(lin_a′`type_of)
{-12} 0 ≤ lin_a′`offset
{-13} lin_a′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-15} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-16} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(lvl′,

base′,
lin_a′,
access′,
priv′))),

addr_set)

Expanding the definition of translate,

Rewriting using plain_memory_unchanged_composition [Physical_memory, (range_pt(lvl!1)), [bool, Address]], matching in * where P gets LAMBDA (p: (range_pt(lvl!1))): FORALL (s: (pm_phy‘states)): OK?(read_data(pm_phy, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, lin_a!1))(s)) IMPLIES set_reference(data(read_data(pm_phy, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, lin_a!1)) (s)), Write) = set_reference(p, Write), pm gets pm_phy, addresses gets addr_set,

we get 4 subgoals:

translate_unchanged_pm_phy_except_pe.1.1:

{-1} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states

{-5} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-11} Mem?(lin_a′`type_of)
{-12} 0 ≤ lin_a′`offset
{-13} lin_a′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-15} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-16} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} ∀ (s_1: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s_1))

⊃

(∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s))

⊃

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_1)),

Write))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx

(lvl′, base′, lin_a′))

##

(λ (pe: (range_pt(lvl′))):

if pag-

ing_type?(lvl′, pe)

then if present?(pe) then if ac-

cessible?

(pe, access′) ∧ priv-

ileged?(pe, priv′)

then write_data (pm_phy, pag-

ing_data_type

(lvl′)) (xlat_idx (lvl′,

base′, lin_a′), set_reference (pe, access′))

##

ok_result (is_leaf?(pe), base(pe))

else raise_fault (priv′,

access′, true, lin_a′)

en-

dif

else raise_fault (priv′,

access′, false, lin_a′)

endif else fatal_result endif)))),

addr_set)

1640

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -21 with the terms: (s!1 s!2), Simplifying, rewriting, and recording with decision procedures,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.1.

translate_unchanged_pm_phy_except_pe.1.2:

{-1} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states

{-5} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-11} Mem?(lin_a′`type_of)
{-12} 0 ≤ lin_a′`offset
{-13} lin_a′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-15} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-16} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(read_data(pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx

(lvl′, base′, lin_a′)))),

addr_set)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx

(lvl′, base′, lin_a′))

##

(λ (pe: (range_pt(lvl′))):

if pag-

ing_type?(lvl′, pe)

then if present?(pe) then if ac-

cessible?

(pe, access′) ∧ priv-

ileged?(pe, priv′)

then write_data (pm_phy, pag-

ing_data_type

(lvl′)) (xlat_idx (lvl′,

base′, lin_a′), set_reference (pe, access′))

##

ok_result (is_leaf?(pe), base(pe))

else raise_fault (priv′,

access′, true, lin_a′)

en-

dif

else raise_fault (priv′,

access′, false, lin_a′)

endif else fatal_result endif)))),

addr_set)

1642

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma plain_memory_unchanged_memory_invariant_read_data[Physical_memory, (range_pt(lvl′))], Using lemma unchanged_memory_invariant_mono, Expanding the definition of in_blessed_memory?, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using paging_data_type_size, matching in *, Simplifying, rewriting, and recording with decision procedures, Keeping (-15 3) and hiding *, Rewriting using subset_transitive, matching in * where a gets address_block(xlat_idx(lvl!1, base!1,

lin_a!1), expt(2, pe_size)), b gets pm_phy‘rw_addr, c gets union(pm_phy‘ro_addr, pm_phy‘rw_addr), Rewriting using union_subset3, matching in *,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.2.

translate_unchanged_pm_phy_except_pe.1.3:

{-1} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states

{-5} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-11} Mem?(lin_a′`type_of)
{-12} 0 ≤ lin_a′`offset
{-13} lin_a′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-15} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-16} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} ∀ (d:

(λ (p: (range_pt(lvl′))):

∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s))

⊃

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(p, Write))): unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

if paging_type?(lvl′, d) then if present?(d)

then if accessible?(d, access′) ∧

privileged?(d, priv′) then singleton(expr_2_super

(write_data (pm_phy, pag-

ing_data_type(lvl′))

(xlat_idx (lvl′, base′, lin_a′), set_reference(d, access′))

##

ok_result

(is_leaf?(d), base(d))))

else singleton(expr_2_super

(raise_fault (priv′,

access′, true, lin_a′)))

endif else singleton(expr_2_super(raise_fault

(priv′, access′, false, lin_a′)))

endif else singleton(expr_2_super(fatal_result)) endif, addr_set)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx

(lvl′, base′, lin_a′))

##

(λ (pe: (range_pt(lvl′))):

if pag-

ing_type?(lvl′, pe)

then if present?(pe) then if ac-

cessible?

(pe, access′) ∧ priv-

ileged?(pe, priv′)

then write_data (pm_phy, pag-

ing_data_type

(lvl′)) (xlat_idx (lvl′,

base′, lin_a′), set_reference (pe, access′))

##

ok_result (is_leaf?(pe), base(pe))

else raise_fault (priv′,

access′, true, lin_a′)

en-

dif

else raise_fault (priv′,

access′, false, lin_a′)

endif else fatal_result endif)))),

addr_set)

1644

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 5 subgoals:

translate_unchanged_pm_phy_except_pe.1.3.1:

{-1} range_pt(lvl′)(d′)

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s)) ⊃ set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(d′, Write)

{-3} paging_type?(lvl′, d′)
{-4} present?(d′)
{-5} accessible?(d′, access′)
{-6} privileged?(d′, priv′)
{-7} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-8} is_linear_plain_memory?(pm′)
{-9} plain_memory?(pm_phy)
{-10} pm′`states = pm_phy`states

{-11} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-12} lvl′ < max_level
{-13} Mem?(base′`type_of)
{-14} 0 ≤ base′`offset
{-15} base′`offset < max_linear_offset
{-16} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-17} Mem?(lin_a′`type_of)
{-18} 0 ≤ lin_a′`offset
{-19} lin_a′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-21} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-22} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-23} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx (lvl′, base′, lin_a′), set_reference(d′, access′))

##

ok_result(is_leaf?(d′),

base(d′)))),

addr_set)

Using lemma plain_memory_unchanged_composition[Physical_memory, Unit, [bool, Address]], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

we get 3 subgoals:

translate_unchanged_pm_phy_except_pe.1.3.1.1:

{-1} plain_memory?(pm_phy)
{-2} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx (lvl′, base′, lin_a′), set_reference(d′, access′))

##

(λ (u: Unit): ok_result

[Physical_memory, [bool, Ad-

dress]]

(is_leaf?(d′), base(d′))))),

addr_set)

{-4} range_pt(lvl′)(d′)

{-5} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s)) ⊃ set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(d′, Write)

{-6} paging_type?(lvl′, d′)
{-7} present?(d′)
{-8} accessible?(d′, access′)
{-9} privileged?(d′, priv′)
{-10} is_linear_plain_memory?(pm′)
{-11} pm′`states = pm_phy`states

{-12} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-13} lvl′ < max_level
{-14} Mem?(base′`type_of)
{-15} 0 ≤ base′`offset
{-16} base′`offset < max_linear_offset
{-17} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-18} Mem?(lin_a′`type_of)
{-19} 0 ≤ lin_a′`offset
{-20} lin_a′`offset < max_linear_offset
{-21} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-22} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-23} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-24} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx (lvl′, base′, lin_a′), set_reference(d′, access′))

##

ok_result(is_leaf?(d′),

base(d′)))),

addr_set)

1648

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of ##, Expanding the definition of ##, which is trivially true.

This completes the proof of translate_unchanged_pm_phy_except_pe.1.3.1.1.

translate_unchanged_pm_phy_except_pe.1.3.1.2:

{-1} plain_memory?(pm_phy)
{-2} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} range_pt(lvl′)(d′)

{-4} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s)) ⊃ set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(d′, Write)

{-5} paging_type?(lvl′, d′)
{-6} present?(d′)
{-7} accessible?(d′, access′)
{-8} privileged?(d′, priv′)
{-9} is_linear_plain_memory?(pm′)
{-10} pm′`states = pm_phy`states

{-11} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-12} lvl′ < max_level
{-13} Mem?(base′`type_of)
{-14} 0 ≤ base′`offset
{-15} base′`offset < max_linear_offset
{-16} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-17} Mem?(lin_a′`type_of)
{-18} 0 ≤ lin_a′`offset
{-19} lin_a′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-21} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-22} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-23} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} ∀ (d: (λ (u: Unit): true)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(ok_result

[Physical_memory, [bool, Ad-

dress]]

(is_leaf?(d′), base(d′)))),

addr_set)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx (lvl′, base′, lin_a′), set_reference(d′, access′))

##

ok_result(is_leaf?(d′),

base(d′)))),

addr_set)

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.3.1.2.

translate_unchanged_pm_phy_except_pe.1.3.1.3:

{-1} plain_memory?(pm_phy)
{-2} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-3} range_pt(lvl′)(d′)

{-4} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s)) ⊃ set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(d′, Write)

{-5} paging_type?(lvl′, d′)
{-6} present?(d′)
{-7} accessible?(d′, access′)
{-8} privileged?(d′, priv′)
{-9} is_linear_plain_memory?(pm′)
{-10} pm′`states = pm_phy`states

{-11} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-12} lvl′ < max_level
{-13} Mem?(base′`type_of)
{-14} 0 ≤ base′`offset
{-15} base′`offset < max_linear_offset
{-16} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-17} Mem?(lin_a′`type_of)
{-18} 0 ≤ lin_a′`offset
{-19} lin_a′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-21} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-22} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-23} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx (lvl′, base′, lin_a′), set_reference (d′, access′)))),

addr_set)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(write_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx (lvl′, base′, lin_a′), set_reference(d′, access′))

##

ok_result(is_leaf?(d′),

base(d′)))),

addr_set)

1652

Hiding formulas: 2, Replacing using formula -10, Using lemma plain_memory_unchanged_memory_invariant_write_data, Expanding the definition of in_blessed_memory?, Rewriting using paging_data_type_size, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.3.1.3.
translate_unchanged_pm_phy_except_pe.1.3.2:

{-1} range_pt(lvl′)(d′)

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s)) ⊃ set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(d′, Write)

{-3} paging_type?(lvl′, d′)
{-4} present?(d′)
{-5} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-6} is_linear_plain_memory?(pm′)
{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states

{-9} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-10} lvl′ < max_level
{-11} Mem?(base′`type_of)
{-12} 0 ≤ base′`offset
{-13} base′`offset < max_linear_offset
{-14} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-15} Mem?(lin_a′`type_of)
{-16} 0 ≤ lin_a′`offset
{-17} lin_a′`offset < max_linear_offset
{-18} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-19} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-20} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-21} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} privileged?(d′, priv′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(raise_fault(priv′, access′, true, lin_a′))),

addr_set)

Using lemma raise_fault_unchanged_memory_invariant, Using lemma unchanged_memory_invariant_mono, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.3.2.
translate_unchanged_pm_phy_except_pe.1.3.3:

{-1} range_pt(lvl′)(d′)

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s)) ⊃ set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(d′, Write)

{-3} paging_type?(lvl′, d′)
{-4} present?(d′)
{-5} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-6} is_linear_plain_memory?(pm′)
{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states

{-9} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-10} lvl′ < max_level
{-11} Mem?(base′`type_of)
{-12} 0 ≤ base′`offset
{-13} base′`offset < max_linear_offset
{-14} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-15} Mem?(lin_a′`type_of)
{-16} 0 ≤ lin_a′`offset
{-17} lin_a′`offset < max_linear_offset
{-18} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-19} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-20} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-21} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} accessible?(d′, access′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(raise_fault(priv′, access′, true, lin_a′))),

addr_set)

Using lemma raise_fault_unchanged_memory_invariant, Using lemma unchanged_memory_invariant_mono, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.3.3.
translate_unchanged_pm_phy_except_pe.1.3.4:

{-1} range_pt(lvl′)(d′)

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s)) ⊃ set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(d′, Write)

{-3} paging_type?(lvl′, d′)
{-4} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-5} is_linear_plain_memory?(pm′)
{-6} plain_memory?(pm_phy)
{-7} pm′`states = pm_phy`states

{-8} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-9} lvl′ < max_level
{-10} Mem?(base′`type_of)
{-11} 0 ≤ base′`offset
{-12} base′`offset < max_linear_offset
{-13} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-14} Mem?(lin_a′`type_of)
{-15} 0 ≤ lin_a′`offset
{-16} lin_a′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-18} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-19} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-20} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} present?(d′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(raise_fault(priv′, access′, false, lin_a′))),

addr_set)

Using lemma raise_fault_unchanged_memory_invariant,

Using lemma unchanged_memory_invariant_mono,

Rewriting using subset_reflexive, matching in *,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.3.4.

translate_unchanged_pm_phy_except_pe.1.3.5:

{-1} range_pt(lvl′)(d′)

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s)) ⊃ set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s)),

Write)

= set_reference(d′, Write)

{-3} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-4} is_linear_plain_memory?(pm′)
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states

{-7} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-8} lvl′ < max_level
{-9} Mem?(base′`type_of)
{-10} 0 ≤ base′`offset
{-11} base′`offset < max_linear_offset
{-12} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-13} Mem?(lin_a′`type_of)
{-14} 0 ≤ lin_a′`offset
{-15} lin_a′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-17} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-18} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-19} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} paging_type?(lvl′, d′)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, single-

ton(expr_2_super(fatal_result)), addr_set)

Keeping (2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.3.5.

translate_unchanged_pm_phy_except_pe.1.4:

{-1} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′)
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states

{-5} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-11} Mem?(lin_a′`type_of)
{-12} 0 ≤ lin_a′`offset
{-13} lin_a′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-15} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-16} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} ∀ (pe: (range_pt(lvl′))):

accessible?(pe, access′) ∧

privileged?(pe, priv′) ∧ present?(pe) ∧ paging_type?(lvl′, pe)

⊃ range_pt(lvl′)(set_reference(pe, access′))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy,

pag-

ing_data_type(lvl′))

(xlat_idx

(lvl′, base′, lin_a′))

##

(λ (pe: (range_pt(lvl′))):

if pag-

ing_type?(lvl′, pe)

then if present?(pe) then if ac-

cessible?

(pe, access′) ∧ priv-

ileged?(pe, priv′)

then write_data (pm_phy, pag-

ing_data_type

(lvl′)) (xlat_idx (lvl′,

base′, lin_a′), set_reference (pe, access′))

##

ok_result (is_leaf?(pe), base(pe))

else raise_fault (priv′,

access′, true, lin_a′)

en-

dif

else raise_fault (priv′,

access′, false, lin_a′)

endif else fatal_result endif)))),

addr_set)

1657

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of translate_unchanged_pm_phy_except_pe.1.4.
translate_unchanged_pm_phy_except_pe.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states

{-4} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)))

= addr_set

{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-10} Mem?(lin_a′`type_of)
{-11} 0 ≤ lin_a′`offset
{-12} lin_a′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-14} (address_block(xlat_idx(lvl′, base′, lin_a′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-15} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s_{2})),

Write)

{1} (addr_set⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(lvl′,

base′,
lin_a′,
access′,
priv′))),

addr_set)

Replacing using formula -4,

Rewriting using difference_subset, matching in *,

This completes the proof of translate_unchanged_pm_phy_except_pe.2.

Q.E.D.

C.117.33 Linear_Memory_Properties.translate_result_ok_TCC1

Terse proof for translate_result_ok_TCC1.

translate_result_ok_TCC1:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s_{1}, s_{2}: (pm`states),

base: PTab_Address[Physical_memory, pm_phy], lin_a: Memory_Address_4G): is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(lin_a) ⊃ Mem?(xlat_idx[Physical_memory, pm_phy](lvl, base, lin_a)`type_of) ∧ 0 ≤ xlat_idx[Physical_memory, pm_phy](lvl, base, lin_a)`offset ∧ xlat_idx[Physical_memory, pm_phy](lvl, base, lin_a)`offset < max_linear_offset

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: (Mem! max_linear! <!) Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_ok_TCC1.

Q.E.D.

C.117.34 Linear_Memory_Properties.translate_result_ok

Terse proof for translate_result_ok.
translate_result_ok:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s_{1}, s_{2}: (pm`states), base: PTab_Address, lin_a: Memory_Address_4G, access: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧

is_linear_plain_memory?(pm) ∧

pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl)

(xlat_idx(lvl, base, lin_a))

∧ OK?(translate(lvl, base, lin_a, access, priv)(s_{1})) ⊃ OK?(translate(lvl, base, lin_a, access, priv)(s_{2}))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Hiding formulas: (-13 -14 -15 -16), Expanding the definition of ##, Expanding the definition of raise_fault, Expanding the definition of exception_result, Expanding the definition of fatal_result, Expanding the definition of ##, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -15 with the terms: (s1!1 s2!1 lvl!1 xlat_idx(lvl!1, base!1, lin_a!1)), Instantiating the top quantifier in -13 with the terms: (s1!1 s2!1), Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -15 with the terms: (s2!1 lvl!1 xlat_idx(lvl!1, base!1, lin_a!1)), we get 2 subgoals:

translate_result_ok.1:

{-1} lvl′ < max_level
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-8} Mem?(lin_a′`type_of)
{-9} 0 ≤ lin_a′`offset
{-10} lin_a′`offset < max_linear_offset
{-11} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-12} pm′`mem = linear_pm

{-13} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-15} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-16} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-17} plain_memory?(pm_phy)
{-18} pm′`states = pm_phy`states
{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-24} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-25} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-26} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-27} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-28} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-29} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?((read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif))

(s′_{2}))

1660

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of ##, Using lemma set_reference_present, Using lemma set_reference_base, Using lemma set_reference_accessible, Using lemma set_reference_privileged, Using lemma set_reference_leaf, Using lemma set_reference_paging_type, Case splitting on OK?(write_data(pm_phy, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, lin_a!1),

set_reference(data(read_data (pm_phy, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, lin_a!1)) (s2!1)), access!1)) (state(read_data(pm_phy, paging_data_type(lvl!1)) (xlat_idx(lvl!1, base!1, lin_a!1)) (s2!1)))),

we get 4 subgoals:

translate_result_ok.1.1:

{-1} OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

= privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

= accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

= base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-7} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-8} lvl′ < max_level
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} Mem?(base′`type_of)
{-12} 0 ≤ base′`offset
{-13} base′`offset < max_linear_offset
{-14} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-15} Mem?(lin_a′`type_of)
{-16} 0 ≤ lin_a′`offset
{-17} lin_a′`offset < max_linear_offset
{-18} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-19} pm′`mem = linear_pm

{-20} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-22} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-23} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-24} plain_memory?(pm_phy)
{-25} pm′`states = pm_phy`states
{-26} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-27} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-28} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-29} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-30} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-31} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-32} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-33} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-34} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-35} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-36} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?(cases read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}) of

OK(state, data):

if paging_type?(lvl′, data) then if present?(data)

then if accessible?(data, access′) ∧ privileged?(data, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(data, access′))

## ok_result(is_leaf?(data), base(data))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif

(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

1662

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Installing automatic rewrites from: ## ok_result Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of translate_result_ok.1.1.

translate_result_ok.1.2:

{-1} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

= privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

= accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

= base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-7} lvl′ < max_level
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} Mem?(base′`type_of)
{-11} 0 ≤ base′`offset
{-12} base′`offset < max_linear_offset
{-13} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-14} Mem?(lin_a′`type_of)
{-15} 0 ≤ lin_a′`offset
{-16} lin_a′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-18} pm′`mem = linear_pm

{-19} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-22} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-23} plain_memory?(pm_phy)
{-24} pm′`states = pm_phy`states
{-25} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-26} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-27} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-28} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-29} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-30} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-31} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-32} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-33} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-34} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-35} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

{2} OK?(cases read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}) of

OK(state, data):

if paging_type?(lvl′, data) then if present?(data)

then if accessible?(data, access′) ∧ privileged?(data, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(data, access′))

## ok_result(is_leaf?(data), base(data))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif

(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

1664

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma plain_memory_write_data_ok, Case splitting on in_blessed_memory?(paging_data_type(lvl!1), xlat_idx(lvl!1, base!1, lin_a!1),

pm_phy‘rw_addr), we get 2 subgoals:

translate_result_ok.1.2.1:

{-1} in_blessed_memory?(paging_data_type(lvl′), xlat_idx(lvl′, base′, lin_a′), pm_phy`rw_addr)

{-2} plain_memory?(pm_phy) ∧

pm_phy`states

(state(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

∧ in_blessed_memory?(paging_data_type(lvl′), xlat_idx(lvl′, base′, lin_a′),

pm_phy`rw_addr)

⊃ OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

= privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

= accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-7} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

= base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-8} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-9} lvl′ < max_level
{-10} pm′`states(s′_{1})
{-11} pm′`states(s′_{2})
{-12} Mem?(base′`type_of)
{-13} 0 ≤ base′`offset
{-14} base′`offset < max_linear_offset
{-15} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-16} Mem?(lin_a′`type_of)
{-17} 0 ≤ lin_a′`offset
{-18} lin_a′`offset < max_linear_offset
{-19} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-20} pm′`mem = linear_pm

{-21} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-22} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-23} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-24} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-25} plain_memory?(pm_phy)
{-26} pm′`states = pm_phy`states
{-27} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-28} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-29} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-30} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-31} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-32} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-33} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-34} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-35} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-36} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-37} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

1666

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma plain_memory_transformer_invariant_read_data, Using lemma expr_transformer_invariant_next_ok, Expanding the definition of singleton, Installing automatic rewrites from: has_next_state in_blessed_memory_rw_ro Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_ok.1.2.1.

translate_result_ok.1.2.2:

{-1} plain_memory?(pm_phy) ∧

pm_phy`states

(state(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

∧ in_blessed_memory?(paging_data_type(lvl′), xlat_idx(lvl′, base′, lin_a′),

pm_phy`rw_addr)

⊃ OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

= privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

= accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

= base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-7} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-8} lvl′ < max_level
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} Mem?(base′`type_of)
{-12} 0 ≤ base′`offset
{-13} base′`offset < max_linear_offset
{-14} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-15} Mem?(lin_a′`type_of)
{-16} 0 ≤ lin_a′`offset
{-17} lin_a′`offset < max_linear_offset
{-18} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-19} pm′`mem = linear_pm

{-20} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-22} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-23} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-24} plain_memory?(pm_phy)
{-25} pm′`states = pm_phy`states
{-26} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-27} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-28} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-29} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-30} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-31} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-32} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-33} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-34} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-35} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-36} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} in_blessed_memory?(paging_data_type(lvl′), xlat_idx(lvl′, base′, lin_a′), pm_phy`rw_addr)

{2} OK?(write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)) (state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))))

1668

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of in_blessed_memory?, Rewriting using paging_data_type_size, matching in *, Hiding formulas: (-1 -2 -3 -4 -5 -6 -7 2), Using lemma pe_in_pt_address_in_pt, Using lemma subset_ptab_address_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -24 with the terms: (s1!1), Expanding the definition of linear_blessed?, which is trivially true.

This completes the proof of translate_result_ok.1.2.2.

translate_result_ok.1.3:

{-1} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

= privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

= accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

= base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-7} lvl′ < max_level
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} Mem?(base′`type_of)
{-11} 0 ≤ base′`offset
{-12} base′`offset < max_linear_offset
{-13} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-14} Mem?(lin_a′`type_of)
{-15} 0 ≤ lin_a′`offset
{-16} lin_a′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-18} pm′`mem = linear_pm

{-19} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-22} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-23} plain_memory?(pm_phy)
{-24} pm′`states = pm_phy`states
{-25} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-26} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-27} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-28} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-29} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-30} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-31} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-32} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-33} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-34} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-35} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} range_pt(lvl′)

(set_reference(data[Physical_memory, ((range_pt(lvl′)))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm_phy, paging_data_type(lvl′)) (xlat_idx[Physical_memory, pm_phy](lvl′, base′, lin_a′)) (s′_{2})),

access′))

{2} OK?(cases read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}) of

OK(state, data):

if paging_type?(lvl′, data) then if present?(data)

then if accessible?(data, access′) ∧ privileged?(data, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(data, access′))

## ok_result(is_leaf?(data), base(data))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif

(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

1670

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Rewriting using set_reference_range, matching in *,

This completes the proof of translate_result_ok.1.3.

translate_result_ok.1.4:

{-1} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-2} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-3} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

= privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

priv′)

{-4} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

= accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

access′)

{-5} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

∧ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

⊃ base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

= base(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2})))

{-6} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

⊃ present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

= present?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})))

{-7} lvl′ < max_level
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} Mem?(base′`type_of)
{-11} 0 ≤ base′`offset
{-12} base′`offset < max_linear_offset
{-13} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-14} Mem?(lin_a′`type_of)
{-15} 0 ≤ lin_a′`offset
{-16} lin_a′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-18} pm′`mem = linear_pm

{-19} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

= pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-21} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{2}))

{-22} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

= set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-23} plain_memory?(pm_phy)
{-24} pm′`states = pm_phy`states
{-25} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-26} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-27} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-28} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-29} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-30} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-31} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-32} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-33} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-34} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-35} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} OK?[Physical_memory, (range_pt(lvl′))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm_phy, paging_data_type(lvl′)) (xlat_idx[Physical_memory, pm_phy](lvl′, base′, lin_a′))(s′_{2}))

∨ Exception?[Physical_memory, (range_pt(lvl′))]

(read_data[Physical_memory, ((range_pt(lvl′)))] (pm_phy, paging_data_type(lvl′)) (xlat_idx[Physical_memory, pm_phy](lvl′, base′, lin_a′))(s′_{2}))

{2} OK?(cases read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{2}) of

OK(state, data):

if paging_type?(lvl′, data) then if present?(data)

then if accessible?(data, access′) ∧ privileged?(data, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(data, access′))

## ok_result(is_leaf?(data), base(data))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif

(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

1672

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_ok.1.4.

translate_result_ok.2:

{-1} lvl′ < max_level
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} Mem?(base′`type_of)
{-5} 0 ≤ base′`offset
{-6} base′`offset < max_linear_offset
{-7} aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)(offset(base′))
{-8} Mem?(lin_a′`type_of)
{-9} 0 ≤ lin_a′`offset
{-10} lin_a′`offset < max_linear_offset
{-11} union(pm′`ro_addr, pm′`rw_addr)(lin_a′)
{-12} pm′`mem = linear_pm

{-13} pe_in_pdir_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} pe_in_ptab_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-15} set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{2})),

Write)

{-16} plain_memory?(pm_phy)
{-17} pm′`states = pm_phy`states
{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl′)

(xlat_idx(lvl′, base′, lin_a′))

{-23} OK?(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))

{-24} paging_type?(lvl′,

data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))

{-25} present?(data(read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′))

(s′_{1})))

{-26} accessible?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′)

{-27} privileged?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

priv′)

{-28} OK?((write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′),

set_reference(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})),

access′))

##

ok_result(is_leaf?(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))),

base(data(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1})))))

(state(read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′))(s′_{1}))))

{1} pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{2}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

lvl′) (xlat_idx[Physical_memory, pm_phy](lvl′, base′, lin_a′))

{2} OK?((read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, lin_a′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, lin_a′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, lin_a′)

endif else raise_fault(priv′, access′, false, lin_a′) endif else fatal_result endif))

(s′_{2}))

1674

Expanding the definition of pe_in_pt_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of translate_result_ok.2. Q.E.D.

C.117.35 Linear_Memory_Properties.translate_result_as_read_TCC1

Terse proof for translate_result_as_read_TCC1.
translate_result_as_read_TCC1:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s: Lin-

ear_memory[Physical_memory, pm_phy], base: PTab_Address[Physical_memory, pm_phy], lin_a: Memory_Address_4G, access: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ OK?(translate(lvl, base, lin_a, access, priv)(s)) ⊃ (∀ (res: ExprResult[Physical_memory, ((range_pt(lvl)))]):

res = read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))(s) ⊃ OK?[Physical_memory, ((range_pt(lvl)))](res))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_as_read_TCC1.

Q.E.D.

C.117.36 Linear_Memory_Properties.translate_result_as_read_TCC2

Terse proof for translate_result_as_read_TCC2.
translate_result_as_read_TCC2:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s: Lin-

ear_memory[Physical_memory, pm_phy], base: PTab_Address[Physical_memory, pm_phy], lin_a: Memory_Address_4G, access: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ OK?(translate(lvl, base, lin_a, access, priv)(s)) ⊃ (∀ (res: ExprResult[Physical_memory, ((range_pt(lvl)))]):

res = read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))(s) ⊃ present?(data[Physical_memory, ((range_pt(lvl)))](res)))

Repeatedly Skolemizing and flattening, Hiding formulas: -10, Expanding the definition of translate, Installing automatic rewrites from: ( ##! raise_fault! fatal_result! exception_result!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_as_read_TCC2.

Q.E.D.

C.117.37 Linear_Memory_Properties.translate_result_as_read

Terse proof for translate_result_as_read.
translate_result_as_read:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s: Lin-

ear_memory[Physical_memory, pm_phy],

base: PTab_Address, lin_a: Memory_Address_4G, access: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ OK?(translate(lvl, base, lin_a, access, priv)(s)) ⊃ let res = read_data(pm_phy, paging_data_type(lvl))(xlat_idx(lvl, base, lin_a))(s) in

data(translate(lvl, base, lin_a, access, priv)(s)) =

(is_leaf?(data(res)), base(data(res)))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res! ok_result! fatal_result!

raise_fault! exception_result!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_result_as_read.

Q.E.D.

C.117.38 Linear_Memory_Properties.translate_same_result

Terse proof for translate_same_result.
translate_same_result:

{1} ∀ (lvl: Level, pm: Plain_Memory[Linear_memory], s_{1}, s_{2}: (pm`states), base: PTab_Address,

lin_a: Memory_Address_4G, ac1, ac2: Memory_access, priv: Memory_privilege):

union(pm`ro_addr, pm`rw_addr)(lin_a) ∧ is_linear_plain_memory?(pm) ∧ pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), lvl)

(xlat_idx(lvl, base, lin_a))

∧

OK?(translate(lvl, base, lin_a, ac1, priv)(s_{1})) ∧ OK?(translate(lvl, base, lin_a, ac2, priv)(s_{2}))

⊃

data(translate(lvl, base, lin_a, ac1, priv)(s_{1})) = data(translate(lvl, base, lin_a, ac2, priv)(s_{2}))

Repeatedly Skolemizing and flattening, Using lemma translate_result_as_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma translate_result_as_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of is_linear_plain_memory?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -9 with the terms: (s1!1 s2!1 lvl!1 xlat_idx(lvl!1, base!1, lin_a!1)), Using lemma set_reference_leaf, Using lemma set_reference_base, Using lemma set_reference_present, Keeping (-1 -2 -3 -12 -19 -20 -21 -22 1) and hiding *, Replacing using formula -6, Replacing using formula -8, Hiding formulas: (-6 -8), Expanding the definition of translate, Installing automatic rewrites from: ( ##! expr_2_super! raise_fault! expr_2_super_res! excep-

tion_result! ok_result! fatal_result!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of translate_same_result. Q.E.D.

C.117.39 Linear_Memory_Properties.xlat_pe_in_pdir_range_TCC1

Terse proof for xlat_pe_in_pdir_range_TCC1.
xlat_pe_in_pdir_range_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ pdir_lvl[Physical_memory, pm_phy] < max_level

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC1.

Q.E.D.

C.117.40 Linear_Memory_Properties.xlat_pe_in_pdir_range_TCC2

Terse proof for xlat_pe_in_pdir_range_TCC2.
xlat_pe_in_pdir_range_TCC2:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{2}))

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Instantiating quantified variables,

This completes the proof of xlat_pe_in_pdir_range_TCC2.

Q.E.D.

C.117.41 Linear_Memory_Properties.xlat_pe_in_pdir_range_TCC3

Terse proof for xlat_pe_in_pdir_range_TCC3.

xlat_pe_in_pdir_range_TCC3:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

addr)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

addr)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

addr)`offset < max_linear_offset

Installing automatic rewrites from: (bits_per_level pe_size Mem max_linear < max_level)

Repeatedly Skolemizing and flattening,

Case splitting on OK?[Physical_memory, Pdbr_type] (read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s2!1)),

we get 2 subgoals:

xlat_pe_in_pdir_range_TCC3.1:

{-1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_idx_memory_address,

we get 2 subgoals:

xlat_pe_in_pdir_range_TCC3.1.1:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr))

⊃

xlat_idx(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)

< max_linear

{-2} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_idx_memory_address2,

we get 2 subgoals:

xlat_pe_in_pdir_range_TCC3.1.1.1:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr))

⊃ 0 ≤ offset

(xlat_idx(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′))

{-2} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr))

⊃

xlat_idx(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)

< max_linear

{-3} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

1681

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC3.1.1.1.
xlat_pe_in_pdir_range_TCC3.1.1.2:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr))

⊃

xlat_idx(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)

< max_linear

{-2} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{1} pdir_lvl[Physical_memory, pm_phy] < 2

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_pe_in_pdir_range_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC3.1.1.2.

xlat_pe_in_pdir_range_TCC3.1.2:

{-1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})
{1} pdir_lvl[Physical_memory, pm_phy] < 2

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_pe_in_pdir_range_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC3.1.2.

xlat_pe_in_pdir_range_TCC3.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{2}))

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr,

addr′)`offset < max_linear_offset

Using lemma xlat_pe_in_pdir_range_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range_TCC3.2.

Q.E.D.

C.117.42 Linear_Memory_Properties.xlat_pe_in_pdir_range

Terse proof for xlat_pe_in_pdir_range.

xlat_pe_in_pdir_range:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Lin- ear_memory): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ pe_in_pdir_range?(s_{1}, restrict[Address, Memory_Address_4G, boolean] ((pm‘ro_addr∪ pm‘rw_addr))) (xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR) (s_{2}))`base_addr, addr))

Repeatedly Skolemizing and flattening, Expanding the definition of pe_in_pdir_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

xlat_pe_in_pdir_range.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{1} ∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))): xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

lin_a)

=

xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr, addr′)

Instantiating the top quantifier in 1 with the terms: (addr!1), we get 2 subgoals:

xlat_pe_in_pdir_range.1.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{1} xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′) = xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{2}))`base_addr, addr′)

Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -9 with the terms: (s1!1 s2!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pdir_range.1.1.
xlat_pe_in_pdir_range.1.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})
{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(addr′)

Expanding the definition of restrict, which is trivially true.

This completes the proof of xlat_pe_in_pdir_range.1.2.
xlat_pe_in_pdir_range.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})
{1} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))

Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, This completes the proof of xlat_pe_in_pdir_range.2. Q.E.D.

C.117.43 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC1

Terse proof for xlat_pe_in_pt_range_TCC1.
xlat_pe_in_pt_range_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

pm`states(s_{2}) ∧ pm`states(s_{1}) ∧ is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{1})) ∨ Exception?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Instantiating quantified variables,

This completes the proof of xlat_pe_in_pt_range_TCC1.

Q.E.D.

C.117.44 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC2

Terse proof for xlat_pe_in_pt_range_TCC2.
xlat_pe_in_pt_range_TCC2:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]):

pm`states(s_{2}) ∧

pm`states(s_{1}) ∧ is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s_{1}))

Repeatedly Skolemizing and flattening, Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables,

This completes the proof of xlat_pe_in_pt_range_TCC2.

Q.E.D.

C.117.45 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC3

Terse proof for xlat_pe_in_pt_range_TCC3.
xlat_pe_in_pt_range_TCC3:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem-

ory_access,

priv: Memory_privilege, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`1

⊃ ptab_lvl[Physical_memory, pm_phy] < max_level

Repeatedly Skolemizing and flattening, Keeping (2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC3.

Q.E.D.

C Proof scripts

C.117.46 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC4

Terse proof for xlat_pe_in_pt_range_TCC4.

xlat_pe_in_pt_range_TCC4:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem-

ory_access,

priv: Memory_privilege, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))

∧ ¬ data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`1

⊃ Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2`offset

∧ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2`offset

< max_linear_offset

C Proof scripts

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: Mem max_linear < bits_per_level pe_size max_level Using lemma xlat_pe_in_pt_range_TCC2, Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Using lemma translate_result_no_leaf, Using lemma translate_memory_address, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC4.

Q.E.D.

C.117.47 Linear_Memory_Properties.xlat_pe_in_pt_range_TCC5

Terse proof for xlat_pe_in_pt_range_TCC5.

xlat_pe_in_pt_range_TCC5:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem-

ory_access,

priv: Memory_privilege, s_{1}, s_{2}: Linear_memory[Physical_memory, pm_phy]): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))

∧ ¬ data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`1

⊃ Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2,

addr)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2,

addr)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

addr, access, priv) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`2,

addr)`offset < max_linear_offset

1691 C Proof scripts

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: Mem max_linear < bits_per_level pe_size max_level Using lemma xlat_idx_memory_address, we get 3 subgoals:

xlat_pe_in_pt_range_TCC5.1:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃

xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

< max_linear

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})

{-9} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1693 C Proof scripts

Using lemma xlat_idx_memory_address2,

we get 3 subgoals:

xlat_pe_in_pt_range_TCC5.1.1:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃ 0 ≤ offset

(xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′))

{-2} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃ xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

< max_linear

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})

{-10} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1695 C Proof scripts

Using lemma translate_result_leaf, Using lemma translate_memory_address, Using lemma translate_memory_address2, Using lemma translate_result_no_leaf, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC5.1.1.

xlat_pe_in_pt_range_TCC5.1.2:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃ xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

< max_linear

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})

{-9} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`offset

∧ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`offset

< max_linear_offset

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1697 C Proof scripts

Using lemma translate_memory_address, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC5.1.2.

xlat_pe_in_pt_range_TCC5.1.3:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2))

⊃

xlat_idx(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

< max_linear

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})

{-9} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} ptab_lvl[Physical_memory, pm_phy] < 2

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1699 C Proof scripts

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC5.1.3.

xlat_pe_in_pt_range_TCC5.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{-8} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`offset

∧ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2`offset

< max_linear_offset

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy],

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1701 C Proof scripts

Using lemma translate_memory_address, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC5.2.

xlat_pe_in_pt_range_TCC5.3:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{-8} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} ptab_lvl[Physical_memory, pm_phy] < 2

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} Mem?(xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(ptab_lvl[Physical_memory, pm_phy],

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)`offset < max_linear_offset

1703

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_pe_in_pt_range_TCC5.3.

Q.E.D.

C.117.48 Linear_Memory_Properties.xlat_pe_in_pt_range

Terse proof for xlat_pe_in_pt_range.
xlat_pe_in_pt_range:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem-

ory_access,

priv: Memory_privilege, s_{1}, s_{2}: Linear_memory): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr, addr, access, priv)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))))`1

⊃

pe_in_pt_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s_{1}))`base_addr,

addr, access, priv) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s_{1}))))`2,

addr))

Installing automatic rewrites from: (bits_per_level pe_size singleton has_next_state)

Repeatedly Skolemizing and flattening,

Expanding the definition of pe_in_pt_range?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

xlat_pe_in_pt_range.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{-8} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{-9} ptab_lvl = pdir_lvl

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

Keeping (-9) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.1.

xlat_pe_in_pt_range.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})

{-8} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

Copying formula number: -5

Expanding the definition of is_linear_plain_memory?,

Applying disjunctive simplification to flatten sequent,

Hiding formulas: (-1 -2 -3 -5 -7 -8),

Case splitting on OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s1!1)), pm!1‘states (state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s1!1))),

we get 3 subgoals:

xlat_pe_in_pt_range.2.1:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-4} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-8} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-9} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-10} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-11} Mem?(addr′`type_of)
{-12} 0 ≤ addr′`offset
{-13} addr′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-15} is_linear_plain_memory?(pm′)
{-16} pm′`states(s′_{1})
{-17} pm′`states(s′_{2})

{-18} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′)) 1707

C Proof scripts

Instantiating the top quantifier in -4 with the terms: (s2!1 state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s1!1))),

we get 2 subgoals:

xlat_pe_in_pt_range.2.1.1:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-4} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-8} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-9} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-10} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-11} Mem?(addr′`type_of)
{-12} 0 ≤ addr′`offset
{-13} addr′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-15} is_linear_plain_memory?(pm′)
{-16} pm′`states(s′_{1})
{-17} pm′`states(s′_{2})

{-18} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

1709 C Proof scripts

Applying disjunctive simplification to flatten sequent, Replacing using formula -5, Expanding the definition of pe_in_ptab_range?, Case splitting on pe_in_pdir_range?[Physical_memory, pm_phy] (state(read_data[Physical_memory,

Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s1!1)), restrict[Address, Memory_Address_4G, boolean] (union[Address](pm!1‘ro_addr, pm!1‘rw_addr))) (xlat_idx[Physical_memory, pm_phy] (pdir_lvl, data[Physical_memory, Pdbr_type] (read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s1!1))‘base_addr, addr!1)),

we get 3 subgoals:

xlat_pe_in_pt_range.2.1.1.1:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} ∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))`2,

addr′)

1711 C Proof scripts

Instantiating the top quantifier in 3 with the terms: (xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s1!1))‘base_addr, addr!1)),

we get 2 subgoals:

xlat_pe_in_pt_range.2.1.1.1.1:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} ∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl)) (xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))),

lin_a)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))`2,

addr′)

1713 C Proof scripts

Instantiating the top quantifier in 3 with the terms: (addr!1),

we get 2 subgoals:

xlat_pe_in_pt_range.2.1.1.1.1.1:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} OK?(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))),

addr′)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

1715

we get 3 subgoals:

xlat_pe_in_pt_range.2.1.1.1.1.1.1:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))),

addr′)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, priv′)

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`2,

addr′)

1717 C Proof scripts

Using lemma translate_result_as_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.2.1.1.1.1.1.1.

xlat_pe_in_pt_range.2.1.1.1.1.1.2:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′))

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))))

1719 C Proof scripts

Expanding the definition of translate, Installing automatic rewrites from: ( ##! fatal_result! raise_fault! exception_result! ok_result!) Expanding the definition of paging_type?, Expanding the definition of pdir_entry?, Expanding the definition of present?, Expanding the definition of is_leaf?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.2.1.1.1.1.1.2.

xlat_pe_in_pt_range.2.1.1.1.1.1.3:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{2} ptab_lvl = pdir_lvl

{3} OK?(read_data(pm_phy, paging_data_type(pdir_lvl))

(xlat_idx(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′))

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

1721 C Proof scripts

Keeping (-20 3) and hiding *, Expanding the definition of translate, Installing automatic rewrites from: ( ##! fatal_result! raise_fault! exception_result! ok_result!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.2.1.1.1.1.1.3.

xlat_pe_in_pt_range.2.1.1.1.1.2:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(addr′)

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

1723 C Proof scripts

Expanding the definition of restrict, which is trivially true.

This completes the proof of xlat_pe_in_pt_range.2.1.1.1.1.2.

xlat_pe_in_pt_range.2.1.1.1.2:

{-1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{-2} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-3} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-7} plain_memory?(pm_phy)
{-8} pm′`states = pm_phy`states
{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})

{-20} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})), restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

1725

C Proof scripts

which is trivially true.

This completes the proof of xlat_pe_in_pt_range.2.1.1.1.2.

xlat_pe_in_pt_range.2.1.1.2:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-4} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-6} plain_memory?(pm_phy)
{-7} pm′`states = pm_phy`states
{-8} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-9} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-10} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-11} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-12} Mem?(addr′`type_of)
{-13} 0 ≤ addr′`offset
{-14} addr′`offset < max_linear_offset
{-15} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-16} is_linear_plain_memory?(pm′)
{-17} pm′`states(s′_{1})
{-18} pm′`states(s′_{2})

{-19} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} pe_in_pdir_range?[Physical_memory, pm_phy]

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy]

(pdir_lvl,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

{4} ∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))`2,

addr′)

1727 C Proof scripts

Hiding formulas: 4, Using lemma xlat_pe_in_pdir_range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.2.1.1.2.

xlat_pe_in_pt_range.2.1.1.3:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-4} pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} (λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)(s′_{2})) ∧ pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde) (s′_{2}))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(s′_{2}))),

lin_a)

= phy_a)

=

(λ (phy_a: Memory_Address_4G):

∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

= phy_a)

{-6} plain_memory?(pm_phy)
{-7} pm′`states = pm_phy`states
{-8} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-9} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-10} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-11} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-12} Mem?(addr′`type_of)
{-13} 0 ≤ addr′`offset
{-14} addr′`offset < max_linear_offset
{-15} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-16} is_linear_plain_memory?(pm′)
{-17} pm′`states(s′_{1})
{-18} pm′`states(s′_{2})

{-19} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(pdir_lvl[Physical_memory, pm_phy], data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′)`offset < max_linear_offset

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

{4} ∃ (pde:

(pe_in_pdir_range?(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))))):

∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))): OK?(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type]

(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

pde_pt?(pdir(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))))

∧

xlat_idx(ptab_lvl,

base(data(read_data(pm_phy, paging_data_type(pdir_lvl))(pde)

(state(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))),

lin_a)

=

xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (s′_{1}))))`2,

addr′)

1729

Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Installing automatic rewrites from: max_linear < Mem <= min_linear Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_pe_in_pt_range.2.1.1.3.
xlat_pe_in_pt_range.2.1.2:

{-1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-7} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-8} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-9} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-10} Mem?(addr′`type_of)
{-11} 0 ≤ addr′`offset
{-12} addr′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-14} is_linear_plain_memory?(pm′)
{-15} pm′`states(s′_{1})
{-16} pm′`states(s′_{2})

{-17} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} pm′`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

{4} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

which is trivially true.

This completes the proof of xlat_pe_in_pt_range.2.1.2.

xlat_pe_in_pt_range.2.2:

{-1} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))
{-2} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-3} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-7} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-8} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-9} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-10} Mem?(addr′`type_of)
{-11} 0 ≤ addr′`offset
{-12} addr′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-14} is_linear_plain_memory?(pm′)
{-15} pm′`states(s′_{1})
{-16} pm′`states(s′_{2})

{-17} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} pm′`states

(state(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

{4} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′)) 1731

C Proof scripts

Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of xlat_pe_in_pt_range.2.2.

xlat_pe_in_pt_range.2.3:

{-1} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-2} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-6} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-7} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-8} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-9} Mem?(addr′`type_of)
{-10} 0 ≤ addr′`offset
{-11} addr′`offset < max_linear_offset
{-12} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-13} is_linear_plain_memory?(pm′)
{-14} pm′`states(s′_{1})
{-15} pm′`states(s′_{2})

{-16} OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{1} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))

{2} data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

{3} ptab_lvl = pdir_lvl

{4} pe_in_ptab_range?(s′_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, priv′) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))

Instantiating quantified variables, This completes the proof of xlat_pe_in_pt_range.2.3. Q.E.D.

C.117.49 Linear_Memory_Properties.linear_resolve_unchanged_pm_phy

Terse proof for linear_resolve_unchanged_pm_phy.
linear_resolve_unchanged_pm_phy:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

addr: Memory_Address_4G, access: Memory_access): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm`states,

singleton(expr_2_super[Physical_memory, Address](linear_resolve(addr, ac-

cess))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s, restrict [Address, Memory_Address_4G , boolean]((pm‘ro_addr∪ pm‘rw_addr))))))

Installing automatic rewrites from: plain_memory_unchanged_memory_ok_result Repeatedly Skolemizing and flattening, Letting addresses name difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr), extend[Address, Mem-

ory_Address_4G, bool, FALSE] (address_in_pt_range?(s!1, restrict [Address, Memory_Address_4G, boolean] (union (pm!1‘ro_addr, pm!1‘rw_addr))))),

Replacing using formula -1, Case splitting on subset?(addresses, union(pm_phy‘ro_addr, pm_phy‘rw_addr)), we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1:

{-1} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)

{1} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(addr′, access′))), addresses)

Expanding the definition of linear_resolve, Using lemma pm_plain_phy, Using lemma pm_states, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Installing automatic rewrites from: (has_next_state! max_level! bits_per_level! bus_width! pe_size!

singleton! <! Mem! max_linear!)

Copying formula number: -9 Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Installing automatic rewrites from: pdir_lvl!! ptab_lvl!!

Case splitting on FORALL (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool, base: {b: Memory_Address_4G | IF leaf THEN aligned?(-1 * (pdir_lvl[Physical_memory, pm_phy] * bits_per_level [Physical_memory, pm_phy]) - bits_per_level [Physical_memory, pm_phy] + bus_width) (offset(b)) ELSE aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size) (offset(b)) ENDIF}): NOT leaf IMPLIES (FORALL (x1: Physical_memory): every[Physical_memory, [bool, Address]] (LAMBDA (x: Physical_memory): TRUE, LAMBDA (t: [bool, Address]): Mem?(t‘2‘type_of) AND 0 <= t‘2‘offset AND t‘2‘offset < max_linear_offset) (translate[Physical_memory, pm_phy] (1, base, addr!1, access!1, segment_to_priv(cs))(x1))), FORALL (cs: Segment_Reg_type, pdbr: Pdbr_type): FORALL (x1: Physical_memory): every[Physical_memory, [bool, Address]] (LAMBDA (x: Physical_memory): TRUE, LAMBDA (t: [bool, Address]): Mem?(t‘2‘type_of) AND (0 <= t‘2‘offset AND t‘2‘offset < max_linear_offset) AND IF t‘1 THEN aligned?(22)(offset(t‘2)) ELSE aligned?(12)(offset(t‘2)) ENDIF) (translate[Physical_memory, pm_phy] (0, pdbr‘base_addr, addr!1, access!1, segment_to_priv(cs)) (x1)),

we get 5 subgoals:

linear_resolve_unchanged_pm_phy.1.1:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-3} pm′`mem = linear_pm
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-11} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-12} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-13} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-14} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-15} pm′`states = pm_phy`states
{-16} plain_memory?(pm_phy)
{-17} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-18} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm_phy`states(s′)

{1} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′)) else (translate(ptab_lvl,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(ptab_lvl, base_1, addr′))))

endif)))))))),

addresses)

1736

Rewriting using plain_memory_unchanged_composition [Physical_memory, Segment_Reg_type, Address], matching in * where P gets LAMBDA (t: Segment_Reg_type): FORALL (s: (pm!1‘states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) AND t = data(read_data(pm_phy, segment_reg_data_type)(CS)(s)),

we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.1:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-3} pm′`mem = linear_pm
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-11} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-12} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-13} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-14} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-15} pm′`states = pm_phy`states
{-16} plain_memory?(pm_phy)
{-17} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-18} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm_phy`states(s′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s_1)) ⊃

(∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧ data(read_data(pm_phy, segment_reg_data_type)(CS)(s_1)) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s)))

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(0, base, addr′)) else (translate(1,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(1, base_1, addr′))))

endif)))))))),

addresses)

1738

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Keeping (-7 -8 1) and hiding *, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.1.

linear_resolve_unchanged_pm_phy.1.1.2:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-3} pm′`mem = linear_pm
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-11} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-12} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-13} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-14} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-15} pm′`states = pm_phy`states
{-16} plain_memory?(pm_phy)
{-17} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-18} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(read_data(pm_phy, seg-

ment_reg_data_type)

(CS))),

addresses)

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(0, base, addr′)) else (translate(1,

base, addr′, access′, seg-

ment_to_priv(cs))

##

(λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(1, base_1, addr′))))

endif)))))))),

addresses)

1740

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma unchanged_memory_invariant_mono, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.2.

linear_resolve_unchanged_pm_phy.1.1.3:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-3} pm′`mem = linear_pm
{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-9} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-11} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-12} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-13} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-14} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-15} pm′`states = pm_phy`states
{-16} plain_memory?(pm_phy)
{-17} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-18} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm_phy`states(s′)

{1} ∀ (d:

(λ (t: Segment_Reg_type): ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧ t = data(read_data(pm_phy, segment_reg_data_type)(CS)(s)))):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)

(PDBR)

## (λ

(pdbr: Pdbr_type):

(translate (0,

pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf

then ok_result (xlat_ofs

(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))))),

addresses)

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(0, base, addr′)) else (translate(1,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(1, base_1, addr′))))

endif)))))))),

addresses)

1742

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using plain_memory_unchanged_composition[Physical_memory, Pdbr_type, Address],

matching in * where P gets LAMBDA (base: Pdbr_type): FORALL (s: (pm_phy‘states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) AND data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = base,

we get 5 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.1:

{-1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-4} pm′`mem = linear_pm
{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-12} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-13} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-14} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-15} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-16} pm′`states = pm_phy`states
{-17} plain_memory?(pm_phy)
{-18} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-19} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm_phy`states(s′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_1)) ⊃

(∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧ data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_1)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)(PDBR) ## (λ (pdbr: Pdbr_type): (translate (0,

pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf

then ok_result (xlat_ofs

(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))))),

addresses)

1744

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (-7 -8 1) and hiding *, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.1.

linear_resolve_unchanged_pm_phy.1.1.3.2:

{-1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-4} pm′`mem = linear_pm
{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-12} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-13} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-14} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-15} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-16} pm′`states = pm_phy`states
{-17} plain_memory?(pm_phy)
{-18} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-19} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(read_data(pm_phy, pdbr_data_type)

(PDBR))),

addresses)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)(PDBR) ## (λ (pdbr: Pdbr_type): (translate (0,

pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf

then ok_result (xlat_ofs

(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))))),

addresses)

1746

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Using lemma unchanged_memory_invariant_mono, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.2.

linear_resolve_unchanged_pm_phy.1.1.3.3:

{-1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-4} pm′`mem = linear_pm
{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-12} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-13} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-14} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-15} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-16} pm′`states = pm_phy`states
{-17} plain_memory?(pm_phy)
{-18} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-19} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm_phy`states(s′)

{1} ∀ (d:

(λ (base: Pdbr_type):

∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧ data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = base)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((translate(0, d`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned?

(bits_per_level + pe_size)

(offset(b)) endif}):

if leaf

then ok_result

(xlat_ofs(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))),

addresses)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)(PDBR) ## (λ (pdbr: Pdbr_type): (translate (0,

pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf

then ok_result (xlat_ofs

(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))))),

addresses)

1748

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_unchanged_composition [Physical_memory, [leaf: bool, {b: Memory_Address_4G | IF leaf THEN aligned?(-1 * (pdir_lvl * bits_per_level) - bits_per_level + bus_width) (offset(b)) ELSE aligned?(bits_per_level + pe_size)(offset(b)) ENDIF}], Address], matching in * where P gets LAMBDA (d: [leaf: bool, {b: Memory_Address_4G | IF leaf THEN aligned?(-1 * (pdir_lvl * bits_per_level) - bits_per_level + bus_width) (offset(b)) ELSE aligned?(bits_per_level + pe_size)(offset(b)) ENDIF}]): FORALL (s: (pm_phy‘states)): OK?(translate(0, d!2‘base_addr, addr!1, access!1, segment_to_priv(d!1)) (s)) AND d = data(translate(0, d!2‘base_addr, addr!1, access!1, segment_to_priv(d!1)) (s)),

we get 4 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.1:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} ∀ (s_1: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s_1)) ⊃ (∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s_1)) = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ (leaf: bool,

base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned?

(bits_per_level + pe_size)

(offset(b)) endif}):

if leaf

then ok_result

(xlat_ofs(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))),

addresses)

1750

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Case splitting on pe_in_pt_range?(s!2, restrict[Address, Memory_Address_4G, boolean]

(union(pm!1‘ro_addr, pm!1‘rw_addr)), 0) (xlat_idx(0, d!2‘base_addr, addr!1)), we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.1.1:

{-1} pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0, d′′`base_addr, addr′))

{-2} pm_phy`states(s′′′)
{-3} pm_phy`states(s′′)
{-4} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))

{-5} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-6} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-9} pm′`mem = linear_pm
{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-15} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-17} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-18} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-19} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-20} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-21} pm′`states = pm_phy`states
{-22} plain_memory?(pm_phy)
{-23} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-24} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-25} Mem?(addr′`type_of)
{-26} 0 ≤ addr′`offset
{-27} addr′`offset < max_linear_offset
{-28} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-29} is_linear_plain_memory?(pm′)
{-30} pm_phy`states(s′)

{1} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′)) ∧ data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′)) = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′))

1752

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma translate_same_result, Using lemma translate_result_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.1.2:

{-1} pm_phy`states(s′′′)
{-2} pm_phy`states(s′′)
{-3} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))

{-4} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-5} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-8} pm′`mem = linear_pm
{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-16} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-17} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-18} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-19} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-20} pm′`states = pm_phy`states
{-21} plain_memory?(pm_phy)
{-22} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-23} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-24} Mem?(addr′`type_of)
{-25} 0 ≤ addr′`offset
{-26} addr′`offset < max_linear_offset
{-27} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-28} is_linear_plain_memory?(pm′)
{-29} pm_phy`states(s′)

{1} pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0, d′′`base_addr, addr′))

{2} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′)) ∧ data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′)) = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′))

1754

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Expanding the definition of pe_in_pt_range?, Expanding the definition of pe_in_pdir_range?, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in 1 with the terms: addr′, we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.1.2.1:

{-1} 0 = 0
{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))
{-3} pm_phy`states(s′′′)
{-4} pm_phy`states(s′′)
{-5} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))
{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

((λ (phy_a: Memory_Address_4G):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) ∧ (∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

lin_a)

= phy_a))

=

(λ (phy_a: Memory_Address_4G): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2})) ∧ (∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

lin_a)

= phy_a)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)

{1} xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr, addr′) = xlat_idx(0, d′′`base_addr, addr′)

1756

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.1.2.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.1.2.2:

{-1} 0 = 0
{-2} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))
{-3} pm_phy`states(s′′′)
{-4} pm_phy`states(s′′)
{-5} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))
{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

((λ (phy_a: Memory_Address_4G):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) ∧ (∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1}))`base_addr,

lin_a)

= phy_a))

=

(λ (phy_a: Memory_Address_4G): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2})) ∧ (∃ (lin_a:

(restrict[Address, Memory_Address_4G, boolean] ((pm′‘ro_addr∪ pm′‘rw_addr)))):

xlat_idx(0, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))`base_addr,

lin_a)

= phy_a)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(addr′)

1758

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (-29 1) and hiding *, Expanding the definition of restrict, which is trivially true.

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.1.2.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.1.3:

{-1} pm_phy`states(s′′′)
{-2} pm_phy`states(s′′)
{-3} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′))

{-4} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-5} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-8} pm′`mem = linear_pm
{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-16} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-17} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-18} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-19} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-20} pm′`states = pm_phy`states
{-21} plain_memory?(pm_phy)
{-22} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-23} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-24} Mem?(addr′`type_of)
{-25} 0 ≤ addr′`offset
{-26} addr′`offset < max_linear_offset
{-27} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-28} is_linear_plain_memory?(pm′)
{-29} pm_phy`states(s′)

{1} Mem?(xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`type_of) ∧ 0 ≤ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset < max_linear_offset

{2} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′)) ∧ data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′)) = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s′′′))

1760

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.1.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.2:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ (leaf: bool,

base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned?

(bits_per_level + pe_size)

(offset(b)) endif}):

if leaf

then ok_result

(xlat_ofs(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))),

addresses)

1762

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma translate_unchanged_pm_phy_except_pe, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 5 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.1:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{-3} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-4} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-7} pm′`mem = linear_pm
{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-15} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-16} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-17} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-18} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-19} pm′`states = pm_phy`states
{-20} plain_memory?(pm_phy)
{-21} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-22} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-23} Mem?(addr′`type_of)
{-24} 0 ≤ addr′`offset
{-25} addr′`offset < max_linear_offset
{-26} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-27} is_linear_plain_memory?(pm′)
{-28} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1764

Case splitting on Transformer_Super_Embedding_Expr [Physical_memory, [bool, Address_Helpers.Address]].expr_2_super (Linear_Memory[Physical_memory, pm_phy].translate (0, d!2‘base_addr, addr!1, access!1, Segment_Types.segment_to_priv(d!1))) = Transformer_Super_Embedding_Expr [Physical_memory, [leaf: bool, {b: Memory_Address_4G | IF leaf THEN aligned?(-1 * (pdir_lvl[Physical_memory, pm_phy] * bits_per_level [Physical_memory, pm_phy]) - bits_per_level[Physical_memory, pm_phy] + bus_width) (offset(b)) ELSE aligned?(bits_per_level[Physical_memory, pm_phy] + pe_size) (offset(b)) ENDIF}]].expr_2_super (Linear_Memory[Physical_memory, pm_phy].translate (0, d!2‘base_addr, addr!1, access!1, Segment_Types.segment_to_priv(d!1))),

we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.1.1:

{-1} Transformer_Super_Embedding_Expr[Physical_memory, [bool, Ad-

dress_Helpers.Address]].expr_2_super

(Linear_Memory[Physical_memory, pm_phy].translate

(0, d′′`base_addr, addr′, access′, Segment_Types.segment_to_priv(d′)))

=

Transformer_Super_Embedding_Expr

[Physical_memory, [leaf: bool,

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}]].expr_2_super (Linear_Memory[Physical_memory, pm_phy].translate

(0, d′′`base_addr, addr′, access′, Segment_Types.segment_to_priv(d′)))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{-4} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-5} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-8} pm′`mem = linear_pm
{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-16} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-17} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-18} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-19} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-20} pm′`states = pm_phy`states
{-21} plain_memory?(pm_phy)
{-22} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-23} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-24} Mem?(addr′`type_of)
{-25} 0 ≤ addr′`offset
{-26} addr′`offset < max_linear_offset
{-27} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-28} is_linear_plain_memory?(pm′)
{-29} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1766

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{-3} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-4} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-7} pm′`mem = linear_pm
{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-15} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-16} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-17} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-18} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-19} pm′`states = pm_phy`states
{-20} plain_memory?(pm_phy)
{-21} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-22} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-23} Mem?(addr′`type_of)
{-24} 0 ≤ addr′`offset
{-25} addr′`offset < max_linear_offset
{-26} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-27} is_linear_plain_memory?(pm′)
{-28} pm_phy`states(s′)

{1} Transformer_Super_Embedding_Expr[Physical_memory, [bool, Ad-

dress_Helpers.Address]].expr_2_super

(Linear_Memory[Physical_memory, pm_phy].translate

(0, d′′`base_addr, addr′, access′, Segment_Types.segment_to_priv(d′)))

=

Transformer_Super_Embedding_Expr

[Physical_memory, [leaf: bool,

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}]].expr_2_super (Linear_Memory[Physical_memory, pm_phy].translate

(0, d′′`base_addr, addr′, access′, Segment_Types.segment_to_priv(d′)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1768

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (1) and hiding *, Applying extensionality, Expanding the definition(s) of (expr_2_super expr_2_super_res has_next_state), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.2:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{2} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(0))

(xlat_idx(0, d′′`base_addr, addr′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(0))

(xlat_idx(0, d′′`base_addr, addr′))(s_{2})),

Write)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1770

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (1 3), Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -14 with the terms: (s1!1 s2!1 0 xlat_idx(0, d!2‘base_addr, addr!1)), we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.2.1:

{-1} pm′`states(s′_{1})
{-2} pm′`states(s′_{2})

{-3} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-4} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-7} pm′`mem = linear_pm
{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-14} set_reference(data(read_data(pm_phy, paging_data_type(0))

(xlat_idx(0, d′′`base_addr, addr′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(0))

(xlat_idx(0, d′′`base_addr, addr′))(s′_{2})),

Write)

{-15} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-16} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-17} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-18} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-19} pm′`states = pm_phy`states
{-20} plain_memory?(pm_phy)
{-21} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-22} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-23} Mem?(addr′`type_of)
{-24} 0 ≤ addr′`offset
{-25} addr′`offset < max_linear_offset
{-26} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-27} is_linear_plain_memory?(pm′)
{-28} pm_phy`states(s′)

{1} set_reference(data(read_data(pm_phy, paging_data_type(0))

(xlat_idx(0, d′′`base_addr, addr′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(0))

(xlat_idx(0, d′′`base_addr, addr′))(s′_{2})),

Write)

1772

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.2.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.2.2:

{-1} pm′`states(s′_{1})
{-2} pm′`states(s′_{2})

{-3} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-4} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-7} pm′`mem = linear_pm
{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-14} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-15} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-16} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-17} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-18} pm′`states = pm_phy`states
{-19} plain_memory?(pm_phy)
{-20} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-21} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm_phy`states(s′)

{1} Mem?(xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`type_of) ∧

(0 ≤ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset ∧

xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset < max_linear_offset) ∧ pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{1},

restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)), 0) (xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′))

{2} set_reference(data(read_data(pm_phy, paging_data_type(0))

(xlat_idx(0, d′′`base_addr, addr′))(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(0))

(xlat_idx(0, d′′`base_addr, addr′))(s′_{2})),

Write)

1774

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Adding type constraints for d!2‘base_addr, Instantiating the top quantifier in -7 with the terms: (s1!1), Using lemma xlat_pe_in_pdir_range, Expanding the definition of pe_in_pt_range?, Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.2.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.3:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(0))(xlat_idx(0, d′′`base_addr, addr′))(s))

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1776

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (1 3), Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -12 with the terms: (s!2 0 xlat_idx(0, d!2‘base_addr, addr!1)), we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.3.1:

{-1} pm′`states(s′′)

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-3} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-6} pm′`mem = linear_pm
{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} OK?(read_data(pm_phy, paging_data_type(0))(xlat_idx(0, d′′`base_addr, addr′))(s′′))

{-13} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-14} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-15} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-16} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-17} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-18} pm′`states = pm_phy`states
{-19} plain_memory?(pm_phy)
{-20} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-21} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm_phy`states(s′)
{1} OK?(read_data(pm_phy, paging_data_type(0))(xlat_idx(0, d′′`base_addr, addr′))(s′′))

1778

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.3.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.3.2:

{-1} pm′`states(s′′)

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-3} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-6} pm′`mem = linear_pm
{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} Mem?(xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`type_of) ∧

(0 ≤ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset ∧

xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset < max_linear_offset) ∧ pe_in_pt_range?[Physical_memory, pm_phy]

(s′′, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

0) (xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′))

{2} OK?(read_data(pm_phy, paging_data_type(0))(xlat_idx(0, d′′`base_addr, addr′))(s′′))

1780

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Adding type constraints for d!2‘base_addr, Instantiating quantified variables, Using lemma xlat_pe_in_pdir_range, Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Expanding the definition of pe_in_pt_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.3.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{2} (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1782

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma subset_ptab_address_rw_addr,

we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1:

{-1} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr)) ∧ (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊃ (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-3} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-6} pm′`mem = linear_pm
{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-14} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-15} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-16} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-17} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-18} pm′`states = pm_phy`states
{-19} plain_memory?(pm_phy)
{-20} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-21} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{2} (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1784

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Simplifying, rewriting, and recording with decision procedures, Hiding formulas: (2 3 4), Applying propositional simplification, we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.1:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)
{1} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr))

1786

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma pm_address_in_pt_range_in_rw_addr, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr,

pm!1‘rw_addr)) = union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr), restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)),

we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.1.1:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-4} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-5} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-8} pm′`mem = linear_pm
{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-16} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-17} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-18} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-19} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-20} pm′`states = pm_phy`states
{-21} plain_memory?(pm_phy)
{-22} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-23} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-24} Mem?(addr′`type_of)
{-25} 0 ≤ addr′`offset
{-26} addr′`offset < max_linear_offset
{-27} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-28} pm_phy`states(s′)
{1} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr))

1788

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-3} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-4} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-7} pm′`mem = linear_pm
{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-15} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-16} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-17} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-18} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-19} pm′`states = pm_phy`states
{-20} plain_memory?(pm_phy)
{-21} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-22} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-23} Mem?(addr′`type_of)
{-24} 0 ≤ addr′`offset
{-25} addr′`offset < max_linear_offset
{-26} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-27} pm_phy`states(s′)

{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

{2} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr))

1790

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.2:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)
{1} (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict  [Address,  Memory_Address_4G ,  bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))

1792

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma pe_in_pt_address_in_pt,

we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.2.1:

{-1} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, bool]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0, d′′`base_addr, addr′))

⊃

(address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr))))) {-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-3} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-6} pm′`mem = linear_pm
{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-14} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-15} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-16} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-17} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-18} pm′`states = pm_phy`states
{-19} plain_memory?(pm_phy)
{-20} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-21} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm_phy`states(s′)
{1} (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict  [Address,  Memory_Address_4G ,  bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))

1794

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma xlat_pe_in_pdir_range, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pe_in_pt_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.2.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.2.2:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} Mem?(xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`type_of) ∧ 0 ≤ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset < max_linear_offset

{2} (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict  [Address,  Memory_Address_4G ,  bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))

1796

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.1.2.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.2:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} Mem?(xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`type_of) ∧ 0 ≤ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset < max_linear_offset

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{3} (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1798

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.4.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.5:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-3} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-6} pm′`mem = linear_pm
{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-14} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-15} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-16} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-17} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-18} pm′`states = pm_phy`states
{-19} plain_memory?(pm_phy)
{-20} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-21} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm_phy`states(s′)
{1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), addresses)

1800

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Replacing using formula -21, Rewriting using subset_of_differences, matching in *, Using lemma pe_in_pt_address_in_pt, we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.2.5.1:

{-1} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0, d′′`base_addr, addr′))

⊃

(address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) {-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{-3} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-4} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-7} pm′`mem = linear_pm
{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-15} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-16} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-17} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-18} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-19} pm′`states = pm_phy`states
{-20} plain_memory?(pm_phy)
{-21} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-22} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-23} Mem?(addr′`type_of)
{-24} 0 ≤ addr′`offset
{-25} addr′`offset < max_linear_offset
{-26} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-27} is_linear_plain_memory?(pm′)
{-28} pm_phy`states(s′)
{1} (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{2} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

1802

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma xlat_pe_in_pdir_range, Expanding the definition of pe_in_pt_range?, Instantiating the top quantifier in -4 with the terms: (s!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.5.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.2.5.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-3} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-6} pm′`mem = linear_pm
{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-14} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-15} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-16} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-17} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-18} pm′`states = pm_phy`states
{-19} plain_memory?(pm_phy)
{-20} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-21} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm_phy`states(s′)

{1} Mem?(xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`type_of) ∧ 0 ≤ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy](0, d′′`base_addr, addr′)`offset < max_linear_offset

{2} (address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{3} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(0, d′′‘base_addr, addr′), expt(2, 2))))

{4} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

1804

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.2.5.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} ∀ (d_1:

(λ (d:

[leaf: bool,

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl× bits_per_level ) − bits_per_level + bus_width)

(offset(b)) else aligned?(bits_per_level + pe_size)(offset(b)) endif}]):

∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′))(s)) ∧ d = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(s)))):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

if d_1`1

then singleton(expr_2_super(ok_result

(xlat_ofs

(0, d_1`2, addr′))))

else singleton(expr_2_super((translate

(1, d_1`2, addr′, access′, seg-

ment_to_priv(d′))

## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs

(1, base_1, addr′))))))

endif, addresses)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′))

##

(λ (leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned?

(bits_per_level + pe_size)

(offset(b)) endif}):

if leaf

then ok_result

(xlat_ofs(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′))

## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))),

addresses)

1806

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using plain_memory_unchanged_composition [Physical_memory, [bool, Mem-

ory_Address_4G], Address], matching in * where P gets LAMBDA (d: [bool, Memory_Address_4G]): TRUE,

Hiding formulas: 3, Case splitting on aligned?(12)(offset(d!3‘2)), we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1:

{-1} aligned?(12)(offset(d′′′`2))

{-2} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-3} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-4} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-6} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-7} pm′`mem = linear_pm
{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-15} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-16} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-17} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-18} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-19} pm′`states = pm_phy`states
{-20} plain_memory?(pm_phy)
{-21} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-22} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-23} Mem?(addr′`type_of)
{-24} 0 ≤ addr′`offset
{-25} addr′`offset < max_linear_offset
{-26} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-27} is_linear_plain_memory?(pm′)
{-28} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{2} d′′′`1

1808

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma unchanged_memory_invariant_mono, Using lemma xlat_idx_memory_address, Using lemma translate_unchanged_pm_phy_except_pe, Simplifying, rewriting, and recording with decision procedures, Case splitting on subset?(addresses, difference(union(pm_phy‘ro_addr, pm_phy‘rw_addr), ad-

dress_block(xlat_idx(1, d!3‘2, addr!1), expt(2, 2)))), we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{-2} ((address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr) ∧

(∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s))) ∧ (∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{2})),

Write)))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{-3} xlat_idx(1, d′′′`2, addr′)`type_of = Mem_∧

xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset

{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)

{1} (singleton(expr_2_super (translate(1, d′′′‘2, addr′, access′, segment_to_priv (d′)))) ⊆ singleton(expr_2_super (translate(1, d′′′‘2, addr′, access′, segment_to_priv (d′))))) ∧ (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)))) ∧ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{3} d′′′`1

1810

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Rewriting using subset_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.1:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{3} d′′′`1

1812

Keeping (-2 1) and hiding *,

Case splitting on Transformer_Super_Embedding_Expr [Physical_memory, [bool, Address_Helpers.Address]].expr_2_super (Linear_Memory[Physical_memory, pm_phy].translate (1, d!3‘2, addr!1, access!1, Segment_Types.segment_to_priv(d!1))) = Transformer_Super_Embedding_Expr [Physical_memory, [bool, IA32.Memory_Address_4G]].expr_2_super (Linear_Memory[Physical_memory, pm_phy].translate (1, d!3‘2, addr!1, access!1, Segment_Types.segment_to_priv(d!1))),

we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.1.1:

{-1} Transformer_Super_Embedding_Expr[Physical_memory, [bool, Ad-

dress_Helpers.Address]].expr_2_super

(Linear_Memory[Physical_memory, pm_phy].translate

(1, d′′′`2, addr′, access′, Segment_Types.segment_to_priv(d′)))

= Transformer_Super_Embedding_Expr[Physical_memory, [bool, IA32.Memory_Address_4G]].expr_2_super

(Linear_Memory[Physical_memory, pm_phy].translate

(1, d′′′`2, addr′, access′, Segment_Types.segment_to_priv(d′)))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{1} Transformer_Super_Embedding_Expr[Physical_memory, [bool, Ad-

dress_Helpers.Address]].expr_2_super

(Linear_Memory[Physical_memory, pm_phy].translate

(1, d′′′`2, addr′, access′, Segment_Types.segment_to_priv(d′)))

= Transformer_Super_Embedding_Expr[Physical_memory, [bool, IA32.Memory_Address_4G]].expr_2_super

(Linear_Memory[Physical_memory, pm_phy].translate

(1, d′′′`2, addr′, access′, Segment_Types.segment_to_priv(d′)))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

Keeping (1) and hiding *,

Applying extensionality,

Expanding the definition(s) of (expr_2_super expr_2_super_res has_next_state),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)

{1} ∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{2})),

Write)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{4} d′′′`1

1815 C Proof scripts

Hiding formulas: (2 3), Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -19 with the terms: (s1!1 s2!1 1 xlat_idx(1, d!3‘2, addr!1)), we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.1:

{-1} pm′`states(s′_{1})
{-2} pm′`states(s′_{2})
{-3} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-4} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-5} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-6} aligned?(12)(offset(d′′′`2))

{-7} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-8} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-9} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-12} pm′`mem = linear_pm
{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-18} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-19} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)

{1} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{2} d′′′`1

1817

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2:

{-1} pm′`states(s′_{1})
{-2} pm′`states(s′_{2})
{-3} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-4} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-5} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-6} aligned?(12)(offset(d′′′`2))

{-7} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-8} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-9} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-12} pm′`mem = linear_pm
{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-18} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)

{1} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧

pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{1}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

1) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{2} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{3} d′′′`1

1819 C Proof scripts

Using lemma xlat_pe_in_pt_range, Instantiating quantified variables, Case splitting on pm!1‘states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s1!1))), we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.1:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′_{1}) ∧ pm′`states(s′_{1}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

⊃

pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))
{-3} pm′`states(s′_{1})
{-4} pm′`states(s′_{2})
{-5} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-6} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-7} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-8} aligned?(12)(offset(d′′′`2))

{-9} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) = d′′

{-11} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-13} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-19} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-21} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-22} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-23} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-24} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-25} pm′`states = pm_phy`states
{-26} plain_memory?(pm_phy)
{-27} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-28} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-29} Mem?(addr′`type_of)
{-30} 0 ≤ addr′`offset
{-31} addr′`offset < max_linear_offset
{-32} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-33} is_linear_plain_memory?(pm′)
{-34} pm_phy`states(s′)

{1} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧

pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{1}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

1) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{2} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{3} d′′′`1

1821

C Proof scripts

Instantiating quantified variables,

we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.1.1:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′_{1}) ∧ pm′`states(s′_{1}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

⊃

pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))
{-3} pm′`states(s′_{1})
{-4} pm′`states(s′_{2})
{-5} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-6} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-7} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-8} aligned?(12)(offset(d′′′`2))

{-9} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) = d′′

{-11} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-13} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-19} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-21} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-22} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-23} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-24} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-25} pm′`states = pm_phy`states
{-26} plain_memory?(pm_phy)
{-27} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-28} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-29} Mem?(addr′`type_of)
{-30} 0 ≤ addr′`offset
{-31} addr′`offset < max_linear_offset
{-32} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-33} is_linear_plain_memory?(pm′)
{-34} pm_phy`states(s′)

{1} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧

pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{1}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

1) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{2} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{3} d′′′`1

1823 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.1.2:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′_{1}) ∧ pm′`states(s′_{1}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

⊃

pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))
{-3} pm′`states(s′_{1})
{-4} pm′`states(s′_{2})
{-5} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-6} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-7} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-8} aligned?(12)(offset(d′′′`2))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) = d′′

{-10} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-13} pm′`mem = linear_pm
{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-16} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-19} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)

{1} pm_phy`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{2} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧

pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{1}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

1) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{3} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{4} d′′′`1

1825

C Proof scripts

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.1.3:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′_{1}) ∧ pm′`states(s′_{1}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

⊃

pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))
{-3} pm′`states(s′_{1})
{-4} pm′`states(s′_{2})
{-5} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-6} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-7} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-8} aligned?(12)(offset(d′′′`2))

{-9} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) = d′′

{-11} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-13} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-19} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-21} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-22} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-23} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-24} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-25} pm′`states = pm_phy`states
{-26} plain_memory?(pm_phy)
{-27} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-28} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-29} Mem?(addr′`type_of)
{-30} 0 ≤ addr′`offset
{-31} addr′`offset < max_linear_offset
{-32} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-33} is_linear_plain_memory?(pm′)
{-34} pm_phy`states(s′)

{1} pm_phy`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{2} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧

pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{1}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

1) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{3} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{4} d′′′`1

1827

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.1.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′_{1}) ∧ pm′`states(s′_{1}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

⊃

pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-5} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-6} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-7} aligned?(12)(offset(d′′′`2))

{-8} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) = d′′

{-10} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-13} pm′`mem = linear_pm
{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-16} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-19} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)
{1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})))

{2} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧

pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{1}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

1) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{3} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{4} d′′′`1

1829 C Proof scripts

Hiding formulas: -1, Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Using lemma unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.3:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′_{1}) ∧ pm′`states(s′_{1}) ∧ OK?(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1}))))`1

⊃

pe_in_pt_range?(s′_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′_{1}))))`2,

addr′))
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-5} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-6} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-7} aligned?(12)(offset(d′′′`2))

{-8} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′_{1})) = d′′

{-10} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-13} pm′`mem = linear_pm
{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-16} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-19} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)

{1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1})) ∨ Exception?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′_{1}))

{2} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧

pe_in_pt_range?[Physical_memory, pm_phy]

(s′_{1}, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

1) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{3} set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))

(s′_{2})),

Write)

{4} d′′′`1

1831

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.2.2.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)

{1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{4} d′′′`1

1833 C Proof scripts

Hiding formulas: (3 2), Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -17 with the terms: (s!2 1 xlat_idx(1, d!3‘2, addr!1)), we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.1:

{-1} pm′`states(s′′)
{-2} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)
{1} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))
{2} d′′′`1

1835

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2:

{-1} pm′`states(s′′)
{-2} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)

{1} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧

pe_in_pt_range?[Physical_memory, pm_phy]

(s′′, restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)),

1) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{2} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))
{3} d′′′`1

1837 C Proof scripts

Simplifying, rewriting, and recording with decision procedures, Using lemma xlat_idx_memory_address2, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of pe_in_pt_range?, Simplifying, rewriting, and recording with decision procedures, Using lemma xlat_pe_in_pt_range, Instantiating quantified variables, Case splitting on pm!1‘states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s!2))), we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.1:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′′) ∧ pm′`states(s′′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))`1

⊃

pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))))`2,

addr′))
{-3} 0 ≤ offset(xlat_idx(1, d′′′`2, addr′))
{-4} pm′`states(s′′)
{-5} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-6} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-7} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-8} aligned?(12)(offset(d′′′`2))

{-9} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′

{-11} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-13} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-19} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-21} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-22} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-23} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-24} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-25} pm′`states = pm_phy`states
{-26} plain_memory?(pm_phy)
{-27} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-28} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-29} Mem?(addr′`type_of)
{-30} 0 ≤ addr′`offset
{-31} addr′`offset < max_linear_offset
{-32} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-33} is_linear_plain_memory?(pm′)
{-34} pm_phy`states(s′)

{1} pe_in_ptab_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{2} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))
{3} d′′′`1

1839

we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.1.1:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′′) ∧ pm′`states(s′′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))`1

⊃

pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))))`2,

addr′))
{-3} 0 ≤ offset(xlat_idx(1, d′′′`2, addr′))
{-4} pm′`states(s′′)
{-5} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-6} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-7} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-8} aligned?(12)(offset(d′′′`2))

{-9} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))

∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′

{-11} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-13} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-19} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-21} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-22} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-23} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-24} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-25} pm′`states = pm_phy`states
{-26} plain_memory?(pm_phy)
{-27} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-28} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-29} Mem?(addr′`type_of)
{-30} 0 ≤ addr′`offset
{-31} addr′`offset < max_linear_offset
{-32} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-33} is_linear_plain_memory?(pm′)
{-34} pm_phy`states(s′)

{1} pe_in_ptab_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{2} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))
{3} d′′′`1

1841

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.1.2:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′′) ∧ pm′`states(s′′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))`1

⊃

pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))))`2,

addr′))
{-3} 0 ≤ offset(xlat_idx(1, d′′′`2, addr′))
{-4} pm′`states(s′′)
{-5} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-6} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-7} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-8} aligned?(12)(offset(d′′′`2))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′

{-10} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-13} pm′`mem = linear_pm
{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-16} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-19} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)

{1} pm_phy`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′′)))

{2} pe_in_ptab_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{3} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))
{4} d′′′`1

1843

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.1.3:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′′) ∧ pm′`states(s′′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))`1

⊃

pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))))`2,

addr′))
{-3} 0 ≤ offset(xlat_idx(1, d′′′`2, addr′))
{-4} pm′`states(s′′)
{-5} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-6} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-7} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-8} aligned?(12)(offset(d′′′`2))

{-9} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′

{-11} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-13} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-19} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-21} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-22} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-23} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-24} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-25} pm′`states = pm_phy`states
{-26} plain_memory?(pm_phy)
{-27} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-28} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-29} Mem?(addr′`type_of)
{-30} 0 ≤ addr′`offset
{-31} addr′`offset < max_linear_offset
{-32} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-33} is_linear_plain_memory?(pm′)
{-34} pm_phy`states(s′)

{1} pm_phy`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′′)))

{2} pe_in_ptab_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{3} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))
{4} d′′′`1

1845

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.1.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′′) ∧ pm′`states(s′′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))`1

⊃

pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))))`2,

addr′))
{-2} 0 ≤ offset(xlat_idx(1, d′′′`2, addr′))
{-3} pm′`states(s′′)
{-4} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-5} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-6} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-7} aligned?(12)(offset(d′′′`2))

{-8} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′

{-10} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-13} pm′`mem = linear_pm
{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-16} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-19} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)
{1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)))

{2} pe_in_ptab_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{3} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))
{4} d′′′`1

1847 C Proof scripts

Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Using lemma unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.3:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′′) ∧ pm′`states(s′′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′))))`1

⊃

pe_in_pt_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′′))))`2,

addr′))
{-2} 0 ≤ offset(xlat_idx(1, d′′′`2, addr′))
{-3} pm′`states(s′′)
{-4} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-5} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-6} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-7} aligned?(12)(offset(d′′′`2))

{-8} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′′)) = d′′

{-10} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-12} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-13} pm′`mem = linear_pm
{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-16} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-19} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)

{1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′′)) ∨ Exception?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′′))

{2} pe_in_ptab_range?(s′′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′))

{3} OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s′′))
{4} d′′′`1

1849

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.3.2.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{4} d′′′`1

1851 C Proof scripts

Hiding formulas: 2, 3, Using lemma subset_ptab_address_rw_addr, we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1:

{-1} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr)) ∧ (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊃ (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, pe_size)) ⊆ pm_phy‘rw_addr)

{-2} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)
{1} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{2} d′′′`1

1853 C Proof scripts

Simplifying, rewriting, and recording with decision procedures, Applying propositional simplification, we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.1:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr))
{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{3} d′′′`1

1855 C Proof scripts

Using lemma pm_address_in_pt_range_in_rw_addr, Case splitting on restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr,

pm!1‘rw_addr)) = union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr), restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)),

we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.1.1:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)) {-2} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃

(address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-3} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-4} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-5} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-6} aligned?(12)(offset(d′′′`2))

{-7} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-8} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-9} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-12} pm′`mem = linear_pm
{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-18} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-19} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)
{1} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr))
{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{3} d′′′`1

1857

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.1.2:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃

(address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-2} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)

{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

{2} (address_in_pt_range? (s′, (restrict [Address, Memory_Address_4G , bool](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , bool](pm′‘rw_addr))) ⊆ restrict [Address, Memory_Address_4G , bool](pm_phy‘rw_addr))
{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{4} d′′′`1

1859 C Proof scripts

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{3} d′′′`1

1861 C Proof scripts

Using lemma pe_in_pt_address_in_pt,

we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1:

{-1} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, bool]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

⊃

(address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{-2} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)
{1} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{3} d′′′`1

1863 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma xlat_pe_in_pt_range, Instantiating quantified variables, Case splitting on pm!1‘states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s!1))), we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.1:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-3} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-4} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-5} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-6} aligned?(12)(offset(d′′′`2))

{-7} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-8} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-9} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-12} pm′`mem = linear_pm
{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-18} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-19} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)

{1} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, bool]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{4} d′′′`1

1865

we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.1.1:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-3} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-4} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-5} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-6} aligned?(12)(offset(d′′′`2))

{-7} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

{-8} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-9} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-12} pm′`mem = linear_pm
{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-18} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-19} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)

{1} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, bool]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{4} d′′′`1

1867

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.1.2:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-3} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-4} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-5} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-6} aligned?(12)(offset(d′′′`2))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)

{1} pm_phy`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′)))

{2} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, bool]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{4} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{5} d′′′`1

1869

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.1.3:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-3} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-4} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-5} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-6} aligned?(12)(offset(d′′′`2))

{-7} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-8} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-9} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-11} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-12} pm′`mem = linear_pm
{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-17} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-18} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-19} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-20} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-21} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-22} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-23} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-24} pm′`states = pm_phy`states
{-25} plain_memory?(pm_phy)
{-26} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-27} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-28} Mem?(addr′`type_of)
{-29} 0 ≤ addr′`offset
{-30} addr′`offset < max_linear_offset
{-31} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-32} is_linear_plain_memory?(pm′)
{-33} pm_phy`states(s′)

{1} pm_phy`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′)))

{2} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, bool]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{4} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{5} d′′′`1

1871

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.1.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-2} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)
{1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{2} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, bool]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{4} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{5} d′′′`1

1873 C Proof scripts

Hiding formulas: -1, Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Using lemma unchanged_memory_invariant_invariant, Using lemma pm_states, Using lemma expr_transformer_invariant_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.3:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-2} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)

{1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′)) ∨ Exception?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′))

{2} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, bool]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{4} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{5} d′′′`1

1875

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.1.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.2:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset
{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , bool]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{4} d′′′`1

1877 C Proof scripts

Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.1.2.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.2:

{-1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset
{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)
{3} d′′′`1

1879 C Proof scripts

Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.1.4.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2:

{-1} ((address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr) ∧

(∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s))) ∧ (∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{2})),

Write)))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{-2} xlat_idx(1, d′′′`2, addr′)`type_of = Mem_∧

xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset

{-3} aligned?(12)(offset(d′′′`2))

{-4} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-5} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-6} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-9} pm′`mem = linear_pm
{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-15} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-17} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-18} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-19} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-20} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-21} pm′`states = pm_phy`states
{-22} plain_memory?(pm_phy)
{-23} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-24} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-25} Mem?(addr′`type_of)
{-26} 0 ≤ addr′`offset
{-27} addr′`offset < max_linear_offset
{-28} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-29} is_linear_plain_memory?(pm′)
{-30} pm_phy`states(s′)
{1} (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{2} (singleton(expr_2_super (translate(1, d′′′‘2, addr′, access′, segment_to_priv (d′)))) ⊆ singleton(expr_2_super (translate(1, d′′′‘2, addr′, access′, segment_to_priv (d′))))) ∧ (addresses ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)))) ∧ unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{3} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{4} d′′′`1

1881 C Proof scripts

Hiding formulas: (2 3), Replacing using formula -24, Rewriting using subset_of_differences, matching in *, Using lemma pe_in_pt_address_in_pt, we get 2 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1:

{-1} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

⊃

(address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, pe_size)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) {-2} ((address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr) ∧

(∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s))) ∧ (∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{2})),

Write)))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{-3} xlat_idx(1, d′′′`2, addr′)`type_of = Mem_∧

xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset

{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{2} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{3} d′′′`1

1883 C Proof scripts

Hiding formulas: -2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma xlat_pe_in_pt_range, Instantiating quantified variables, Case splitting on pm!1‘states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s!1))), we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.1:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)

{1} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{3} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{4} d′′′`1

1885

we get 3 subgoals:

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.1.1:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)

{1} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{3} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{4} d′′′`1

1887

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.1.1.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.1.2:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)

{1} pm_phy`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′)))

{2} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{4} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{5} d′′′`1

1889

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.1.3:

{-1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-3} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-4} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-5} aligned?(12)(offset(d′′′`2))

{-6} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-8} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-10} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-11} pm′`mem = linear_pm
{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-14} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-17} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states = pm_phy`states
{-24} plain_memory?(pm_phy)
{-25} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-26} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-27} Mem?(addr′`type_of)
{-28} 0 ≤ addr′`offset
{-29} addr′`offset < max_linear_offset
{-30} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-31} is_linear_plain_memory?(pm′)
{-32} pm_phy`states(s′)

{1} pm_phy`states

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′)))

{2} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{4} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{5} d′′′`1

1891

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.1.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)
{1} pm′`states(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)))

{2} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{4} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{5} d′′′`1

1893 C Proof scripts

Hiding formulas: -1, Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Using lemma unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.3:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`states(s′) ∧ OK?(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr,

addr′, access′, segment_to_priv(d′)) (state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))

∧

¬ data(translate(pdir_lvl, data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))`base_addr, addr′, access′, segment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)(s′))))`1

⊃

pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), ptab_lvl)

(xlat_idx(ptab_lvl,

data(translate(pdir_lvl,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))`base_addr,

addr′, access′, seg-

ment_to_priv(d′))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (s′))))`2,

addr′))
{-2} Mem?(xlat_idx(1, d′′′`2, addr′)`type_of)
{-3} xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset
{-4} aligned?(12)(offset(d′′′`2))

{-5} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-6} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s′)) = d′′ {-7} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-9} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-10} pm′`mem = linear_pm
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-13} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-15} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-17} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states = pm_phy`states
{-23} plain_memory?(pm_phy)
{-24} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-25} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-26} Mem?(addr′`type_of)
{-27} 0 ≤ addr′`offset
{-28} addr′`offset < max_linear_offset
{-29} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-30} is_linear_plain_memory?(pm′)
{-31} pm_phy`states(s′)

{1} OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′)) ∨ Exception?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type](pm_phy, pdbr_data_type)(PDBR)(s′))

{2} pe_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1, d′′′`2, addr′))

{3} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{4} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{5} d′′′`1

1895

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.1.3.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.2:

{-1} ((address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr) ∧

(∀ (s: (pm′`states)):

OK?(read_data(pm_phy, paging_data_type(1))(xlat_idx(1, d′′′`2, addr′))(s))) ∧ (∀ (s_{1}, s_{2}: (pm′`states)):

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{1})),

Write)

=

set_reference(data(read_data(pm_phy, paging_data_type(1))

(xlat_idx(1, d′′′`2, addr′))(s_{2})),

Write)))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))

{-2} xlat_idx(1, d′′′`2, addr′)`type_of = Mem_∧

xlat_idx(1, d′′′`2, addr′)`offset < max_linear_offset

{-3} aligned?(12)(offset(d′′′`2))

{-4} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-5} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-6} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-8} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-9} pm′`mem = linear_pm
{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-15} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-17} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-18} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-19} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-20} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-21} pm′`states = pm_phy`states
{-22} plain_memory?(pm_phy)
{-23} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-24} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-25} Mem?(addr′`type_of)
{-26} 0 ≤ addr′`offset
{-27} addr′`offset < max_linear_offset
{-28} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-29} is_linear_plain_memory?(pm′)
{-30} pm_phy`states(s′)

{1} Mem?(xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`type_of) ∧ 0 ≤ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy](1, d′′′`2, addr′)`offset < max_linear_offset

{2} (address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{3} (((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))) ⊆ ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ address_block(xlat_idx(1, d′′′‘2, addr′), expt(2, 2))))
{4} d′′′`1

1897 C Proof scripts

Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.1.2.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.3.2:

{-1} ∀ (s: (pm_phy`states)):

OK?(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s)) ∧ d′′′ = data(translate(0, d′′`base_addr, addr′, access′, segment_to_priv(d′))(s))

{-2} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-3} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-5} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-6} pm′`mem = linear_pm
{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-9} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-11} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-14} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-15} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-16} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-17} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-18} pm′`states = pm_phy`states
{-19} plain_memory?(pm_phy)
{-20} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-21} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm_phy`states(s′)
{1} aligned?(12)(offset(d′′′`2))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super(translate(1, d′′′`2, addr′, access′, seg-

ment_to_priv(d′)))),

addresses)

{3} d′′′`1

1899 C Proof scripts

Instantiating quantified variables, Using lemma translate_result_no_leaf, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.3.2.

linear_resolve_unchanged_pm_phy.1.1.3.3.4:

{-1} ∀ (s: (pm_phy`states)):

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) ∧

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s)) = d′′

{-2} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-4} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-5} pm′`mem = linear_pm
{-6} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-8} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-10} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-13} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-14} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-15} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-16} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-17} pm′`states = pm_phy`states
{-18} plain_memory?(pm_phy)
{-19} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-20} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm_phy`states(s′)

{1} ∀ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy] − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(d′))(x_{1})))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((translate(0, d′′`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ (leaf: bool,

base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned?

(bits_per_level + pe_size)

(offset(b)) endif}):

if leaf

then ok_result

(xlat_ofs(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))),

addresses)

1901 C Proof scripts

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -8 with the terms: d!2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.3.4.

linear_resolve_unchanged_pm_phy.1.1.3.4:

{-1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-4} pm′`mem = linear_pm
{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-12} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-13} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-14} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-15} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-16} pm′`states = pm_phy`states
{-17} plain_memory?(pm_phy)
{-18} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-19} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm_phy`states(s′)

{1} ∀ (pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy] − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(d′))(x_{1})))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)(PDBR) ## (λ (pdbr: Pdbr_type): (translate (0,

pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf

then ok_result (xlat_ofs

(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))))),

addresses)

1903 C Proof scripts

Keeping (-3 1) and hiding *, Instantiating quantified variables,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.4.

linear_resolve_unchanged_pm_phy.1.1.3.5:

{-1} ∀ (s: (pm′`states)):

OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s)) ∧

d′ = data(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-2} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{-3} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-4} pm′`mem = linear_pm
{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-7} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-9} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-10} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-11} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-12} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-13} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-14} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-15} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-16} pm′`states = pm_phy`states
{-17} plain_memory?(pm_phy)
{-18} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-19} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm_phy`states(s′)

{1} ∀ (pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(d′))(x_{1}))

{2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states,

singleton(expr_2_super((read_data(pm_phy, pdbr_data_type)(PDBR) ## (λ (pdbr: Pdbr_type): (translate (0,

pdbr`base_addr, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf: bool, base: {b: Mem-

ory_Address_4G | if leaf then aligned?

(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

en-

dif}):

if leaf

then ok_result (xlat_ofs

(0, base, addr′)) else (translate (1,

base, addr′, access′, seg-

ment_to_priv(d′)) ## (λ

(leaf_1: bool, base_1: Mem-

ory_Address_4G): ok_result (xlat_ofs (1,

base_1, addr′))))

endif)))))),

addresses)

1905 C Proof scripts

Keeping (-2 1) and hiding *, Instantiating quantified variables,

This completes the proof of linear_resolve_unchanged_pm_phy.1.1.3.5.

linear_resolve_unchanged_pm_phy.1.2:

{-1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{-2} pm′`mem = linear_pm
{-3} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-4} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-5} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-7} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-8} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-9} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-10} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-11} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-12} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-13} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-14} pm′`states = pm_phy`states
{-15} plain_memory?(pm_phy)
{-16} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-17} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-18} Mem?(addr′`type_of)
{-19} 0 ≤ addr′`offset
{-20} addr′`offset < max_linear_offset
{-21} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-22} is_linear_plain_memory?(pm′)
{-23} pm_phy`states(s′)

{1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type):

∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]): Mem?(t`2`type_of) ∧ (0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) ∧ if t`1

then aligned?(22)(offset(t`2)) else aligned?(12)(offset(t`2)) endif)

(translate[Physical_memory, pm_phy]

(0, pdbr`base_addr, addr′, access′, segment_to_priv(cs))(x_{1}))

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′)) else (translate(ptab_lvl,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(ptab_lvl, base_1, addr′))))

endif)))))))),

addresses)

1907 C Proof scripts

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of every, Using lemma translate_memory_address, Using lemma translate_result_leaf, Using lemma translate_result_no_leaf, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.2.

linear_resolve_unchanged_pm_phy.1.3:

{-1} pm′`mem = linear_pm
{-2} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-7} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} pm′`states = pm_phy`states
{-14} plain_memory?(pm_phy)
{-15} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-16} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-17} Mem?(addr′`type_of)
{-18} 0 ≤ addr′`offset
{-19} addr′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-21} is_linear_plain_memory?(pm′)
{-22} pm_phy`states(s′)

{1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × (pdir_lvl[Physical_memory, pm_phy] × bits_per_level[Physical_memory, pm_phy]) − bits_per_level[Physical_memory, pm_phy] + bus_width)

(offset(b))

else aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(b))

endif}):

¬ leaf ⊃

(∀ (x_{1}: Physical_memory):

every[Physical_memory, [bool, Address]] (λ (x: Physical_memory): true,

λ (t: [bool, Address]):

Mem?(t`2`type_of) ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset) (translate[Physical_memory, pm_phy]

(1, base, addr′, access′, segment_to_priv(cs))(x_{1})))

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′)) else (translate(ptab_lvl,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(ptab_lvl, base_1, addr′))))

endif)))))))),

addresses)

1909 C Proof scripts

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Expanding the definition of every, Using lemma translate_memory_address, Using lemma translate_result_leaf, Using lemma translate_result_no_leaf, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.3.

linear_resolve_unchanged_pm_phy.1.4:

{-1} pm′`mem = linear_pm
{-2} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-7} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} pm′`states = pm_phy`states
{-14} plain_memory?(pm_phy)
{-15} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-16} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-17} Mem?(addr′`type_of)
{-18} 0 ≤ addr′`offset
{-19} addr′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-21} is_linear_plain_memory?(pm′)
{-22} pm_phy`states(s′)

{1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, x_{1}: Physical_memory, t: [bool, Ad-

dress]):

¬ t`1 ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset ∧ Mem?(t`2`type_of) ⊃ offset(t`2) ≥ 0

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′)) else (translate(ptab_lvl,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(ptab_lvl, base_1, addr′))))

endif)))))))),

addresses)

1911 C Proof scripts

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.4.

linear_resolve_unchanged_pm_phy.1.5:

{-1} pm′`mem = linear_pm
{-2} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-3} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-4} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-5} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-6} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-7} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-8} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-9} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-10} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-11} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-12} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-13} pm′`states = pm_phy`states
{-14} plain_memory?(pm_phy)
{-15} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-16} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-17} Mem?(addr′`type_of)
{-18} 0 ≤ addr′`offset
{-19} addr′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-21} is_linear_plain_memory?(pm′)
{-22} pm_phy`states(s′)

{1} ∀ (cs: Segment_Reg_type, pdbr: Pdbr_type, x_{1}: Physical_memory, t: [bool, Ad-

dress]):

t`1 ∧ 0 ≤ t`2`offset ∧ t`2`offset < max_linear_offset ∧ Mem?(t`2`type_of) ⊃ offset(t`2) ≥ 0

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm_phy`states,

singleton(expr_2_super[Physical_memory, Address]

((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′, access′, segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned? (−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width) (offset(b))

else aligned? (bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′)) else (translate(ptab_lvl,

base, addr′, access′, seg-

ment_to_priv(cs)) ## (λ (leaf_1: bool,

base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs

(ptab_lvl, base_1, addr′))))

endif)))))))),

addresses)

1913

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_unchanged_pm_phy.1.5.
linear_resolve_unchanged_pm_phy.2:

{-1} ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

= addresses

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)
{1} (addresses ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(addr′, access′))), addresses)

Hiding formulas: 2, Replacing using formula -1, Rewriting using difference_subset, matching in *,

This completes the proof of linear_resolve_unchanged_pm_phy.2.

Q.E.D.

C.117.50 Linear_Memory_Properties.linear_resolve_read_transformers_ok

Terse proof for linear_resolve_read_transformers_ok.
linear_resolve_read_transformers_ok:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G): is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ transformers_ok?(pm`states, singleton(expr_2_super(linear_resolve(addr, Read))))

Installing automatic rewrites from: (singleton ok_expr_2_super) Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -7, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_linear_resolve_read_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_read_transformers_ok.

Q.E.D.

C.117.51 Linear_Memory_Properties.linear_resolve_write_transformers_ok

Terse proof for linear_resolve_write_transformers_ok.

linear_resolve_write_transformers_ok:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G): is_linear_plain_memory?(pm) ∧ pm`rw_addr(addr) ⊃ transformers_ok?(pm`states, singleton(expr_2_super(linear_resolve(addr, Write))))

Installing automatic rewrites from: ok_expr_2_super Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -7, Using lemma pm_linear_resolve_write_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_write_transformers_ok.

Q.E.D.

C.117.52 Linear_Memory_Properties.linear_resolve_transformer_invariant

Terse proof for linear_resolve_transformer_invariant.
linear_resolve_transformer_invariant:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, access: Mem- ory_access): is_linear_plain_memory?(pm) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ transformer_invariant?(pm`states, singleton(expr_2_super(linear_resolve(addr, ac- cess))))

Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Using lemma linear_resolve_unchanged_pm_phy, Using lemma unchanged_memory_invariant_invariant[Physical_memory], Using lemma pm_states, Expanding the definition of transformer_invariant?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-9 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, Applying decompose-equality, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_transformer_invariant.

Q.E.D.

C.117.53 Linear_Memory_Properties.linear_resolve_states_TCC1

Terse proof for linear_resolve_states_TCC1.

linear_resolve_states_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

addr: Memory_Address_4G, access: Memory_access): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ OK?(linear_resolve(addr, access)(s)) ⊃ OK?[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](addr, access)(s)) ∨ Exception?[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](addr, access)(s))

Repeatedly Skolemizing and flattening,

This completes the proof of linear_resolve_states_TCC1.

Q.E.D.

C.117.54 Linear_Memory_Properties.linear_resolve_states

Terse proof for linear_resolve_states.
linear_resolve_states:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

addr: Memory_Address_4G, access: Memory_access): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ OK?(linear_resolve(addr, access)(s)) ⊃ pm_phy`states(state(linear_resolve(addr, access)(s)))

Installing automatic rewrites from: has_next_state Repeatedly Skolemizing and flattening, Using lemma linear_resolve_unchanged_pm_phy, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -2, Using lemma unchanged_memory_invariant_invariant, Using lemma super_transformer_invariant_next_ok, Installing automatic rewrites from: (expr_2_super! expr_2_super_res!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of singleton, which is trivially true. This completes the proof of linear_resolve_states. Q.E.D.

C.117.55 Linear_Memory_Properties.linear_resolve_same_result

Terse proof for linear_resolve_same_result.

linear_resolve_same_result:

{1} ∀ (pm: Plain_Memory[Linear_memory], addr: Memory_Address_4G, ac1, ac2: Mem-

ory_access,

s_{1}, s_{2}: Linear_memory): union(pm`ro_addr, pm`rw_addr)(addr) ∧ is_linear_plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ OK?(linear_resolve(addr, ac1)(s_{1})) ∧ OK?(linear_resolve(addr, ac2)(s_{2})) ⊃ data(linear_resolve(addr, ac1)(s_{1})) = data(linear_resolve(addr, ac2)(s_{2}))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: has_next_state ## ok_result singleton max_level bus_width bits_per_level Mem min_linear Address_Helpers.<= ptab_lvl pdir_lvl max_linear < pe_size

Case splitting on interpreted_data_type?(pdbr_data_type), interpreted_data_type?(segment_reg_data_type),

we get 3 subgoals:

linear_resolve_same_result.1:

{-1} interpreted_data_type?(segment_reg_data_type)
{-2} interpreted_data_type?(pdbr_data_type)
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-11} OK?(linear_resolve(addr′, ac2′)(s′_{2}))
{1} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Case splitting on OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s1!1)) AND OK?(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type)(CS) (s1!1)))) AND OK?(translate(0, data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))‘base_addr, addr!1, ac1!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))))),

we get 5 subgoals:

linear_resolve_same_result.1.1:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-2} interpreted_data_type?(segment_reg_data_type)
{-3} interpreted_data_type?(pdbr_data_type)
{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-12} OK?(linear_resolve(addr′, ac2′)(s′_{2}))
{1} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Case splitting on OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s2!1)) AND OK?(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type)(CS) (s2!1)))) AND OK?(translate(0, data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data (pm_phy, segment_reg_data_type) (CS) (s2!1))))‘base_addr, addr!1, ac2!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s2!1)))) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s2!1)))))),

we get 5 subgoals:

linear_resolve_same_result.1.1.1:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

{-2} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-3} interpreted_data_type?(segment_reg_data_type)
{-4} interpreted_data_type?(pdbr_data_type)
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-9} is_linear_plain_memory?(pm′)
{-10} pm′`states(s′_{1})
{-11} pm′`states(s′_{2})
{-12} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-13} OK?(linear_resolve(addr′, ac2′)(s′_{2}))
{1} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Applying disjunctive simplification to flatten sequent, Hiding formulas: (-16 -17), Using lemma translate_memory_address, Using lemma translate_memory_address, Case splitting on data(read_data(pm_phy, segment_reg_data_type)(CS)(s1!1)) = data(read_data(pm_phy,

C Proof scripts

segment_reg_data_type)(CS)(s2!1)), pm!1‘states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s1!1))), pm!1‘states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s2!1))),

we get 4 subgoals:

linear_resolve_same_result.1.1.1.1:

{-1} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-2} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-3} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-4} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-5} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-6} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-8} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-12} interpreted_data_type?(segment_reg_data_type)
{-13} interpreted_data_type?(pdbr_data_type)
{-14} Mem?(addr′`type_of)
{-15} 0 ≤ addr′`offset
{-16} addr′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-18} is_linear_plain_memory?(pm′)
{-19} pm′`states(s′_{1})
{-20} pm′`states(s′_{2})
{1} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1921

Case splitting on data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type)(CS) (s1!1))))‘base_addr = data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type)(CS) (s2!1))))‘base_addr, pm!1‘states (state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type) (CS) (s1!1))))), pm!1‘states (state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type) (CS) (s2!1))))),

we get 4 subgoals:

linear_resolve_same_result.1.1.1.1.1:

{-1} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-3} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-4} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-6} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-7} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-8} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-15} interpreted_data_type?(segment_reg_data_type)
{-16} interpreted_data_type?(pdbr_data_type)
{-17} Mem?(addr′`type_of)
{-18} 0 ≤ addr′`offset
{-19} addr′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-21} is_linear_plain_memory?(pm′)
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})
{1} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1923

Case splitting on data(translate(0, data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data (pm_phy, segment_reg_data_type) (CS) (s2!1))))‘base_addr, addr!1, ac2!1, segment_to_priv(data(read_data (pm_phy, segment_reg_data_type) (CS) (s2!1)))) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data (pm_phy, segment_reg_data_type) (CS) (s2!1)))))) = data(translate(0, data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))‘base_addr, addr!1, ac1!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))))),

we get 4 subgoals:

linear_resolve_same_result.1.1.1.1.1.1:

{-1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-3} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-4} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-6} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-7} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-8} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-9} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-15} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-16} interpreted_data_type?(segment_reg_data_type)
{-17} interpreted_data_type?(pdbr_data_type)
{-18} Mem?(addr′`type_of)
{-19} 0 ≤ addr′`offset
{-20} addr′`offset < max_linear_offset
{-21} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-22} is_linear_plain_memory?(pm′)
{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})
{1} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1925

Case splitting on data(translate(0, data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))‘base_addr, addr!1, ac1!1, segment_to_priv(data(read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))))‘1,

we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.1:

{-1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{-2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-3} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-4} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-5} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-6} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-8} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-9} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-10} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-11} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-12} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-13} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-14} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-15} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-16} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-17} interpreted_data_type?(segment_reg_data_type)
{-18} interpreted_data_type?(pdbr_data_type)
{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm′`states(s′_{1})
{-25} pm′`states(s′_{2})
{1} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1927 C Proof scripts

Expanding the definition of linear_resolve, Expanding the definition of ##, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -2, Replacing using formula -1, which is trivially true.

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.1.

linear_resolve_same_result.1.1.1.1.1.1.2:

{-1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-3} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-4} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-6} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-7} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-8} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-9} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-15} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-16} interpreted_data_type?(segment_reg_data_type)
{-17} interpreted_data_type?(pdbr_data_type)
{-18} Mem?(addr′`type_of)
{-19} 0 ≤ addr′`offset
{-20} addr′`offset < max_linear_offset
{-21} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-22} is_linear_plain_memory?(pm′)
{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1
{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1929

Expanding the definition of linear_resolve,

Expanding the definition of ##,

Simplifying, rewriting, and recording with decision procedures,

Replacing using formula -1,

Replacing using formula 1,

Case splitting on OK?(translate(1, data(translate(0, data(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))‘base_addr, addr!1, ac1!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))))‘2, addr!1, ac1!1, segment_to_priv(data(read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(translate(0, data(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))‘base_addr, addr!1, ac1!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))))))), OK?(translate(1, data(translate(0, data(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))‘base_addr, addr!1, ac1!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))))‘2, addr!1, ac2!1, segment_to_priv(data(read_data (pm_phy, segment_reg_data_type) (CS) (s2!1)))) (state(translate(0, data(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s2!1))))‘base_addr, addr!1, ac2!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s2!1)))) (state(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s2!1)))))))),

we get 3 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1:

{-1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-2} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-4} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-9} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of

= Mem_ ∧ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-11} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of

= Mem_ ∧ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-15} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-16} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-17} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-18} interpreted_data_type?(segment_reg_data_type)
{-19} interpreted_data_type?(pdbr_data_type)
{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm′`states(s′_{1})
{-26} pm′`states(s′_{2})

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{2} data(cases translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))) of

OK(state_1, data_1): ok_result(xlat_ofs(ptab_lvl, data_1`2, addr′))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

= data(cases translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))) of

OK(state_1, data_1): ok_result(xlat_ofs(ptab_lvl, data_1`2, addr′))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

1931

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Replacing using formula -6,

Replacing using formula -9,

Case splitting on pm!1‘states (state(translate(0, data(read_data(pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))‘base_addr, addr!1, ac1!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))))), pm!1‘states (state(translate(0, data(read_data(pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1))))‘base_addr, addr!1, ac2!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s1!1)))) (state(read_data(pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s2!1))))))),

we get 3 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.1:

{-1} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))

{-2} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))

{-3} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-4} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-5} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-6} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-7} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-8} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-9} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-10} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-11} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-12} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-13} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-14} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-15} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-16} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-17} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-18} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-19} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-20} interpreted_data_type?(segment_reg_data_type)
{-21} interpreted_data_type?(pdbr_data_type)
{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm′`states(s′_{1})
{-28} pm′`states(s′_{2})

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{2} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))))`2,

addr′)

= xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))))`2,

addr′)

1933 C Proof scripts

Using lemma translate_same_result,

we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pe_in_pt_range?(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′))

∧

OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

∧

OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

⊃ data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

=

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-2} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))

{-3} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))

{-4} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-5} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-6} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-7} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-8} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-9} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-10} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-11} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-12} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-14} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-15} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-16} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-17} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-18} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-19} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-20} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-21} interpreted_data_type?(segment_reg_data_type)
{-22} interpreted_data_type?(pdbr_data_type)
{-23} Mem?(addr′`type_of)
{-24} 0 ≤ addr′`offset
{-25} addr′`offset < max_linear_offset
{-26} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-27} is_linear_plain_memory?(pm′)
{-28} pm′`states(s′_{1})
{-29} pm′`states(s′_{2})

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{2} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))))`2,

addr′)

= xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))))`2,

addr′)

1935

we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-2} is_linear_plain_memory?(pm′)

{-3} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-4} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-5} data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

= data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-6} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))

{-7} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))

{-8} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-9} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-10} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-11} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-12} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-13} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-14} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-15} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-16} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-17} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-18} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-19} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-20} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-21} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-22} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-23} interpreted_data_type?(segment_reg_data_type)
{-24} interpreted_data_type?(pdbr_data_type)
{-25} Mem?(addr′`type_of)
{-26} 0 ≤ addr′`offset
{-27} addr′`offset < max_linear_offset
{-28} pm′`states(s′_{1})
{-29} pm′`states(s′_{2})

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{2} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))))`2,

addr′)

= xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))))`2,

addr′)

1937 C Proof scripts

Replacing using formula -5, which is trivially true.

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.1.1.1.

linear_resolve_same_result.1.1.1.1.1.1.2.1.1.1.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-2} is_linear_plain_memory?(pm′)

{-3} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-4} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-5} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))

{-6} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))

{-7} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-8} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-9} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-10} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-11} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-12} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-13} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-14} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-15} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-16} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-17} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-18} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-19} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-20} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-21} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-22} interpreted_data_type?(segment_reg_data_type)
{-23} interpreted_data_type?(pdbr_data_type)
{-24} Mem?(addr′`type_of)
{-25} 0 ≤ addr′`offset
{-26} addr′`offset < max_linear_offset
{-27} pm′`states(s′_{1})
{-28} pm′`states(s′_{2})

{1} pe_in_pt_range?(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 1)

(xlat_idx(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{3} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))))`2,

addr′)

= xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))))`2,

addr′)

1939 C Proof scripts

Hiding formulas: (-3 -4 3), Using lemma xlat_pe_in_pt_range, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.1.1.2.

linear_resolve_same_result.1.1.1.1.1.1.2.1.1.2:

{-1} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))

{-2} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))

{-3} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-4} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-5} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-6} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-7} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-8} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-9} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-10} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-11} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-12} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-13} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-14} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-15} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-16} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-17} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-18} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-19} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-20} interpreted_data_type?(segment_reg_data_type)
{-21} interpreted_data_type?(pdbr_data_type)
{-22} Mem?(addr′`type_of)
{-23} 0 ≤ addr′`offset
{-24} addr′`offset < max_linear_offset
{-25} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-26} is_linear_plain_memory?(pm′)
{-27} pm′`states(s′_{1})
{-28} pm′`states(s′_{2})

{1} aligned?(12)

(offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data[Physical_memory, Seg-

ment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{3} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))))`2,

addr′)

= xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))))`2,

addr′)

1941 C Proof scripts

Hiding formulas: (-1 -2 3), Using lemma translate_result_no_leaf, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.1.2.

linear_resolve_same_result.1.1.1.1.1.1.2.1.2:

{-1} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))

{-2} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-3} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-4} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-6} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-7} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-9} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-10} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-12} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-15} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-16} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-17} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-18} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-19} interpreted_data_type?(segment_reg_data_type)
{-20} interpreted_data_type?(pdbr_data_type)
{-21} Mem?(addr′`type_of)
{-22} 0 ≤ addr′`offset
{-23} addr′`offset < max_linear_offset
{-24} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-25} is_linear_plain_memory?(pm′)
{-26} pm′`states(s′_{1})
{-27} pm′`states(s′_{2})

{1} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{3} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))))`2,

addr′)

= xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))))`2,

addr′)

1943 C Proof scripts

Hiding formulas: (-1 -2 -3 -4 -18 3), Using lemma translate_transformer_invariant, Using lemma expr_transformer_invariant_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -3 -4 -6 -7), Using lemma subset_transitive, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.2.1:

{-1} (address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean](pm_phy‘rw_addr))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-4} is_linear_plain_memory?(pm′)

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-9} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-11} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-15} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-16} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-17} interpreted_data_type?(segment_reg_data_type)
{-18} interpreted_data_type?(pdbr_data_type)
{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})
{1} (extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))) ⊆ pm_phy‘rw_addr)

{2} transformer_invariant?(pm′`states,

singleton(expr_2_super(translate(0, data (read_data

(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr, addr′, ac2′, segment_to_priv (data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))))

{3} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))
{4} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{5} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1945

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, Case splitting on restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr,

pm!1‘rw_addr)) = union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr), restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)),

we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.2.1.1:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < expt(2, 32)

{-5} address_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)

((#type_of := CS_, offset := 0#))(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (x′)

{1} pm_phy`rw_addr(x′)

{2} address_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)

((#type_of := CS_, offset := 0#))(s′_{1})),

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.2.1.1.
linear_resolve_same_result.1.1.1.1.1.1.2.1.2.1.2:

{-1} Mem?(x′`type_of)
{-2} 0 ≤ x′`offset
{-3} x′`offset < expt(2, 32)

{-4} address_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)

((#type_of := CS_, offset := 0#))(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (x′)

{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

{2} pm_phy`rw_addr(x′)

{3} address_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)

((#type_of := CS_, offset := 0#))(s′_{1})),

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (x′)

Keeping (1) and hiding *, Applying decompose-equality, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.2.1.2.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(x′′)

{1} union(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)) (x′′)

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.2.1.2.1.
linear_resolve_same_result.1.1.1.1.1.1.2.1.2.1.2.2:

{-1} union(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)) (x′′)

{1} union(pm′`ro_addr, pm′`rw_addr)(x′′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.2.1.2.2.

linear_resolve_same_result.1.1.1.1.1.1.2.1.2.2:

{-1} (address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean](pm_phy‘rw_addr))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-4} is_linear_plain_memory?(pm′)

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-9} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-11} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-15} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-16} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-17} interpreted_data_type?(segment_reg_data_type)
{-18} interpreted_data_type?(pdbr_data_type)
{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})
{1} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{2} transformer_invariant?(pm′`states,

singleton(expr_2_super(translate(0, data (read_data

(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr, addr′, ac2′, segment_to_priv (data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))))

{3} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))
{4} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{5} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1948

we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.2.2.1:

{-1} pe_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′))

⊃

(address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, pe_size)) ⊆ extend  [Address,  Memory_Address_4G ,  bool,  false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict  [Address,  Memory_Address_4G ,  boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{-2} (address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean](pm_phy‘rw_addr))

{-3} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)

{-6} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-7} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-9} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-10} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-12} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-15} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-16} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-17} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-18} interpreted_data_type?(segment_reg_data_type)
{-19} interpreted_data_type?(pdbr_data_type)
{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})
{1} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{2} transformer_invariant?(pm′`states,

singleton(expr_2_super(translate(0, data (read_data

(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr, addr′, ac2′, segment_to_priv (data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))))

{3} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))
{4} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{5} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1950

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma xlat_pe_in_pdir_range, Expanding the definition of pe_in_pt_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.2.2.1.

linear_resolve_same_result.1.1.1.1.1.1.2.1.2.2.2:

{-1} (address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean](pm_phy‘rw_addr))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-4} is_linear_plain_memory?(pm′)

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-9} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-11} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-15} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-16} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-17} interpreted_data_type?(segment_reg_data_type)
{-18} interpreted_data_type?(pdbr_data_type)
{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr,

addr′)`offset < max_linear_offset

{2} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{3} transformer_invariant?(pm′`states,

singleton(expr_2_super(translate(0, data (read_data

(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr, addr′, ac2′, segment_to_priv (data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))))

{4} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2})))))))
{5} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{6} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1952

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.2.2.2.

linear_resolve_same_result.1.1.1.1.1.1.2.1.3:

{-1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-2} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-4} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-9} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-11} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-15} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-16} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-17} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-18} interpreted_data_type?(segment_reg_data_type)
{-19} interpreted_data_type?(pdbr_data_type)
{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-24} is_linear_plain_memory?(pm′)
{-25} pm′`states(s′_{1})
{-26} pm′`states(s′_{2})

{1} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{3} xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))))`2,

addr′)

= xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))))`2,

addr′)

1954

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (-1 -2 -3 -14 3), Using lemma translate_transformer_invariant, Using lemma expr_transformer_invariant_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -3 -4 -6 -7), Using lemma subset_transitive, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.3.1:

{-1} (address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean](pm_phy‘rw_addr))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-4} is_linear_plain_memory?(pm′)

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-9} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-11} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-14} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-15} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-16} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-17} interpreted_data_type?(segment_reg_data_type)
{-18} interpreted_data_type?(pdbr_data_type)
{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})
{1} (extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))) ⊆ pm_phy‘rw_addr)

{2} transformer_invariant?(pm′`states,

singleton(expr_2_super(translate(0, data (read_data

(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr, addr′, ac1′, segment_to_priv (data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))))

{3} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))
{4} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{5} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1956

Keeping (-1 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

Case splitting on restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr)) = union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr), restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)),

we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.3.1.1:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

{-2} Mem?(x′`type_of)
{-3} 0 ≤ x′`offset
{-4} x′`offset < expt(2, 32)

{-5} address_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)

((#type_of := CS_, offset := 0#))(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (x′)

{1} pm_phy`rw_addr(x′)

{2} address_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)

((#type_of := CS_, offset := 0#))(s′_{1})),

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.3.1.1.
linear_resolve_same_result.1.1.1.1.1.1.2.1.3.1.2:

{-1} Mem?(x′`type_of)
{-2} 0 ≤ x′`offset
{-3} x′`offset < expt(2, 32)

{-4} address_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)

((#type_of := CS_, offset := 0#))(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (x′)

{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

{2} pm_phy`rw_addr(x′)

{3} address_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)

((#type_of := CS_, offset := 0#))(s′_{1})),

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (x′)

Keeping (1) and hiding *,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.3.1.2.

linear_resolve_same_result.1.1.1.1.1.1.2.1.3.2:

{-1} (address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean](pm_phy‘rw_addr))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-4} is_linear_plain_memory?(pm′)

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-9} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-11} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-14} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-15} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-16} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-17} interpreted_data_type?(segment_reg_data_type)
{-18} interpreted_data_type?(pdbr_data_type)
{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})
{1} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{2} transformer_invariant?(pm′`states,

singleton(expr_2_super(translate(0, data (read_data

(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr, addr′, ac1′, segment_to_priv (data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))))

{3} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))
{4} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{5} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1958

we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.1.3.2.1:

{-1} pe_in_pt_range?(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′))

⊃

(address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, pe_size)) ⊆ extend  [Address,  Memory_Address_4G ,  bool,  false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict  [Address,  Memory_Address_4G ,  boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))
{-2} (address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean](pm_phy‘rw_addr))

{-3} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)

{-6} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-7} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-9} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-10} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-12} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-15} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-16} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-17} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-18} interpreted_data_type?(segment_reg_data_type)
{-19} interpreted_data_type?(pdbr_data_type)
{-20} Mem?(addr′`type_of)
{-21} 0 ≤ addr′`offset
{-22} addr′`offset < max_linear_offset
{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})
{1} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{2} transformer_invariant?(pm′`states,

singleton(expr_2_super(translate(0, data (read_data

(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr, addr′, ac1′, segment_to_priv (data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))))

{3} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))
{4} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{5} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1960

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma xlat_pe_in_pdir_range, Expanding the definition of pe_in_pt_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.3.2.1.

linear_resolve_same_result.1.1.1.1.1.1.2.1.3.2.2:

{-1} (address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean](pm_phy‘rw_addr))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-3} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-4} is_linear_plain_memory?(pm′)

{-5} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-6} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-8} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-9} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-11} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-14} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-15} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-16} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-17} interpreted_data_type?(segment_reg_data_type)
{-18} interpreted_data_type?(pdbr_data_type)
{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})

{1} Mem?(xlat_idx[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr,

addr′)`type_of)

∧ 0 ≤ xlat_idx[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr,

addr′)`offset ∧ xlat_idx[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr,

addr′)`offset < max_linear_offset

{2} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1})), restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))))

{3} transformer_invariant?(pm′`states,

singleton(expr_2_super(translate(0, data (read_data

(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr, addr′, ac1′, segment_to_priv (data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1})))))))

{4} pm′`states

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))))))
{5} (address_block(xlat_idx(0, data(read_data(pm_phy, pdbr_data_type )(PDBR)(state(read_data(pm_phy, segment_reg_data_type )(CS)(s′_{1}))))‘base_addr, addr′), expt(2, 2)) ⊆ pm_phy‘rw_addr)

{6} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1962

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma xlat_idx_memory_address, Using lemma xlat_idx_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.1.3.2.2.

linear_resolve_same_result.1.1.1.1.1.1.2.2:

{-1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{-2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-3} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-4} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-5} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-6} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-7} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-8} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-9} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of

= Mem_ ∧ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-10} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of

= Mem_ ∧ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-11} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-12} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-13} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-14} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-15} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-16} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-17} interpreted_data_type?(segment_reg_data_type)
{-18} interpreted_data_type?(pdbr_data_type)
{-19} Mem?(addr′`type_of)
{-20} 0 ≤ addr′`offset
{-21} addr′`offset < max_linear_offset
{-22} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-23} is_linear_plain_memory?(pm′)
{-24} pm′`states(s′_{1})
{-25} pm′`states(s′_{2})

{1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{3} data(cases translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))) of

OK(state_1, data_1): ok_result(xlat_ofs(ptab_lvl, data_1`2, addr′))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

= data(cases translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))) of

OK(state_1, data_1): ok_result(xlat_ofs(ptab_lvl, data_1`2, addr′))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

1964

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Revealing hidden formulas, Hiding formulas: (-2 -5 -6 3), Expanding the definition of linear_resolve, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.1.2.2.1:

{-1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`1

{-2} OK?(OK(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2})))))),

xlat_ofs(0,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))`2,

addr′)))

{-3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-4} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-6} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-7} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-8} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-9} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-15} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-16} interpreted_data_type?(segment_reg_data_type)
{-17} interpreted_data_type?(pdbr_data_type)
{-18} Mem?(addr′`type_of)
{-19} 0 ≤ addr′`offset
{-20} addr′`offset < max_linear_offset
{-21} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-22} is_linear_plain_memory?(pm′)
{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})

{1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1966

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Replacing using formula -3, which is trivially true.

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.2.1.

linear_resolve_same_result.1.1.1.1.1.1.2.2.2:

{-1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{-2} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2})))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))))`2,

addr′)))

{-3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-4} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-6} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-7} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-8} Mem?(data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of)

{-9} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-15} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-16} interpreted_data_type?(segment_reg_data_type)
{-17} interpreted_data_type?(pdbr_data_type)
{-18} Mem?(addr′`type_of)
{-19} 0 ≤ addr′`offset
{-20} addr′`offset < max_linear_offset
{-21} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-22} is_linear_plain_memory?(pm′)
{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`1

{2} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{2}))))))))

{3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

1968

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Replacing using formula -3, which is trivially true.

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.2.2.

linear_resolve_same_result.1.1.1.1.1.1.2.3:

{-1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-3} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-4} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-6} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-7} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-8} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of

= Mem_ ∧ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-9} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`type_of

= Mem_ ∧ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2`offset

< max_linear_offset

{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-15} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-16} interpreted_data_type?(segment_reg_data_type)
{-17} interpreted_data_type?(pdbr_data_type)
{-18} Mem?(addr′`type_of)
{-19} 0 ≤ addr′`offset
{-20} addr′`offset < max_linear_offset
{-21} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-22} is_linear_plain_memory?(pm′)
{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})

{1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′_{1}))))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`1

{3} data(cases translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))) of

OK(state_1, data_1): ok_result(xlat_ofs(ptab_lvl, data_1`2, addr′))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

= data(cases translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))))`2,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{2}))))))) of

OK(state_1, data_1): ok_result(xlat_ofs(ptab_lvl, data_1`2, addr′))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

1970

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 3, Revealing hidden formulas, Expanding the definition of linear_resolve, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.1.2.3.

linear_resolve_same_result.1.1.1.1.1.2:

{-1} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-3} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-4} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-6} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-7} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-8} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-15} interpreted_data_type?(segment_reg_data_type)
{-16} interpreted_data_type?(pdbr_data_type)
{-17} Mem?(addr′`type_of)
{-18} 0 ≤ addr′`offset
{-19} addr′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-21} is_linear_plain_memory?(pm′)
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1972

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 2, Using lemma translate_same_result, we get 2 subgoals:

linear_resolve_same_result.1.1.1.1.1.2.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(addr′) ∧ is_linear_plain_memory?(pm′) ∧ pe_in_pt_range?(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1})))),

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), 0)

(xlat_idx(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′_{1}))))`base_addr,

addr′))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

=

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-3} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-4} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-6} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-7} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-8} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-9} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-13} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-14} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-15} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-16} interpreted_data_type?(segment_reg_data_type)
{-17} interpreted_data_type?(pdbr_data_type)
{-18} Mem?(addr′`type_of)
{-19} 0 ≤ addr′`offset
{-20} addr′`offset < max_linear_offset
{-21} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-22} is_linear_plain_memory?(pm′)
{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

1974

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-3 -4 -5 -6 -7 -8 -9 -10 2), Using lemma xlat_pe_in_pdir_range, Expanding the definition of pe_in_pt_range?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.1.2.1.

linear_resolve_same_result.1.1.1.1.1.2.2:

{-1} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-3} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-4} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-6} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-7} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-8} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-15} interpreted_data_type?(segment_reg_data_type)
{-16} interpreted_data_type?(pdbr_data_type)
{-17} Mem?(addr′`type_of)
{-18} 0 ≤ addr′`offset
{-19} addr′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-21} is_linear_plain_memory?(pm′)
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})

{1} aligned?(12)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

= data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

1976

This completes the proof of linear_resolve_same_result.1.1.1.1.1.2.2.

linear_resolve_same_result.1.1.1.1.1.3:

{-1} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-3} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-4} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-6} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-7} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-8} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-15} interpreted_data_type?(segment_reg_data_type)
{-16} interpreted_data_type?(pdbr_data_type)
{-17} Mem?(addr′`type_of)
{-18} 0 ≤ addr′`offset
{-19} addr′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-21} is_linear_plain_memory?(pm′)
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})

{1} OK?[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′_{1}))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1978

This completes the proof of linear_resolve_same_result.1.1.1.1.1.3.

linear_resolve_same_result.1.1.1.1.1.4:

{-1} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{-2} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-3} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-4} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-5} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-6} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-7} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-8} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-15} interpreted_data_type?(segment_reg_data_type)
{-16} interpreted_data_type?(pdbr_data_type)
{-17} Mem?(addr′`type_of)
{-18} 0 ≤ addr′`offset
{-19} addr′`offset < max_linear_offset
{-20} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-21} is_linear_plain_memory?(pm′)
{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})

{1} OK?[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′_{2}))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1980

This completes the proof of linear_resolve_same_result.1.1.1.1.1.4.

linear_resolve_same_result.1.1.1.1.2:

{-1} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{-2} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-3} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-4} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-5} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-6} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-7} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-8} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-10} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-11} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-12} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-13} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-14} interpreted_data_type?(segment_reg_data_type)
{-15} interpreted_data_type?(pdbr_data_type)
{-16} Mem?(addr′`type_of)
{-17} 0 ≤ addr′`offset
{-18} addr′`offset < max_linear_offset
{-19} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-20} is_linear_plain_memory?(pm′)
{-21} pm′`states(s′_{1})
{-22} pm′`states(s′_{2})

{1} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1982

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (-1 -2 -6 -7 -10 -13 2), Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.2.

linear_resolve_same_result.1.1.1.1.3:

{-1} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{-2} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-3} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-4} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-5} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-6} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-7} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-8} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-9} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-13} interpreted_data_type?(segment_reg_data_type)
{-14} interpreted_data_type?(pdbr_data_type)
{-15} Mem?(addr′`type_of)
{-16} 0 ≤ addr′`offset
{-17} addr′`offset < max_linear_offset
{-18} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-19} is_linear_plain_memory?(pm′)
{-20} pm′`states(s′_{1})
{-21} pm′`states(s′_{2})

{1} pm′`states

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1984

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (-1 -5 -6 -9 -12 2), Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.1.3.

linear_resolve_same_result.1.1.1.1.4:

{-1} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-2} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-3} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-4} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-5} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-6} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-8} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-12} interpreted_data_type?(segment_reg_data_type)
{-13} interpreted_data_type?(pdbr_data_type)
{-14} Mem?(addr′`type_of)
{-15} 0 ≤ addr′`offset
{-16} addr′`offset < max_linear_offset
{-17} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-18} is_linear_plain_memory?(pm′)
{-19} pm′`states(s′_{1})
{-20} pm′`states(s′_{2})

{1} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

= data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1986

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (-4 -5 -8 -11 2), Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -18 with the terms: (state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s1!1)) state(read_data(pm_phy, segment_reg_data_type)(CS)(s2!1))), we get 3 subgoals:

linear_resolve_same_result.1.1.1.1.4.1:

{-1} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-2} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-3} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-4} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-5} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-6} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-8} interpreted_data_type?(segment_reg_data_type)
{-9} interpreted_data_type?(pdbr_data_type)
{-10} Mem?(addr′`type_of)
{-11} 0 ≤ addr′`offset
{-12} addr′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

=

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-19} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-20} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-21} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-22} plain_memory?(pm_phy)
{-23} pm′`states = pm_phy`states
{-24} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-25} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-26} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-27} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-28} pm′`states(s′_{1})
{-29} pm′`states(s′_{2})

{1} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

=

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

1988

This completes the proof of linear_resolve_same_result.1.1.1.1.4.1.

linear_resolve_same_result.1.1.1.1.4.2:

{-1} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-2} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-3} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-4} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-5} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-6} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-8} interpreted_data_type?(segment_reg_data_type)
{-9} interpreted_data_type?(pdbr_data_type)
{-10} Mem?(addr′`type_of)
{-11} 0 ≤ addr′`offset
{-12} addr′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-19} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-20} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-21} plain_memory?(pm_phy)
{-22} pm′`states = pm_phy`states
{-23} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-24} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-25} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-26} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-27} pm′`states(s′_{1})
{-28} pm′`states(s′_{2})

{1} pm′`states

(state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2})))

{2} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

=

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

1990

This completes the proof of linear_resolve_same_result.1.1.1.1.4.2.

linear_resolve_same_result.1.1.1.1.4.3:

{-1} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{-2} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-3} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-4} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-5} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-6} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-8} interpreted_data_type?(segment_reg_data_type)
{-9} interpreted_data_type?(pdbr_data_type)
{-10} Mem?(addr′`type_of)
{-11} 0 ≤ addr′`offset
{-12} addr′`offset < max_linear_offset
{-13} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-14} pm′`mem = linear_pm
{-15} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s_{2}))

{-17} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-18} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-19} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-20} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-21} plain_memory?(pm_phy)
{-22} pm′`states = pm_phy`states
{-23} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-24} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-25} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-26} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-27} pm′`states(s′_{1})
{-28} pm′`states(s′_{2})

{1} pm′`states

(state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{2} data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))`base_addr

=

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))`base_addr

1992

This completes the proof of linear_resolve_same_result.1.1.1.1.4.3.

linear_resolve_same_result.1.1.1.2:

{-1} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))

{-2} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-3} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-4} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-5} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-6} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-7} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-8} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-10} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-11} interpreted_data_type?(segment_reg_data_type)
{-12} interpreted_data_type?(pdbr_data_type)
{-13} Mem?(addr′`type_of)
{-14} 0 ≤ addr′`offset
{-15} addr′`offset < max_linear_offset
{-16} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-17} is_linear_plain_memory?(pm′)
{-18} pm′`states(s′_{1})
{-19} pm′`states(s′_{2})
{1} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})))
{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1994

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (-1 -2 -3 -4 -6 -7 -9 -10 2), Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.2.

linear_resolve_same_result.1.1.1.3:

{-1} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) {-2} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-3} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-4} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-5} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-6} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-7} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-8} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-9} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-10} interpreted_data_type?(segment_reg_data_type)
{-11} interpreted_data_type?(pdbr_data_type)
{-12} Mem?(addr′`type_of)
{-13} 0 ≤ addr′`offset
{-14} addr′`offset < max_linear_offset
{-15} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-16} is_linear_plain_memory?(pm′)
{-17} pm′`states(s′_{1})
{-18} pm′`states(s′_{2})
{1} pm′`states(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})))
{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1996

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (-1 -2 -3 -5 -6 -8 -9 2), Using lemma pm_unchanged_singleton_linear_resolve_reg_transformers, Expanding the definition of linear_resolve_register_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Using lemma pm_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.1.3.

linear_resolve_same_result.1.1.1.4:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{1}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))`2

< max_linear

{-2} aligned?(bits_per_level + pe_size)

(offset

(data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′_{2}))))`base_addr))

∧ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))

⊃ data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))`2

< max_linear

{-3} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-4} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{-5} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{-6} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{-8} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, segment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-9} interpreted_data_type?(segment_reg_data_type)
{-10} interpreted_data_type?(pdbr_data_type)
{-11} Mem?(addr′`type_of)
{-12} 0 ≤ addr′`offset
{-13} addr′`offset < max_linear_offset
{-14} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-15} is_linear_plain_memory?(pm′)
{-16} pm′`states(s′_{1})
{-17} pm′`states(s′_{2})

{1} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

1998

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (-1 -2 -4 -5 -7 -8 2), Expanding the definition of is_linear_plain_memory?, Applying disjunctive simplification to flatten sequent, Instantiating the top quantifier in -11 with the terms: (s1!1 s2!1), we get 3 subgoals:

linear_resolve_same_result.1.1.1.4.1:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))
{-2} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))
{-3} interpreted_data_type?(segment_reg_data_type)
{-4} interpreted_data_type?(pdbr_data_type)
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-9} pm′`mem = linear_pm
{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))

{-11} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) =

data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{-12} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-14} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-15} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-16} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-17} plain_memory?(pm_phy)
{-18} pm′`states = pm_phy`states
{-19} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-20} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-21} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-22} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-23} pm′`states(s′_{1})
{-24} pm′`states(s′_{2})

{1} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

2000

This completes the proof of linear_resolve_same_result.1.1.1.4.1.

linear_resolve_same_result.1.1.1.4.2:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))
{-2} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))
{-3} interpreted_data_type?(segment_reg_data_type)
{-4} interpreted_data_type?(pdbr_data_type)
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-9} pm′`mem = linear_pm
{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-16} plain_memory?(pm_phy)
{-17} pm′`states = pm_phy`states
{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})
{1} pm′`states(s′_{2})

{2} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

2002

This completes the proof of linear_resolve_same_result.1.1.1.4.2.

linear_resolve_same_result.1.1.1.4.3:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))
{-2} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))
{-3} interpreted_data_type?(segment_reg_data_type)
{-4} interpreted_data_type?(pdbr_data_type)
{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-9} pm′`mem = linear_pm
{-10} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s))
{-11} ∀ (s: (pm′`states)): OK?(read_data(pm_phy, pdbr_data_type)(PDBR)(s))

{-12} ∀ (s_{1}, s_{2}: (pm′`states)):

data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{1})) = data(read_data(pm_phy, pdbr_data_type)(PDBR)(s_{2}))

{-13} ∀ (s_{1}, s_{2}: (pm′`states)):

pe_in_pdir_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_pdir_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

∧

pe_in_ptab_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

=

pe_in_ptab_range?(s_{2},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))): OK?(read_data(pm_phy, paging_data_type(lvl))(a)(s))

{-15} ∀ (s_{1}, s_{2}: (pm′`states), lvl: Level,

            a:

(pe_in_pt_range?(s_{1},

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), lvl))):

set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{1})), Write) = set_reference(data(read_data(pm_phy, paging_data_type(lvl))(a)(s_{2})), Write)

{-16} plain_memory?(pm_phy)
{-17} pm′`states = pm_phy`states
{-18} (pm′‘other_actions⊆ pm_phy‘other_actions)
{-19} (linear_resolve_register_transformers ⊆ pm_phy‘other_actions)

{-20} ∀ (a: ((pm′‘ro_addr∪ pm′‘rw_addr))):

Mem?(type_of(a)) ∧ 0 ≤ offset(a) ∧ offset(a) < max_linear_offset

{-21} ∀ (s: (pm′`states)):

linear_blessed?(s, restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

{-22} pm′`states(s′_{1})
{-23} pm′`states(s′_{2})
{1} pm′`states(s′_{1})

{2} data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) = data(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

2004

which is trivially true.

This completes the proof of linear_resolve_same_result.1.1.1.4.3.
linear_resolve_same_result.1.1.2:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-2} interpreted_data_type?(segment_reg_data_type)
{-3} interpreted_data_type?(pdbr_data_type)
{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-12} OK?(linear_resolve(addr′, ac2′)(s′_{2}))

{1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))`base_addr,

addr′, ac2′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{2}))))))
{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Hiding formulas: (-1 -8 2), Expanding the definition of linear_resolve, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.2.
linear_resolve_same_result.1.1.3:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-2} interpreted_data_type?(segment_reg_data_type)
{-3} interpreted_data_type?(pdbr_data_type)
{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-12} OK?(linear_resolve(addr′, ac2′)(s′_{2}))

{1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

⊃

OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

∨

Exception?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.3.

linear_resolve_same_result.1.1.4:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-2} interpreted_data_type?(segment_reg_data_type)
{-3} interpreted_data_type?(pdbr_data_type)
{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-12} OK?(linear_resolve(addr′, ac2′)(s′_{2}))

{1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2}))))

⊃

OK?[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

∨

Exception?[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.4.

linear_resolve_same_result.1.1.5:

{-1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{-2} interpreted_data_type?(segment_reg_data_type)
{-3} interpreted_data_type?(pdbr_data_type)
{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states(s′_{1})
{-10} pm′`states(s′_{2})
{-11} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-12} OK?(linear_resolve(addr′, ac2′)(s′_{2}))

{1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{2})) ⊃

OK?[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

∨

Exception?[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{2}))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.1.5.

linear_resolve_same_result.1.2:

{-1} interpreted_data_type?(segment_reg_data_type)
{-2} interpreted_data_type?(pdbr_data_type)
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-11} OK?(linear_resolve(addr′, ac2′)(s′_{2}))

{1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))`base_addr,

addr′, ac1′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′_{1}))))))
{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Hiding formulas: (-8 2),

Expanding the definition of linear_resolve,

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.2.

linear_resolve_same_result.1.3:

{-1} interpreted_data_type?(segment_reg_data_type)
{-2} interpreted_data_type?(pdbr_data_type)
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-11} OK?(linear_resolve(addr′, ac2′)(s′_{2}))

{1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

⊃

OK?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

∨

Exception?[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.3.

linear_resolve_same_result.1.4:

{-1} interpreted_data_type?(segment_reg_data_type)
{-2} interpreted_data_type?(pdbr_data_type)
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-11} OK?(linear_resolve(addr′, ac2′)(s′_{2}))

{1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ∧

OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1}))))

⊃

OK?[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

∨

Exception?[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.4.
linear_resolve_same_result.1.5:

{-1} interpreted_data_type?(segment_reg_data_type)
{-2} interpreted_data_type?(pdbr_data_type)
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′_{1})
{-9} pm′`states(s′_{2})
{-10} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-11} OK?(linear_resolve(addr′, ac2′)(s′_{2}))

{1} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′_{1})) ⊃

OK?[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

∨

Exception?[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′_{1}))

{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.1.5.

linear_resolve_same_result.2:

{-1} interpreted_data_type?(pdbr_data_type)
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′_{1})
{-8} pm′`states(s′_{2})
{-9} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-10} OK?(linear_resolve(addr′, ac2′)(s′_{2}))
{1} interpreted_data_type?(segment_reg_data_type)
{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Adding type constraints for segment_reg_data_type, Expanding the definition of pod_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.2.
linear_resolve_same_result.3:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} union(pm′`ro_addr, pm′`rw_addr)(addr′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′_{1})
{-7} pm′`states(s′_{2})
{-8} OK?(linear_resolve(addr′, ac1′)(s′_{1}))
{-9} OK?(linear_resolve(addr′, ac2′)(s′_{2}))
{1} interpreted_data_type?(pdbr_data_type)
{2} data(linear_resolve(addr′, ac1′)(s′_{1})) = data(linear_resolve(addr′, ac2′)(s′_{2}))

Adding type constraints for pdbr_data_type, Expanding the definition of pod_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_result.3.

Q.E.D.

C.117.56 Linear_Memory_Properties.delta_memory_address

Terse proof for delta_memory_address.
delta_memory_address:

{1} ∀ (addr: Memory_Address_4G, δ: nat): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ⊃ offset(addr + δ) < max_linear_offset

Repeatedly Skolemizing and flattening, Expanding the definition of +, Using lemma aligned_add_below, we get 2 subgoals:

delta_memory_address.1:

{-1} min_page ≤ bus_width ∧ offset(addr′) − rem(expt(2, min_page))(offset(addr′)) < expt(2, bus_width) ∧ aligned?(min_page)(offset(addr′) − rem(expt(2, min_page))(offset(addr′))) ∧ rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

⊃

offset(addr′) − rem(expt(2, min_page))(offset(addr′)) + rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, bus_width)

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} addr′‘offset + delta′ < max_linear_offset

Installing automatic rewrites from: (min_page! bus_width! max_linear_offset!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma rem_def2, Expanding the definition of aligned?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of delta_memory_address.1.

delta_memory_address.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} delta′ ≥ 0
{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} offset(addr′) − rem(expt(2, min_page))(offset(addr′)) ≥ 0
{2} addr′‘offset + delta′ < max_linear_offset

Using lemma rem_floor, Case splitting on expt(2, min_page) * floor(offset(addr!1) / expt(2, min_page)) >= 0, we get 2 subgoals:

delta_memory_address.2.1:

{-1} expt(2, min_page) × floor(offset(addr′)/expt(2, min_page)) ≥ 0

{-2} offset(addr′) =

rem(expt(2, min_page))(offset(addr′)) + expt(2, min_page) × floor(offset(addr′)/expt(2, min_page))

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} offset(addr′) − rem(expt(2, min_page))(offset(addr′)) ≥ 0
{2} addr′‘offset + delta′ < max_linear_offset

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of delta_memory_address.2.1.

delta_memory_address.2.2:

{-1} offset(addr′) =

rem(expt(2, min_page))(offset(addr′)) + expt(2, min_page) × floor(offset(addr′)/expt(2, min_page))

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} expt(2, min_page) × floor(offset(addr′)/expt(2, min_page)) ≥ 0
{2} offset(addr′) − rem(expt(2, min_page))(offset(addr′)) ≥ 0
{3} addr′‘offset + delta′ < max_linear_offset

Using lemma nonneg_floor_is_nat, we get 2 subgoals:

delta_memory_address.2.2.1:

{-1} floor(offset(addr′)/expt(2, min_page)) ≥ 0

{-2} offset(addr′) =

rem(expt(2, min_page))(offset(addr′)) + expt(2, min_page) × floor(offset(addr′)/expt(2, min_page))

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} expt(2, min_page) × floor(offset(addr′)/expt(2, min_page)) ≥ 0
{2} offset(addr′) − rem(expt(2, min_page))(offset(addr′)) ≥ 0
{3} addr′‘offset + delta′ < max_linear_offset

Rewriting using nnreal_times_nnreal_is_nnreal, matching in *,

This completes the proof of delta_memory_address.2.2.1.
delta_memory_address.2.2.2:

{-1} offset(addr′) =

rem(expt(2, min_page))(offset(addr′)) + expt(2, min_page) × floor(offset(addr′)/expt(2, min_page))

{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} offset(addr′)/expt(2, min_page) ≥ 0
{2} expt(2, min_page) × floor(offset(addr′)/expt(2, min_page)) ≥ 0
{3} offset(addr′) − rem(expt(2, min_page))(offset(addr′)) ≥ 0
{4} addr′‘offset + delta′ < max_linear_offset

Rewriting using nnreal_div_posreal_is_nnreal, matching in *,

This completes the proof of delta_memory_address.2.2.2.

Q.E.D.

C.117.57 Linear_Memory_Properties.xlat_idx_same_page_address_TCC1

Terse proof for xlat_idx_same_page_address_TCC1.

xlat_idx_same_page_address_TCC1:

{1} ∀ (addr: Memory_Address_4G, lvl: Level, a: Memory_Address_4G): offset(a) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_idx_same_page_address_TCC1.

Q.E.D.

C.117.58 Linear_Memory_Properties.xlat_idx_same_page_address_TCC2

Terse proof for xlat_idx_same_page_address_TCC2.
xlat_idx_same_page_address_TCC2:

{1} ∀ (addr: Memory_Address_4G, δ: nat, lvl: Level,

base:

{a: Memory_Address_4G |

aligned?(bits_per_level [Physical_memory, pm_phy] + pe_size)

(offset(a))}): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ⊃ 0 ≤ (addr + δ)`offset ∧ (addr + δ)`offset < max_linear_offset

Repeatedly Skolemizing and flattening, Rewriting using delta_memory_address, matching in *, Expanding the definition of +, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address_TCC2.

Q.E.D.

C.117.59 Linear_Memory_Properties.xlat_idx_same_page_address

Terse proof for xlat_idx_same_page_address.
xlat_idx_same_page_address:

{1} ∀ (addr: Memory_Address_4G, δ: nat, lvl: Level,

base:

{a: Memory_Address_4G | aligned?(bits_per_level + pe_size)(offset(a))}): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ⊃ xlat_idx(lvl, base, addr) = xlat_idx(lvl, base, addr + δ)

Repeatedly Skolemizing and flattening, Expanding the definition of xlat_idx, Expanding the definition of cut_bits, Installing automatic rewrites from: (bus_width! bits_per_level! max_level! min_page!) Case splitting on bus_width - bits_per_level - bits_per_level * lvl!1 >= 0, we get 2 subgoals:

xlat_idx_same_page_address.1:

{-1} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{-11} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size) = base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′ + delta′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size)

Case splitting on ndiv(offset(addr!1), expt(2, -1 * (bits_per_level * lvl!1) - bits_per_level + bus_width)) = ndiv(offset(addr!1 + delta!1), expt(2, -1 * (bits_per_level * lvl!1) - bits_per_level + bus_width)),

we get 3 subgoals:

xlat_idx_same_page_address.1.1:

{-1} ndiv(offset(addr′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width)) = ndiv(offset(addr′ + delta′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

{-2} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(bits_per_level + pe_size)(offset(base′))
{-12} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size) = base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′ + delta′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.1.

xlat_idx_same_page_address.1.2:

{-1} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{-11} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} ndiv(offset(addr′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width)) = ndiv(offset(addr′ + delta′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

{2} base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size) = base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′ + delta′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size)

Hiding formulas: 2,

Expanding the definition of +,

Using lemma ndiv_plus_mod,

we get 2 subgoals:

xlat_idx_same_page_address.1.2.1:

{-1} divides(expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width), offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)))

⊃

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)) + rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

=

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

{-2} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(bits_per_level + pe_size)(offset(base′))
{-12} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} ndiv(offset(addr′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width)) = ndiv(addr′‘offset + delta′,

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

Using lemma ndiv_plus_mod,

we get 3 subgoals:

xlat_idx_same_page_address.1.2.1.1:

{-1} divides(expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width), offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)))

⊃

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)) + rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)) + delta′,

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

=

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

{-2} divides(expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width), offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)))

⊃

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)) + rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

=

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

{-3} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} delta′ ≥ 0
{-8} lvl′ < max_level
{-9} Mem?(base′`type_of)
{-10} 0 ≤ base′`offset
{-11} base′`offset < max_linear_offset
{-12} aligned?(bits_per_level + pe_size)(offset(base′))
{-13} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} ndiv(offset(addr′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width)) = ndiv(addr′‘offset + delta′,

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma rem_def2,

we get 2 subgoals:

xlat_idx_same_page_address.1.2.1.1.1:

{-1} true ≡

divides(expt(2, 22 − 10 × lvl′),

offset(addr′) − rem(expt(2, 22 − 10 × lvl′))(offset(addr′)))

{-2} 22 − 10 × lvl′ ≥ 0
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < 2
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(10 + pe_size)(offset(base′))
{-12} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} divides(expt(2, 22 − 10 × lvl′),

offset(addr′) − rem(expt(2, 22 − 10 × lvl′))(offset(addr′)))

{2} ndiv(offset(addr′), expt(2, 22 − 10 × lvl′)) = ndiv(addr′‘offset + delta′, expt(2, 22 − 10 × lvl′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of xlat_idx_same_page_address.1.2.1.1.1.
xlat_idx_same_page_address.1.2.1.1.2:

{-1} 22 − 10 × lvl′ ≥ 0
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < 2
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(10 + pe_size)(offset(base′))
{-11} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) <

expt(2, 22 − 10 × lvl′) {2} divides(expt(2, 22 − 10 × lvl′),

offset(addr′) − rem(expt(2, 22 − 10 × lvl′))(offset(addr′)))

{3} ndiv(offset(addr′), expt(2, 22 − 10 × lvl′)) = ndiv(addr′‘offset + delta′, expt(2, 22 − 10 × lvl′))

Adding type constraints for rem(expt(2, bus_width - bits_per_level - bits_per_level * lvl!1)) (offset(addr!1)),

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of xlat_idx_same_page_address.1.2.1.1.2.

xlat_idx_same_page_address.1.2.1.2:

{-1} divides(expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width), offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)))

⊃

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)) + rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

=

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

{-2} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(bits_per_level + pe_size)(offset(base′))
{-12} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′) {2} ndiv(offset(addr′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width)) = ndiv(addr′‘offset + delta′,

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

Keeping (-2 -6 -7 -11 -12 1) and hiding *, Using lemma aligned_add_below, we get 3 subgoals:

xlat_idx_same_page_address.1.2.1.2.1:

{-1} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′ ∧ rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) − rem(expt(2, min_page))(offset(addr′)) < expt(2, bus_width− bits_per_level − bits_per_level × lvl′) ∧ aligned?(min_page)

(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) − rem(expt(2, min_page))(offset(addr′))) ∧ rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

⊃

rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) − rem(expt(2, min_page))(offset(addr′)) + rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, bus_width− bits_per_level − bits_per_level × lvl′)

{-2} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-3} delta′ ≥ 0
{-4} lvl′ < max_level
{-5} aligned?(bits_per_level + pe_size)(offset(base′))
{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ < expt(2, 22 − 10 × lvl′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

xlat_idx_same_page_address.1.2.1.2.1.1:

{-1} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{-2} 22 − 10 × lvl′ ≥ 0
{-3} delta′ ≥ 0
{-4} lvl′ < 2
{-5} aligned?(10 + pe_size)(offset(base′))
{1} aligned?(12)

(rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′)))

{2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ < expt(2, 22 − 10 × lvl′)

Expanding the definition of aligned?, Using lemma rem_def2, Rewriting using rem_rem, matching in *, we get 2 subgoals:

xlat_idx_same_page_address.1.2.1.2.1.1.1:

{-1} true ≡

divides(expt(2, min_page),

rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′)))

{-2} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{-3} 22 − 10 × lvl′ ≥ 0
{-4} delta′ ≥ 0
{-5} lvl′ < 2
{-6} divides(expt(2, 10 + pe_size), offset(base′))

{1} divides(expt(2, 12),

rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′)))

{2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ < expt(2, 22 − 10 × lvl′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.2.1.2.1.1.1.
xlat_idx_same_page_address.1.2.1.2.1.1.2:

{-1} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{-2} 22 − 10 × lvl′ ≥ 0
{-3} delta′ ≥ 0
{-4} lvl′ < 2
{-5} divides(expt(2, 10 + pe_size), offset(base′))
{1} divides(expt(2, 12), expt(2, 22 − 10 × lvl′))

{2} rem(expt(2, 12))(rem(expt(2, 22 − 10 × lvl′))(offset(addr′))) =

rem(expt(2, 12))(offset(addr′)) {3} divides(expt(2, 12),

rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′)))

{4} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ < expt(2, 22 − 10 × lvl′)

Keeping (-2 1) and hiding *, Using lemma divides_expt_gt, Rewriting using divides_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.2.1.2.1.1.2.

xlat_idx_same_page_address.1.2.1.2.1.2:

{-1} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{-2} 22 − 10 × lvl′ ≥ 0
{-3} delta′ ≥ 0
{-4} lvl′ < 2
{-5} aligned?(10 + pe_size)(offset(base′))

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

< expt(2, 22 − 10 × lvl′) {2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′)

Adding type constraints for rem(expt(2, bus_width - bits_per_level - bits_per_level * lvl!1)) (offset(addr!1)),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.2.1.2.1.2.
xlat_idx_same_page_address.1.2.1.2.2:

{-1} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-2} delta′ ≥ 0
{-3} lvl′ < max_level
{-4} aligned?(bits_per_level + pe_size)(offset(base′))
{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′)

Using lemma rem_floor, we get 2 subgoals:

xlat_idx_same_page_address.1.2.1.2.2.1:

{-1} rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(offset(addr′)) = rem(expt(2, 12))(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))) + expt(2, 12) × floor(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))/expt(2, 12))

{-2} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-3} delta′ ≥ 0
{-4} lvl′ < max_level
{-5} aligned?(bits_per_level + pe_size)(offset(base′))
{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′)

Rewriting using rem_rem, matching in *, we get 2 subgoals:

xlat_idx_same_page_address.1.2.1.2.2.1.1:

{-1} rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(offset(addr′)) = rem(expt(2, 12))(offset(addr′)) + expt(2, 12) × floor(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))/expt(2, 12))

{-2} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-3} delta′ ≥ 0
{-4} lvl′ < max_level
{-5} aligned?(bits_per_level + pe_size)(offset(base′))
{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′)

Adding type constraints for expt(2, 12) * floor(rem(expt(2, bus_width - bits_per_level - bits_per_level * lvl!1)) (offset(addr!1)) / expt(2, min_page)),

we get 2 subgoals:

xlat_idx_same_page_address.1.2.1.2.2.1.1.1:

{-1} expt(2, 12) × floor(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))/expt(2, min_page))

≥ 0 {-2} divides(expt(2, 12))

(expt(2, 12) × floor(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))/expt(2, min_page)))

{-3} divides(floor(rem(expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))(offset(addr′))/expt(2, min_page)))

(expt(2, 12) × floor(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))/expt(2, min_page)))

{-4} rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(offset(addr′)) = rem(expt(2, 12))(offset(addr′)) + expt(2, 12) × floor(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))/expt(2, 12))

{-5} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} aligned?(bits_per_level + pe_size)(offset(base′))
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.2.1.2.2.1.1.1.

xlat_idx_same_page_address.1.2.1.2.2.1.1.2:

{-1} rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(offset(addr′)) = rem(expt(2, 12))(offset(addr′)) + expt(2, 12) × floor(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))/expt(2, 12))

{-2} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-3} delta′ ≥ 0
{-4} lvl′ < max_level
{-5} aligned?(bits_per_level + pe_size)(offset(base′))
{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} 22 − 10 × lvl′ ≥ 0

{2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {3} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.2.1.2.2.1.1.2.
xlat_idx_same_page_address.1.2.1.2.2.1.2:

{-1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) =

rem(expt(2, 12))(rem(expt(2, 22 − 10 × lvl′))(offset(addr′))) + expt(2, 12) × floor(rem(expt(2, 22 − 10 × lvl′))(offset(addr′))/expt(2, 12))

{-2} 22 − 10 × lvl′ ≥ 0
{-3} delta′ ≥ 0
{-4} lvl′ < 2
{-5} aligned?(10 + pe_size)(offset(base′))
{-6} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{1} divides(expt(2, 12), expt(2, 22 − 10 × lvl′))

{2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {3} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′)

Keeping (-2 1) and hiding *, Using lemma divides_expt_gt, Rewriting using divides_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.2.1.2.2.1.2.
xlat_idx_same_page_address.1.2.1.2.2.2:

{-1} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-2} delta′ ≥ 0
{-3} lvl′ < max_level
{-4} aligned?(bits_per_level + pe_size)(offset(base′))
{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} 22 − 10 × lvl′ ≥ 0

{2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {3} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ <

expt(2, 22 − 10 × lvl′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.2.1.2.2.2.

xlat_idx_same_page_address.1.2.1.2.3:

{-1} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-2} delta′ ≥ 0
{-3} lvl′ < max_level
{-4} aligned?(bits_per_level + pe_size)(offset(base′))
{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} 22 − 10 × lvl′ ≥ 0

{2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ < expt(2, 22 − 10 × lvl′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_idx_same_page_address.1.2.1.2.3.
xlat_idx_same_page_address.1.2.1.3:

{-1} divides(expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width), offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)))

⊃

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)) + rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

=

ndiv(offset(addr′) − rem(expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))(offset(addr′)),

expt(2,

−1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

{-2} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(bits_per_level + pe_size)(offset(base′))
{-12} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} 22 − 10 × lvl′ ≥ 0

{2} ndiv(offset(addr′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width)) = ndiv(addr′‘offset + delta′,

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of xlat_idx_same_page_address.1.2.1.3.

xlat_idx_same_page_address.1.2.2:

{-1} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{-11} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} 22 − 10 × lvl′ ≥ 0

{2} ndiv(offset(addr′),

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width)) = ndiv(addr′‘offset + delta′,

expt(2, −1 × (bits_per_level × lvl′) − bits_per_level + bus_width))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of xlat_idx_same_page_address.1.2.2.

xlat_idx_same_page_address.1.3:

{-1} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{-11} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} 22 − 10 × lvl′ ≥ 0

{2} base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size) = base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′ + delta′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of xlat_idx_same_page_address.1.3.

xlat_idx_same_page_address.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} delta′ ≥ 0
{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))
{-10} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{1} bus_width− bits_per_level − bits_per_level × lvl′ ≥ 0

{2} base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size) = base′ + shift_bits_left (rem(expt(2, bits_per_level ))(ndiv(offset(addr′ + delta′), expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))), pe_size)

Keeping (-5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_idx_same_page_address.2.

Q.E.D.

C.117.60 Linear_Memory_Properties.xlat_ofs_same_page_address_TCC1

Terse proof for xlat_ofs_same_page_address_TCC1.
xlat_ofs_same_page_address_TCC1:

{1} ∀ (addr: Memory_Address_4G, lvl: Level, a: Memory_Address_4G): bus_width− (lvl + 1) × bits_per_level [Physical_memory, pm_phy] ≥ 0

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: (bits_per_level! max_level! bus_width! pe_size!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address_TCC1.

Q.E.D.

C.117.61 Linear_Memory_Properties.xlat_ofs_same_page_address_TCC2

Terse proof for xlat_ofs_same_page_address_TCC2.
xlat_ofs_same_page_address_TCC2:

{1} ∀ (addr: Memory_Address_4G, δ: nat, lvl: Level,

base:

{a: Memory_Address_4G |

aligned?(bus_width− (lvl + 1) × bits_per_level[Physical_memory, pm_phy])

(offset(a))}): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ⊃ 0 ≤ (addr + δ)`offset ∧ (addr + δ)`offset < max_linear_offset

Repeatedly Skolemizing and flattening, Rewriting using delta_memory_address, matching in *, Expanding the definition of +, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address_TCC2.

Q.E.D.

C.117.62 Linear_Memory_Properties.xlat_ofs_same_page_address

Terse proof for xlat_ofs_same_page_address.
xlat_ofs_same_page_address:

{1} ∀ (addr: Memory_Address_4G, δ: nat, lvl: Level,

base:

{a: Memory_Address_4G |

aligned?(bus_width− (lvl + 1) × bits_per_level )

(offset(a))}): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ⊃ xlat_ofs(lvl, base, addr) + δ = xlat_ofs(lvl, base, addr + δ)

Repeatedly Skolemizing and flattening, Expanding the definition of xlat_ofs, Expanding the definition of cut_bits, Installing automatic rewrites from: (expt_x0_aux! ndiv_1! bits_per_level! min_page! bus_width!) Simplifying, rewriting, and recording with decision procedures, Case splitting on min_page <= bus_width - bits_per_level - bits_per_level * lvl!1, we get 2 subgoals:

xlat_ofs_same_page_address.1:

{-1} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(22 − 10 × lvl′)(offset(base′))
{-11} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ = base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′ + delta′))

Case splitting on rem(expt(2, bus_width - bits_per_level - bits_per_level * lvl!1)) (offset(addr!1)) + delta!1 = rem(expt(2, bus_width - bits_per_level - bits_per_level * lvl!1)) (offset(addr!1 + delta!1)),

we get 3 subgoals:

xlat_ofs_same_page_address.1.1:

{-1} rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) + delta′ = rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(offset(addr′ + delta′))

{-2} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(22 − 10 × lvl′)(offset(base′))
{-12} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ = base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′ + delta′))

Expanding the definition of +,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address.1.1.
xlat_ofs_same_page_address.1.2:

{-1} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(22 − 10 × lvl′)(offset(base′))
{-11} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) + delta′ = rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(offset(addr′ + delta′))

{2} base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ = base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′ + delta′))

Hiding formulas: 2,

Expanding the definition of +,

Using lemma rem_sum_assoc,

we get 2 subgoals:

xlat_ofs_same_page_address.1.2.1:

{-1} rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(addr′‘offset + delta′) = rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(addr′‘offset) + delta′ ≡ rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(addr′`offset) < expt(2, bus_width− bits_per_level − bits_per_level × lvl′) − delta′

{-2} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(22 − 10 × lvl′)(offset(base′))
{-12} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} rem(expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))(offset(addr′)) + delta′ = rem(expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))

(addr′‘offset + delta′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma aligned_add_below,

we get 2 subgoals:

xlat_ofs_same_page_address.1.2.1.1:

{-1} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′ ∧ rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) − rem(expt(2, min_page))(offset(addr′)) < expt(2, bus_width− bits_per_level − bits_per_level × lvl′) ∧ aligned?(min_page)

(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) − rem(expt(2, min_page))(offset(addr′))) ∧ rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

⊃

rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′)) − rem(expt(2, min_page))(offset(addr′)) + rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, bus_width− bits_per_level − bits_per_level × lvl′)

{-2} 12 ≤ 22 − 10 × lvl′
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(22 − 10 × lvl′)(offset(base′))
{-12} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′) =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset) + delta′ {2} rem(expt(2, 22 − 10 × lvl′))(addr′`offset) <

expt(2, 22 − 10 × lvl′) − delta′ {3} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

xlat_ofs_same_page_address.1.2.1.1.1:

{-1} 12 ≤ 22 − 10 × lvl′
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(22 − 10 × lvl′)(offset(base′))
{-11} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} aligned?(12)

(rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′)))

{2} rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′) =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset) + delta′ {3} rem(expt(2, 22 − 10 × lvl′))(addr′`offset) <

expt(2, 22 − 10 × lvl′) − delta′ {4} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′)

Expanding the definition of aligned?, Using lemma rem_def2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using rem_rem, matching in *, Using lemma divides_expt_gt, Rewriting using divides_reflexive, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address.1.2.1.1.1.
xlat_ofs_same_page_address.1.2.1.1.2:

{-1} 12 ≤ 22 − 10 × lvl′
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(22 − 10 × lvl′)(offset(base′))
{-11} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

< expt(2, 22 − 10 × lvl′) {2} rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′) =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset) + delta′ {3} rem(expt(2, 22 − 10 × lvl′))(addr′`offset) <

expt(2, 22 − 10 × lvl′) − delta′ {4} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′)

Adding type constraints for rem(expt(2, bus_width - bits_per_level - bits_per_level * lvl!1)) (offset(addr!1)),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address.1.2.1.1.2.
xlat_ofs_same_page_address.1.2.1.2:

{-1} 12 ≤ 22 − 10 × lvl′
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(22 − 10 × lvl′)(offset(base′))
{-11} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {2} rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′) =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset) + delta′ {3} rem(expt(2, 22 − 10 × lvl′))(addr′`offset) <

expt(2, 22 − 10 × lvl′) − delta′ {4} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′)

Using lemma rem_floor,

Rewriting using rem_rem, matching in *,

we get 2 subgoals:

xlat_ofs_same_page_address.1.2.1.2.1:

{-1} rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))

(offset(addr′)) = rem(expt(2, 12))(offset(addr′)) + expt(2, 12) × floor(rem(expt(2, bus_width− bits_per_level − bits_per_level × lvl′))(offset(addr′))/expt(2, 12))

{-2} 12 ≤ 22 − 10 × lvl′
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(22 − 10 × lvl′)(offset(base′))
{-12} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)

{1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {2} rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′) =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset) + delta′ {3} rem(expt(2, 22 − 10 × lvl′))(addr′`offset) <

expt(2, 22 − 10 × lvl′) − delta′ {4} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′)

Adding type constraints for expt(2, min_page) * floor(rem(expt(2, bus_width - bits_per_level - bits_per_level * lvl!1)) (offset(addr!1)) / expt(2, min_page)),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address.1.2.1.2.1.

xlat_ofs_same_page_address.1.2.1.2.2:

{-1} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) =

rem(expt(2, 12))(rem(expt(2, 22 − 10 × lvl′))(offset(addr′))) + expt(2, 12) × floor(rem(expt(2, 22 − 10 × lvl′))(offset(addr′))/expt(2, 12))

{-2} 12 ≤ 22 − 10 × lvl′
{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} lvl′ < max_level
{-8} Mem?(base′`type_of)
{-9} 0 ≤ base′`offset
{-10} base′`offset < max_linear_offset
{-11} aligned?(22 − 10 × lvl′)(offset(base′))
{-12} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{1} divides(expt(2, 12), expt(2, 22 − 10 × lvl′))

{2} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) − rem(expt(2, 12))(offset(addr′))

≥ 0 {3} rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′) =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset) + delta′ {4} rem(expt(2, 22 − 10 × lvl′))(addr′`offset) <

expt(2, 22 − 10 × lvl′) − delta′ {5} rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ =

rem(expt(2, 22 − 10 × lvl′))(addr′‘offset + delta′)

Using lemma divides_expt_gt,

Rewriting using divides_reflexive, matching in *,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address.1.2.1.2.2.
xlat_ofs_same_page_address.1.2.2:

{-1} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(22 − 10 × lvl′)(offset(base′))
{-11} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{1} 22 − 10 × lvl′ ≥ 0

{2} rem(expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))(offset(addr′)) + delta′ = rem(expt(2, −1 × bits_per_level × lvl′ − bits_per_level + bus_width))

(addr′‘offset + delta′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address.1.2.2.

xlat_ofs_same_page_address.1.3:

{-1} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(22 − 10 × lvl′)(offset(base′))
{-11} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{1} 22 − 10 × lvl′ ≥ 0

{2} base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ = base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′ + delta′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of xlat_ofs_same_page_address.1.3.
xlat_ofs_same_page_address.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} delta′ ≥ 0
{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} aligned?(22 − 10 × lvl′)(offset(base′))
{-10} rem(expt(2, 12))(offset(addr′)) + delta′ < expt(2, 12)
{1} min_page ≤ bus_width− bits_per_level − bits_per_level × lvl′

{2} base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′)) + delta′ = base′ + rem(expt(2, 22 − 10 × lvl′))(offset(addr′ + delta′))

Keeping (-5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of xlat_ofs_same_page_address.2.

Q.E.D.

C.117.63 Linear_Memory_Properties.translate_same_page_address_ok

Terse proof for translate_same_page_address_ok.
translate_same_page_address_ok:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], addr: Mem- ory_Address_4G, δ: nat, lvl: Level, base: {a: Memory_Address_4G | aligned?(bits_per_level + pe_size)(offset(a))}, access: Memory_access, priv: Memory_privilege): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ⊃ OK?(translate(lvl, base, addr + δ, access, priv)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of translate, Case splitting on xlat_idx(lvl!1, base!1, addr!1 + delta!1) = xlat_idx(lvl!1, base!1, addr!1), we get 2 subgoals:

translate_same_page_address_ok.1:

{-1} xlat_idx(lvl′, base′, addr′ + delta′) = xlat_idx(lvl′, base′, addr′)
{-2} Mem?(addr′`type_of)
{-3} 0 ≤ addr′`offset
{-4} addr′`offset < max_linear_offset
{-5} delta′ ≥ 0
{-6} lvl′ < max_level
{-7} Mem?(base′`type_of)
{-8} 0 ≤ base′`offset
{-9} base′`offset < max_linear_offset
{-10} aligned?(bits_per_level + pe_size)(offset(base′))
{-11} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{-12} OK?((read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} OK?((read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′))

##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe)) else raise_fault(priv′, access′, true, addr′ + delta′) endif

else raise_fault(priv′, access′, false, addr′ + delta′)

endif else fatal_result endif))

(s′))

Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res! raise_fault! exception_result! ok_result! fatal_result!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_same_page_address_ok.1.
translate_same_page_address_ok.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} delta′ ≥ 0
{-5} lvl′ < max_level
{-6} Mem?(base′`type_of)
{-7} 0 ≤ base′`offset
{-8} base′`offset < max_linear_offset
{-9} aligned?(bits_per_level + pe_size)(offset(base′))
{-10} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{-11} OK?((read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{1} xlat_idx(lvl′, base′, addr′ + delta′) = xlat_idx(lvl′, base′, addr′)

{2} OK?((read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′))

##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe)) else raise_fault(priv′, access′, true, addr′ + delta′) endif

else raise_fault(priv′, access′, false, addr′ + delta′)

endif else fatal_result endif))

(s′))

Hiding formulas: (-9 2), Using lemma xlat_idx_same_page_address,

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_same_page_address_ok.2.

Q.E.D.

C.117.64 Linear_Memory_Properties.translate_same_page_address_result

Terse proof for translate_same_page_address_result.
translate_same_page_address_result:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], addr: Mem- ory_Address_4G, δ: nat, lvl: Level, base: {a: Memory_Address_4G | aligned?(bits_per_level + pe_size)(offset(a))}, access: Memory_access, priv: Memory_privilege): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ∧ OK?(translate(lvl, base, addr, access, priv)(s)) ⊃ translate(lvl, base, addr, access, priv)(s) = translate(lvl, base, addr + δ, access, priv)(s)

Repeatedly Skolemizing and flattening, Using lemma translate_same_page_address_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of translate, Case splitting on xlat_idx(lvl!1, base!1, addr!1 + delta!1) = xlat_idx(lvl!1, base!1, addr!1), we get 2 subgoals:

translate_same_page_address_result.1:

{-1} xlat_idx(lvl′, base′, addr′ + delta′) = xlat_idx(lvl′, base′, addr′)
{-2} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{-3} OK?((read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{-4} OK?((read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′))

##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe)) else raise_fault(priv′, access′, true, addr′ + delta′) endif

else raise_fault(priv′, access′, false, addr′ + delta′)

endif else fatal_result endif))

(s′))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} lvl′ < max_level
{-10} Mem?(base′`type_of)
{-11} 0 ≤ base′`offset
{-12} base′`offset < max_linear_offset
{-13} aligned?(bits_per_level + pe_size)(offset(base′))

{1} (read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′) = (read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′))

##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe)) else raise_fault(priv′, access′, true, addr′ + delta′) endif

else raise_fault(priv′, access′, false, addr′ + delta′)

endif else fatal_result endif))

(s′)

2040

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res! raise_fault! exception_result! fatal_result! ok_result!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_same_page_address_result.1.

translate_same_page_address_result.2:

{-1} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)

{-2} OK?((read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′))

{-3} OK?((read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′))

##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe)) else raise_fault(priv′, access′, true, addr′ + delta′) endif

else raise_fault(priv′, access′, false, addr′ + delta′)

endif else fatal_result endif))

(s′))

{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} delta′ ≥ 0
{-8} lvl′ < max_level
{-9} Mem?(base′`type_of)
{-10} 0 ≤ base′`offset
{-11} base′`offset < max_linear_offset
{-12} aligned?(bits_per_level + pe_size)(offset(base′))
{1} xlat_idx(lvl′, base′, addr′ + delta′) = xlat_idx(lvl′, base′, addr′)

{2} (read_data(pm_phy, paging_data_type(lvl′))(xlat_idx(lvl′, base′, addr′)) ##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′), set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe))

else raise_fault(priv′, access′, true, addr′)

endif else raise_fault(priv′, access′, false, addr′) endif else fatal_result endif))

(s′) = (read_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′))

##

(λ (pe: (range_pt(lvl′))):

if paging_type?(lvl′, pe) then if present?(pe)

then if accessible?(pe, access′) ∧ privileged?(pe, priv′)

then write_data(pm_phy, paging_data_type(lvl′))

(xlat_idx(lvl′, base′, addr′ + delta′),

set_reference(pe, access′))

## ok_result(is_leaf?(pe), base(pe)) else raise_fault(priv′, access′, true, addr′ + delta′) endif

else raise_fault(priv′, access′, false, addr′ + delta′)

endif else fatal_result endif))

(s′)

2042

Hiding formulas: (-2 -3 2), Using lemma xlat_idx_same_page_address, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of translate_same_page_address_result.2.

Q.E.D.

C.117.65 Linear_Memory_Properties.linear_resolve_same_page_address_ok_TCC1

Terse proof for linear_resolve_same_page_address_ok_TCC1.
linear_resolve_same_page_address_ok_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], addr: Mem-

ory_Address_4G, δ: nat,

ac: Memory_access): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ∧ OK?(linear_resolve(addr, ac)(s)) ⊃ 0 ≤ (addr + δ)`offset ∧ (addr + δ)`offset < max_linear_offset

Repeatedly Skolemizing and flattening, Rewriting using delta_memory_address, matching in *, Expanding the definition of +, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_page_address_ok_TCC1.

Q.E.D.

C.117.66 Linear_Memory_Properties.linear_resolve_same_page_address_ok

Terse proof for linear_resolve_same_page_address_ok.
linear_resolve_same_page_address_ok:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], addr: Mem-

ory_Address_4G, δ: nat,

ac: Memory_access): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ∧ OK?(linear_resolve(addr, ac)(s)) ⊃ OK?(linear_resolve(addr + δ, ac)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of linear_resolve, Installing automatic rewrites from: ( ##! translate_same_page_address_ok! trans-

late_same_page_address_result! min_linear! max_linear! Mem! Address_Helpers.<=! <! xlat_idx_memory_address! xlat_idx_memory_address2! ptab_lvl! pdir_lvl! max_level! expr_2_super! expr_2_super_res! ok_result! bus_width! bits_per_level! pe_size!)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_resolve_same_page_address_ok.1:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} delta′ ≥ 0
{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-6} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-8} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-9} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{-10} OK?(OK(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′)))))),

xlat_ofs(0,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′)))
{1} OK?(linear_resolve(addr′ + delta′, ac′)(s′))

2044

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma translate_same_page_address_ok, Using lemma translate_same_page_address_result, Expanding the definition of linear_resolve, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_page_address_ok.1.

linear_resolve_same_page_address_ok.2:

{-1} Mem?(addr′`type_of)
{-2} 0 ≤ addr′`offset
{-3} addr′`offset < max_linear_offset
{-4} delta′ ≥ 0
{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-6} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-7} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-8} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-9} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-10} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1
{2} OK?(linear_resolve(addr′ + delta′, ac′)(s′))

2046

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma translate_same_page_address_result, Using lemma translate_same_page_address_ok, Expanding the definition of linear_resolve, Case splitting on 0 <= (addr!1 + delta!1)‘offset, (addr!1 + delta!1)‘offset < max_linear_offset, we get 3 subgoals:

linear_resolve_same_page_address_ok.2.1:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{2} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2048

Case splitting on OK?(translate(1, data(translate(0, data(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s!1))))‘base_addr, addr!1, ac!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s!1)))) (state(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s!1))))))‘2, addr!1, ac!1, segment_to_priv(data(read_data (pm_phy, segment_reg_data_type) (CS) (s!1)))) (state(translate(0, data(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s!1))))‘base_addr, addr!1, ac!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s!1)))) (state(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s!1)))))))) = OK?(translate(1, data(translate(0, data(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s!1))))‘base_addr, addr!1 + delta!1, ac!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s!1)))) (state(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s!1))))))‘2, addr!1 + delta!1, ac!1, segment_to_priv(data(read_data (pm_phy, segment_reg_data_type) (CS) (s!1)))) (state(translate(0, data(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s!1))))‘base_addr, addr!1 + delta!1, ac!1, segment_to_priv(data (read_data (pm_phy, segment_reg_data_type) (CS) (s!1)))) (state(read_data (pm_phy, pdbr_data_type) (PDBR) (state (read_data (pm_phy, segment_reg_data_type) (CS) (s!1)))))))),

we get 7 subgoals:

linear_resolve_same_page_address_ok.2.1.1:

{-1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

= OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))

{-2} (addr′ + delta′)`offset < max_linear_offset
{-3} 0 ≤ (addr′ + delta′)`offset

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} delta′ ≥ 0
{-10} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-11} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-12} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-13} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-14} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-15} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{2} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2050

This completes the proof of linear_resolve_same_page_address_ok.2.1.1.

linear_resolve_same_page_address_ok.2.1.2:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

= OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2052

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: 3, Using lemma translate_same_page_address_ok, we get 2 subgoals:

linear_resolve_same_page_address_ok.2.1.2.1:

{-1} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))

⊃ OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))

{-2} (addr′ + delta′)`offset < max_linear_offset
{-3} 0 ≤ (addr′ + delta′)`offset

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} delta′ ≥ 0
{-10} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-11} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-12} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-13} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-14} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-15} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

= OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

2054

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -7, which is trivially true.

This completes the proof of linear_resolve_same_page_address_ok.2.1.2.1.

linear_resolve_same_page_address_ok.2.1.2.2:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} aligned?(12)

(offset

(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Seg-

ment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`2))

{2} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

= OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR) (state(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))))))

{3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

2056

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (-13 -14 2), Using lemma translate_result_no_leaf, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -7, which is trivially true.

This completes the proof of linear_resolve_same_page_address_ok.2.1.2.2.

linear_resolve_same_page_address_ok.2.1.3:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2058

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma translate_memory_address,

we get 2 subgoals:

linear_resolve_same_page_address_ok.2.1.3.1:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr))

∧ OK?(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′)))))) ⊃ data(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))))`2

< max_linear

{-2} (addr′ + delta′)`offset < max_linear_offset
{-3} 0 ≤ (addr′ + delta′)`offset

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} delta′ ≥ 0
{-10} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-11} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-12} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-13} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-14} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-15} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2060

we get 2 subgoals:

linear_resolve_same_page_address_ok.2.1.3.1.1:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr))

∧ OK?(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′)))))) ⊃ 0 ≤ offset

(data(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`2)

{-2} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr))

∧ OK?(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′)))))) ⊃ data(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))))`2

< max_linear

{-3} (addr′ + delta′)`offset < max_linear_offset
{-4} 0 ≤ (addr′ + delta′)`offset

{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-6} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-7} Mem?(addr′`type_of)
{-8} 0 ≤ addr′`offset
{-9} addr′`offset < max_linear_offset
{-10} delta′ ≥ 0
{-11} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-12} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-13} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-14} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-15} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-16} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2062

This completes the proof of linear_resolve_same_page_address_ok.2.1.3.1.1.

linear_resolve_same_page_address_ok.2.1.3.1.2:

{-1} aligned?(bits_per_level + pe_size)

(offset

(data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr))

∧ OK?(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′)))))) ⊃ data(translate(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))))`2

< max_linear

{-2} (addr′ + delta′)`offset < max_linear_offset
{-3} 0 ≤ (addr′ + delta′)`offset

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-5} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-6} Mem?(addr′`type_of)
{-7} 0 ≤ addr′`offset
{-8} addr′`offset < max_linear_offset
{-9} delta′ ≥ 0
{-10} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-11} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-12} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-13} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-14} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-15} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))
{1} 0 ≤ (addr′ + delta′)`offset ∧ (addr′ + delta′)`offset < max_linear_offset

{2} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{4} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2064

This completes the proof of linear_resolve_same_page_address_ok.2.1.3.1.2.

linear_resolve_same_page_address_ok.2.1.3.2:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))
{1} 0 ≤ (addr′ + delta′)`offset ∧ (addr′ + delta′)`offset < max_linear_offset

{2} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{3} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{4} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2066

This completes the proof of linear_resolve_same_page_address_ok.2.1.3.2.

linear_resolve_same_page_address_ok.2.1.4:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} OK?[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2068

This completes the proof of linear_resolve_same_page_address_ok.2.1.4.

linear_resolve_same_page_address_ok.2.1.5:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} OK?[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))))

∨ Exception?[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))))

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2070

This completes the proof of linear_resolve_same_page_address_ok.2.1.5.

linear_resolve_same_page_address_ok.2.1.6:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))
{1} 0 ≤ (addr′ + delta′)`offset ∧ (addr′ + delta′)`offset < max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2072

This completes the proof of linear_resolve_same_page_address_ok.2.1.6.

linear_resolve_same_page_address_ok.2.1.7:

{-1} (addr′ + delta′)`offset < max_linear_offset
{-2} 0 ≤ (addr′ + delta′)`offset

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-4} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-5} Mem?(addr′`type_of)
{-6} 0 ≤ addr′`offset
{-7} addr′`offset < max_linear_offset
{-8} delta′ ≥ 0
{-9} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-10} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-11} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-12} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-13} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-14} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))

{1} Mem?(data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type] (read_data[Physical_memory, Seg-

ment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`type_of)

∧ 0 ≤ data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

∧

data[Physical_memory, [bool, Address]]

(translate[Physical_memory, pm_phy]

(0,

data[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type]

(pm_phy, segment_reg_data_type)(CS)(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Seg-

ment_Reg_type]

(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state[Physical_memory, Pdbr_type]

(read_data[Physical_memory, Pdbr_type] (pm_phy, pdbr_data_type)(PDBR) (state[Physical_memory, Segment_Reg_type]

(read_data[Physical_memory, Segment_Reg_type] (pm_phy, segment_reg_data_type)(CS) (s′))))))`2`offset

< max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2074

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Hiding formulas: (2 3), Using lemma translate_memory_address, Using lemma translate_memory_address2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_page_address_ok.2.1.7.

linear_resolve_same_page_address_ok.2.2:

{-1} 0 ≤ (addr′ + delta′)`offset

{-2} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-3} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-4} Mem?(addr′`type_of)
{-5} 0 ≤ addr′`offset
{-6} addr′`offset < max_linear_offset
{-7} delta′ ≥ 0
{-8} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-9} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-10} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-11} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-12} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-13} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))
{1} (addr′ + delta′)`offset < max_linear_offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2076

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Keeping (-4 -5 -6 -8 1) and hiding *, Rewriting using delta_memory_address, matching in *,

This completes the proof of linear_resolve_same_page_address_ok.2.2.

linear_resolve_same_page_address_ok.2.3:

{-1} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-2} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page) ∧

OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

⊃ translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

=

translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS) (s′))))`base_addr,

addr′ + delta′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)

(s′)))))

{-3} Mem?(addr′`type_of)
{-4} 0 ≤ addr′`offset
{-5} addr′`offset < max_linear_offset
{-6} delta′ ≥ 0
{-7} rem(expt(2, min_page))(offset(addr′)) + delta′ < expt(2, min_page)
{-8} OK?(read_data(pm_phy, segment_reg_data_type)(CS)(s′))

{-9} OK?(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, segment_reg_data_type)(CS)(s′))))

{-10} OK?(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))

{-11} OK?(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))))))

{-12} OK?(OK(state(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′)))))))),

xlat_ofs(1,

data(translate(1,

data(translate(0,

data(read_data(pm_phy, pdbr_data_type) (PDBR) (state

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))`2,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy,

seg-

ment_reg_data_type)

(CS) (s′))))

(state(translate(0,

data(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data

(read_data (pm_phy, seg-

ment_reg_data_type)

(CS) (s′))))

(state(read_data (pm_phy, pdbr_data_type) (PDBR) (state

(read_data

(pm_phy, seg-

ment_reg_data_type)

(CS)

(s′))))))))`2,

addr′)))
{1} 0 ≤ (addr′ + delta′)`offset

{2} data(translate(0,

data(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))`base_addr,

addr′, ac′,

segment_to_priv(data(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))

(state(read_data(pm_phy, pdbr_data_type)(PDBR)

(state(read_data(pm_phy, seg-

ment_reg_data_type)(CS)

(s′))))))`1

{3} OK?((read_data(pm_phy, segment_reg_data_type)(CS) ##

(λ (cs: Segment_Reg_type):

(read_data(pm_phy, pdbr_data_type)(PDBR) ##

(λ (pdbr: Pdbr_type):

(translate(pdir_lvl, pdbr`base_addr, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf: bool,

base:

{b: Memory_Address_4G | if leaf

then aligned?(−1 × pdir_lvl× bits_per_level − bits_per_level + bus_width)

(offset(b))

else aligned?(bits_per_level + pe_size) (offset(b))

endif}):

if leaf

then ok_result(xlat_ofs(pdir_lvl, base, addr′ + delta′)) else (translate(ptab_lvl, base, addr′ + delta′, ac′,

segment_to_priv(cs))

##

(λ (leaf_1: bool, base_1: Mem-

ory_Address_4G):

ok_result(xlat_ofs(ptab_lvl, base_1,

addr′ + delta′))))

endif))))))

(s′))

2078

Keeping (-3 -4 -6 1) and hiding *, Expanding the definition of +, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_resolve_same_page_address_ok.2.3.

Q.E.D.

C.117.67 Linear_Memory_Properties.linear_resolve_same_page_address_TCC1

Terse proof for linear_resolve_same_page_address_TCC1.
linear_resolve_same_page_address_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], addr: Mem-

ory_Address_4G, δ: nat,

ac: Memory_access): rem(expt(2, min_page))(offset(addr)) + δ < expt(2, min_page) ∧ OK?(linear_resolve(addr, ac)(s)) ⊃ OK?[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](addr + δ, ac)(s))

Repeatedly Skolemizing and flattening, Rewriting using linear_resolve_same_page_address_ok, matching in *,

This completes the proof of linear_resolve_same_page_address_TCC1.

Q.E.D.

C.117.68 Linear_Memory_Properties.linear_resolve_same_page_address

The L^{A}TEX code for this proof is broken.

C.117.69 Linear_Memory_Properties.address_block_split_type

Terse proof for address_block_split_type.
address_block_split_type:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: list[Byte]): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ every(λ (t: [Address, list[Byte]]): Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma split_type, Using lemma address_block_in_memory, Using lemma address_block_in_memory2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

address_block_split_type.1:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} 0 ≤ a′`offset
{-4} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{1} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Hiding formulas: (-8),

Using lemma every_implied,

we get 2 subgoals:

address_block_split_type.1.1:

{-1} (∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ⊃ Mem?(t_1`1`type_of) ∧ 0 ≤ t_1`1`offset ∧ t_1`1`offset < max_linear_offset)

∧

every(λ (t: [Address, list[Byte]]): type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} 0 ≤ a′`offset
{-5} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{-6} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} a′`offset < max_linear_offset

{1} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Keeping (-1 -2 -3 1) and hiding *,

Installing automatic rewrites from: (max_linear! Mem!)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_split_type.1.1.

address_block_split_type.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} 0 ≤ a′`offset
{-4} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} a′`offset < max_linear_offset

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(min_linear`type_of) {2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of address_block_split_type.1.2.
address_block_split_type.2:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} 0 ≤ a′`offset
{-4} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{-5} Mem?(a′`type_of)
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{1} reg_base(min_linear)(type_of(a′)) ≤ a′

{2} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Keeping (-3 -5 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_split_type.2.

address_block_split_type.3:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} 0 ≤ a′`offset
{-4} Mem?(a′`type_of)
{-5} a′`offset < max_linear_offset

{-6} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{1} cons?(bl′)
{2} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{3} every(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a′, bl′))

Using lemma split_null, Keeping (-1 1 3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of address_block_split_type.3.

Q.E.D.

C.117.70 Linear_Memory_Properties.same_page_address_block_read_TCC1

Terse proof for same_page_address_block_read_TCC1.
same_page_address_block_read_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a_{1}, a_{2}: Memory_Address_4G, s_{1}, s_{2}: posnat): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(a_{2}) ∧ a_{1} ≤ a_{2} ∧ a_{2} + s_{2} ≤ a_{1} + s_{1} ∧ rem(expt(2, min_page))(offset(a_{2})) + s_{2} ≤ expt(2, min_page) ∧ (address_block(a_{1}, s_{1}) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

⊃ OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a_{2}, Read)(s))

Repeatedly Skolemizing and flattening, Using lemma pm_linear_resolve_read_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_read_TCC1.

Q.E.D.

C.117.71 Linear_Memory_Properties.same_page_address_block_read

Terse proof for same_page_address_block_read.

same_page_address_block_read:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a_{1}, a_{2}: Memory_Address_4G, s_{1}, s_{2}: posnat): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(a_{2}) ∧ a_{1} ≤ a_{2} ∧ a_{2} + s_{2} ≤ a_{1} + s_{1} ∧ rem(expt(2, min_page))(offset(a_{2})) + s_{2} ≤ expt(2, min_page) ∧ (address_block(a_{1}, s_{1}) ⊆ (pm‘ro_addr∪ pm‘rw_addr))

⊃

(address_block(data(linear_resolve(a_{2}, Read)(s)), s_{2}) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Installing automatic rewrites from: singleton member subset? Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-4 -6 -7 -8 -9), Instantiating the top quantifier in -3 with the terms: (a2!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

same_page_address_block_read.1:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} OK?(linear_resolve(a′_{2}, Read)(s′))
{-4} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-5} ∀ (x: Memory_Address_4G): virt_to_phys_range(s′,

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-6} Mem?(a′_{1}`type_of)
{-7} 0 ≤ a′_{1}`offset
{-8} a′_{1}`offset < max_linear_offset
{-9} Mem?(a′_{2}`type_of)
{-10} 0 ≤ a′_{2}`offset
{-11} a′_{2}`offset < max_linear_offset
{-12} s′_{1} > 0
{-13} s′_{2} > 0
{-14} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-15} a′_{1} ≤ a′_{2}
{-16} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-17} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-18} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{1} ∀ (x: Address):

address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

Repeatedly Skolemizing and flattening,

Case splitting on offset(x!1) - offset (data[Physical_memory, Address] (linear_resolve[Physical_memory, pm_phy](a2!1, Read)(s!1))) >= 0,

we get 2 subgoals:

same_page_address_block_read.1.1:

{-1} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} OK?(linear_resolve(a′_{2}, Read)(s′))
{-5} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-6} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-7} Mem?(a′_{1}`type_of)
{-8} 0 ≤ a′_{1}`offset
{-9} a′_{1}`offset < max_linear_offset
{-10} Mem?(a′_{2}`type_of)
{-11} 0 ≤ a′_{2}`offset
{-12} a′_{2}`offset < max_linear_offset
{-13} s′_{1} > 0
{-14} s′_{2} > 0
{-15} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-16} a′_{1} ≤ a′_{2}
{-17} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-18} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-19} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-20} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Using lemma linear_resolve_same_page_address,

Case splitting on rem(expt(2, min_page))(offset(a2!1)) + offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1))) < expt(2, min_page),

we get 2 subgoals:

same_page_address_block_read.1.1.1:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page) {-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

∧ OK?(linear_resolve(a′_{2}, Read)(s′))

⊃

data(linear_resolve(a′_{2}, Read)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(a′_{2}, Read)(s′))
{-7} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-8} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-22} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Case splitting on data(linear_resolve(a2!1, Read)(s!1)) + (offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1)))) = x!1,

we get 2 subgoals:

same_page_address_block_read.1.1.1.1:

{-1} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= x′ {-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-3} OK?(linear_resolve(a′_{2}, Read)(s′))

{-4} data(linear_resolve(a′_{2}, Read)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-5} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)
{-8} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-9} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)
{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Replacing using formula -1,

Replacing using formula -4,

Case splitting on OK?(linear_resolve(a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1)))), Read) (s!1)),

we get 2 subgoals:

same_page_address_block_read.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-10} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-11} Mem?(a′_{1}`type_of)
{-12} 0 ≤ a′_{1}`offset
{-13} a′_{1}`offset < max_linear_offset
{-14} Mem?(a′_{2}`type_of)
{-15} 0 ≤ a′_{2}`offset
{-16} a′_{2}`offset < max_linear_offset
{-17} s′_{1} > 0
{-18} s′_{2} > 0
{-19} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-20} a′_{1} ≤ a′_{2}
{-21} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-22} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-23} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-24} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

Instantiating the top quantifier in -10 with the terms: (data(linear_resolve(a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1)))), Read) (s!1))),

we get 2 subgoals:

same_page_address_block_read.1.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-10} virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(data(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′)))

⇒

restrict[Address, Memory_Address_4G, boolean] ((pm_phy‘ro_addr∪ pm_phy‘rw_addr)) (data(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′)))

{-11} Mem?(a′_{1}`type_of)
{-12} 0 ≤ a′_{1}`offset
{-13} a′_{1}`offset < max_linear_offset
{-14} Mem?(a′_{2}`type_of)
{-15} 0 ≤ a′_{2}`offset
{-16} a′_{2}`offset < max_linear_offset
{-17} s′_{1} > 0
{-18} s′_{2} > 0
{-19} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-20} a′_{1} ≤ a′_{2}
{-21} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-22} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-23} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-24} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

Expanding the definition of restrict, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of virt_to_phys_range, Instantiating the top quantifier in 1 with the terms: (a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1,

Read)(s!1)))) Read), we get 3 subgoals:

same_page_address_block_read.1.1.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))
{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

which is trivially true.

This completes the proof of same_page_address_block_read.1.1.1.1.1.1.1.
same_page_address_block_read.1.1.1.1.1.1.2:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))
{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} union[Memory_access]

(singleton[Memory_access](Read), singleton[Memory_access](Execute))(Read)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

Using lemma linear_resolve_same_page_address_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of union,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.1.1.1.1.2.

same_page_address_block_read.1.1.1.1.1.1.3:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))
{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} union[Memory_Address_4G]

(λ (s: Memory_Address_4G): pm′`ro_addr(s), λ (s: Memory_Address_4G): pm′`rw_addr(s))

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))))

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

Instantiating the top quantifier in -22 with the terms: (a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Read)(s!1))))),

Hiding formulas: (-3 -4 -6 -9 2), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.1.1.1.1.3.

same_page_address_block_read.1.1.1.1.1.2:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{-2} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Read)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} OK?(linear_resolve(a′_{2}, Execute)(s′))
{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} Mem?(data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))),

Read) (s′))`type_of)

∧ 0 ≤ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))),

Read) (s′))`offset

∧

data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))),

Read) (s′))`offset

< max_linear_offset

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

2093

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.1.1.1.2.
same_page_address_block_read.1.1.1.1.2:

{-1} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-3} OK?(linear_resolve(a′_{2}, Read)(s′))

{-4} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-5} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))), Read)(s′))) − offset(data [Physical_memory, Address](linear_resolve [Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)
{-8} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-9} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{-23} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

{1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))),

Read) (s′))

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′)))

Using lemma linear_resolve_same_page_address_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.1.1.2.
same_page_address_block_read.1.1.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{-2} OK?(linear_resolve(a′_{2}, Read)(s′))

{-3} data(linear_resolve(a′_{2}, Read)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-4} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′)
{-7} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-8} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-22} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)

{1} data(linear_resolve(a′_{2}, Read)(s′)) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))))

= x′

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Expanding the definition of +,

Applying decompose-equality,

Expanding the definition of address_block,

which is trivially true.

This completes the proof of same_page_address_block_read.1.1.1.2.

same_page_address_block_read.1.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

∧ OK?(linear_resolve(a′_{2}, Read)(s′))

⊃

data(linear_resolve(a′_{2}, Read)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′))),

Read) (s′))

{-2} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(a′_{2}, Read)(s′))
{-6} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-7} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-8} Mem?(a′_{1}`type_of)
{-9} 0 ≤ a′_{1}`offset
{-10} a′_{1}`offset < max_linear_offset
{-11} Mem?(a′_{2}`type_of)
{-12} 0 ≤ a′_{2}`offset
{-13} a′_{2}`offset < max_linear_offset
{-14} s′_{1} > 0
{-15} s′_{2} > 0
{-16} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-17} a′_{1} ≤ a′_{2}
{-18} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-19} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-20} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-21} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)

{1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Read)(s′)))

< expt(2, min_page)

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_read.1.1.2.

same_page_address_block_read.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} OK?(linear_resolve(a′_{2}, Read)(s′))
{-4} OK?(linear_resolve(a′_{2}, Execute)(s′))

{-5} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-6} Mem?(a′_{1}`type_of)
{-7} 0 ≤ a′_{1}`offset
{-8} a′_{1}`offset < max_linear_offset
{-9} Mem?(a′_{2}`type_of)
{-10} 0 ≤ a′_{2}`offset
{-11} a′_{2}`offset < max_linear_offset
{-12} s′_{1} > 0
{-13} s′_{2} > 0
{-14} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-15} a′_{1} ≤ a′_{2}
{-16} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-17} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-18} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)
{-19} address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x′)

{1} offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Read)(s′)))

≥ 0

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(x′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_read.1.2.

same_page_address_block_read.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(x)

⇒

restrict[Address, Memory_Address_4G, boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(x)

{-4} Mem?(a′_{1}`type_of)
{-5} 0 ≤ a′_{1}`offset
{-6} a′_{1}`offset < max_linear_offset
{-7} Mem?(a′_{2}`type_of)
{-8} 0 ≤ a′_{2}`offset
{-9} a′_{2}`offset < max_linear_offset
{-10} s′_{1} > 0
{-11} s′_{2} > 0
{-12} union(pm′`ro_addr, pm′`rw_addr)(a′_{2})
{-13} a′_{1} ≤ a′_{2}
{-14} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-15} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-16} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ union(pm′`ro_addr, pm′`rw_addr)(x)

{1} union(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)) (a′_{2})

{2} ∀ (x: Address):

address_block(data(linear_resolve(a′_{2}, Read)(s′)), s′_{2})(x) ⇒ union(pm_phy`ro_addr, pm_phy`rw_addr)(x)

Keeping (-12 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_read.2.

Q.E.D.

C.117.72 Linear_Memory_Properties.same_page_address_block_write_TCC1

Terse proof for same_page_address_block_write_TCC1.

same_page_address_block_write_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a_{1}, a_{2}: Memory_Address_4G, s_{1}, s_{2}: posnat): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(a_{2}) ∧ a_{1} ≤ a_{2} ∧ a_{2} + s_{2} ≤ a_{1} + s_{1} ∧ rem(expt(2, min_page))(offset(a_{2})) + s_{2} ≤ expt(2, min_page) ∧ (address_block(a_{1}, s_{1}) ⊆ pm‘rw_addr)

⊃

OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a_{2}, Write)(s))

Repeatedly Skolemizing and flattening, Using lemma pm_linear_resolve_write_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_write_TCC1.

Q.E.D.

C.117.73 Linear_Memory_Properties.same_page_address_block_write

Terse proof for same_page_address_block_write.
same_page_address_block_write:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a_{1}, a_{2}: Memory_Address_4G, s_{1}, s_{2}: posnat): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(a_{2}) ∧ a_{1} ≤ a_{2} ∧ a_{2} + s_{2} ≤ a_{1} + s_{1} ∧ rem(expt(2, min_page))(offset(a_{2})) + s_{2} ≤ expt(2, min_page) ∧ (address_block(a_{1}, s_{1}) ⊆ pm‘rw_addr)

⊃ (address_block(data(linear_resolve(a_{2}, Write)(s)), s_{2}) ⊆ pm_phy‘rw_addr)

Installing automatic rewrites from: singleton member subset? Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-3 -5 -7 -8 -9), Instantiating the top quantifier in -3 with the terms: (a2!1), Repeatedly Skolemizing and flattening, Case splitting on offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1))) >= 0, we get 2 subgoals:

same_page_address_block_write.1:

{-1} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(s′)

{-4} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2}) ⊃

OK?(linear_resolve(a′_{2}, Write)(s′)) {-5} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-6} Mem?(a′_{1}`type_of)
{-7} 0 ≤ a′_{1}`offset
{-8} a′_{1}`offset < max_linear_offset
{-9} Mem?(a′_{2}`type_of)
{-10} 0 ≤ a′_{2}`offset
{-11} a′_{2}`offset < max_linear_offset
{-12} s′_{1} > 0
{-13} s′_{2} > 0
{-14} pm′`rw_addr(a′_{2})
{-15} a′_{1} ≤ a′_{2}
{-16} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-17} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-18} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-19} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} pm_phy`rw_addr(x′)

Using lemma linear_resolve_same_page_address,

Case splitting on rem(expt(2, min_page))(offset(a2!1)) + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1)))) < expt(2, min_page),

we get 2 subgoals:

same_page_address_block_write.1.1:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

< expt(2, min_page) {-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

∧ OK?(linear_resolve(a′_{2}, Write)(s′))

⊃

data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

=

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(s′)

{-6} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2}) ⊃

OK?(linear_resolve(a′_{2}, Write)(s′)) {-7} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-8} Mem?(a′_{1}`type_of)
{-9} 0 ≤ a′_{1}`offset
{-10} a′_{1}`offset < max_linear_offset
{-11} Mem?(a′_{2}`type_of)
{-12} 0 ≤ a′_{2}`offset
{-13} a′_{2}`offset < max_linear_offset
{-14} s′_{1} > 0
{-15} s′_{2} > 0
{-16} pm′`rw_addr(a′_{2})
{-17} a′_{1} ≤ a′_{2}
{-18} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-19} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-20} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-21} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} pm_phy`rw_addr(x′)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

same_page_address_block_write.1.1.1:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-2} OK?(linear_resolve(a′_{2}, Write)(s′))

{-3} data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-4} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′)

{-7} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-8} Mem?(a′_{1}`type_of)
{-9} 0 ≤ a′_{1}`offset
{-10} a′_{1}`offset < max_linear_offset
{-11} Mem?(a′_{2}`type_of)
{-12} 0 ≤ a′_{2}`offset
{-13} a′_{2}`offset < max_linear_offset
{-14} s′_{1} > 0
{-15} s′_{2} > 0
{-16} pm′`rw_addr(a′_{2})
{-17} a′_{1} ≤ a′_{2}
{-18} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-19} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-20} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-21} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} pm_phy`rw_addr(x′)

Case splitting on data(linear_resolve(a2!1, Write)(s!1)) + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1)))) = x!1,

we get 2 subgoals:

same_page_address_block_write.1.1.1.1:

{-1} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

= x′ {-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-3} OK?(linear_resolve(a′_{2}, Write)(s′))

{-4} data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-5} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)

{-8} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} pm_phy`rw_addr(x′)

Replacing using formula -1,

Replacing using formula -4,

Case splitting on OK?(linear_resolve(a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1)))), Write) (s!1)),

we get 2 subgoals:

same_page_address_block_write.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)

{-9} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} pm′`rw_addr(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-23} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

Instantiating the top quantifier in -9 with the terms: (data(linear_resolve(a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1)))), Write) (s!1))),

we get 2 subgoals:

same_page_address_block_write.1.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)

{-9} virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (data(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′)))

⇒

restrict[Address, Memory_Address_4G, boolean] (pm_phy`rw_addr) (data(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′)))

{-10} Mem?(a′_{1}`type_of)
{-11} 0 ≤ a′_{1}`offset
{-12} a′_{1}`offset < max_linear_offset
{-13} Mem?(a′_{2}`type_of)
{-14} 0 ≤ a′_{2}`offset
{-15} a′_{2}`offset < max_linear_offset
{-16} s′_{1} > 0
{-17} s′_{2} > 0
{-18} pm′`rw_addr(a′_{2})
{-19} a′_{1} ≤ a′_{2}
{-20} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-21} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-22} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-23} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

Expanding the definition of restrict, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of virt_to_phys_range, Instantiating the top quantifier in 1 with the terms: (a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1,

Write)(s!1)))) Write), we get 2 subgoals:

same_page_address_block_write.1.1.1.1.1.1.1:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{2} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

which is trivially true.

This completes the proof of same_page_address_block_write.1.1.1.1.1.1.1.

same_page_address_block_write.1.1.1.1.1.1.2:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) + rem(expt(2, min_page))(offset(a′_{2})) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} pm′`rw_addr

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Write)(s′)))))

{2} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

Instantiating the top quantifier in -21 with the terms: (a2!1 + (offset(x!1) - offset(data(linear_resolve(a2!1, Write)(s!1))))),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_write.1.1.1.1.1.1.2.

same_page_address_block_write.1.1.1.1.1.2:

{-1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{-2} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-3} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-4} OK?(linear_resolve(a′_{2}, Write)(s′))

{-5} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-6} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-7} is_linear_plain_memory?(pm′)
{-8} pm′`states(s′)
{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} Mem?(data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Write)(s′)))),

Write) (s′))`type_of)

∧ 0 ≤ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Write)(s′)))),

Write) (s′))`offset

∧

data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy]

(a′_{2} + (offset(x′) − offset(data [Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a′_{2}, Write)(s′)))),

Write) (s′))`offset

< max_linear_offset

{2} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

2108

Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_write.1.1.1.1.1.2.
same_page_address_block_write.1.1.1.1.2:

{-1} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-2} rem(expt(2, min_page))(offset(a′_{2})) + offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-3} OK?(linear_resolve(a′_{2}, Write)(s′))

{-4} x′ =

data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-5} offset(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))), Write)(s′))) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

≥ 0

{-6} is_linear_plain_memory?(pm′)
{-7} pm′`states(s′)

{-8} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-9} Mem?(a′_{1}`type_of)
{-10} 0 ≤ a′_{1}`offset
{-11} a′_{1}`offset < max_linear_offset
{-12} Mem?(a′_{2}`type_of)
{-13} 0 ≤ a′_{2}`offset
{-14} a′_{2}`offset < max_linear_offset
{-15} s′_{1} > 0
{-16} s′_{2} > 0
{-17} pm′`rw_addr(a′_{2})
{-18} a′_{1} ≤ a′_{2}
{-19} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-20} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-21} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)

{-22} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

{1} OK?(linear_resolve(a′_{2} + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))),

Write) (s′))

{2} pm_phy`rw_addr

(data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′)))

Using lemma linear_resolve_same_page_address_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of same_page_address_block_write.1.1.1.1.2.

same_page_address_block_write.1.1.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-2} OK?(linear_resolve(a′_{2}, Write)(s′))

{-3} data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-4} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(s′)

{-7} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-8} Mem?(a′_{1}`type_of)
{-9} 0 ≤ a′_{1}`offset
{-10} a′_{1}`offset < max_linear_offset
{-11} Mem?(a′_{2}`type_of)
{-12} 0 ≤ a′_{2}`offset
{-13} a′_{2}`offset < max_linear_offset
{-14} s′_{1} > 0
{-15} s′_{2} > 0
{-16} pm′`rw_addr(a′_{2})
{-17} a′_{1} ≤ a′_{2}
{-18} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-19} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-20} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-21} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)

{1} data(linear_resolve(a′_{2}, Write)(s′)) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

= x′

{2} pm_phy`rw_addr(x′)

Expanding the definition of +,

Applying decompose-equality,

Expanding the definition of address_block,

which is trivially true.

This completes the proof of same_page_address_block_write.1.1.1.2.

same_page_address_block_write.1.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′)))

< expt(2, min_page)

{-2} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)

{-5} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-6} Mem?(a′_{1}`type_of)
{-7} 0 ≤ a′_{1}`offset
{-8} a′_{1}`offset < max_linear_offset
{-9} Mem?(a′_{2}`type_of)
{-10} 0 ≤ a′_{2}`offset
{-11} a′_{2}`offset < max_linear_offset
{-12} s′_{1} > 0
{-13} s′_{2} > 0
{-14} pm′`rw_addr(a′_{2})
{-15} a′_{1} ≤ a′_{2}
{-16} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-17} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-18} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-19} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} OK?(linear_resolve(a′_{2}, Write)(s′))
{2} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2})
{3} pm_phy`rw_addr(x′)

Expanding the definition of restrict,

which is trivially true.

This completes the proof of same_page_address_block_write.1.1.2.

same_page_address_block_write.1.2:

{-1} rem(expt(2, min_page))(offset(a′_{2})) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) < expt(2, min_page) ∧ OK?(linear_resolve(a′_{2}, Write)(s′)) ⊃ data(linear_resolve(a′_{2}, Write)(s′)) + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) = data(linear_resolve(a′_{2} + offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))),

Write) (s′))

{-2} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(s′)

{-5} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2}) ⊃

OK?(linear_resolve(a′_{2}, Write)(s′)) {-6} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-7} Mem?(a′_{1}`type_of)
{-8} 0 ≤ a′_{1}`offset
{-9} a′_{1}`offset < max_linear_offset
{-10} Mem?(a′_{2}`type_of)
{-11} 0 ≤ a′_{2}`offset
{-12} a′_{2}`offset < max_linear_offset
{-13} s′_{1} > 0
{-14} s′_{2} > 0
{-15} pm′`rw_addr(a′_{2})
{-16} a′_{1} ≤ a′_{2}
{-17} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-18} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-19} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-20} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)

{1} rem(expt(2, min_page))(offset(a′_{2})) + (offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))))

< expt(2, min_page)

{2} pm_phy`rw_addr(x′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_write.1.2.

same_page_address_block_write.2:

{-1} is_linear_plain_memory?(pm′)
{-2} pm′`states(s′)

{-3} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(a′_{2}) ⊃

OK?(linear_resolve(a′_{2}, Write)(s′)) {-4} ∀ (x: Memory_Address_4G):

virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (x)

⇒ restrict[Address, Memory_Address_4G, boolean](pm_phy`rw_addr)(x)

{-5} Mem?(a′_{1}`type_of)
{-6} 0 ≤ a′_{1}`offset
{-7} a′_{1}`offset < max_linear_offset
{-8} Mem?(a′_{2}`type_of)
{-9} 0 ≤ a′_{2}`offset
{-10} a′_{2}`offset < max_linear_offset
{-11} s′_{1} > 0
{-12} s′_{2} > 0
{-13} pm′`rw_addr(a′_{2})
{-14} a′_{1} ≤ a′_{2}
{-15} a′_{2} + s′_{2} ≤ a′_{1} + s′_{1}
{-16} rem(expt(2, min_page))(offset(a′_{2})) + s′_{2} ≤ expt(2, min_page)
{-17} ∀ (x: Address): address_block(a′_{1}, s′_{1})(x) ⇒ pm′`rw_addr(x)
{-18} address_block(data(linear_resolve(a′_{2}, Write)(s′)), s′_{2})(x′)
{1} offset(x′) − offset(data(linear_resolve(a′_{2}, Write)(s′))) ≥ 0
{2} pm_phy`rw_addr(x′)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of same_page_address_block_write.2.

Q.E.D.

C.117.74 Linear_Memory_Properties.split_linear_read_side_effects_states_TCC1

Terse proof for split_linear_read_side_effects_states_TCC1.
split_linear_read_side_effects_states_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma address_block_split_type, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_states_TCC1.

Q.E.D.

C.117.75 Linear_Memory_Properties.split_linear_read_side_effects_states

Terse proof for split_linear_read_side_effects_states.
split_linear_read_side_effects_states:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]): transformer_invariant?(pm`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e)))))

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma split_range, Using lemma split_no_null, Using lemma split_type, Using lemma split_pair_cross_size, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

split_linear_read_side_effects_states.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma every_conjunct_left,

Using lemma every_conjunct_left, we get 3 subgoals:

split_linear_read_side_effects_states.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′)) we get 3 subgoals:

split_linear_read_side_effects_states.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2118

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3 -4 -5 -6 -7 -11), Installing automatic rewrites from: max_linear Mem min_linear Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of transformer_invariant?, Expanding the definition of linear_read_side_effect_in_page, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -9, Hiding formulas: -9, Installing automatic rewrites from: (result_pred! has_next_state! ##! expr_2_super!

expr_2_super_res!)

Case splitting on union(pm!1‘ro_addr, pm!1‘rw_addr)(t!1‘1), we get 2 subgoals:

split_linear_read_side_effects_states.1.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-9} pm′`states(s′)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Using lemma pm_linear_resolve_read_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Read)(s!1)), length(t!1‘2)),

union(pm_phy‘ro_addr, pm_phy‘rw_addr)), we get 3 subgoals:

split_linear_read_side_effects_states.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} pm′`states(s′)
{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Using lemma linear_resolve_states,

Using lemma pm_states,

Using lemma pm_plain_phy,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_states.1.1.1.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(t′`1, Read)(s′))
{-7} pm_phy`states(state(linear_resolve(t′`1, Read)(s′)))
{-8} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} OK?(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} pm′`states

(state(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′)))

Using lemma plain_memory_transformer_invariant_read_side_effects, Using lemma super_transformer_invariant_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_read_side_effect_super_transformers, Instantiating the top quantifier in 1 with the terms: (data(linear_resolve(t!1‘1, Read)(s!1)) t!1‘2

TRUE), Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.1.1.

C Proof scripts

split_linear_read_side_effects_states.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(t′`1, Read)(s′))
{-7} pm_phy`states(state(linear_resolve(t′`1, Read)(s′)))
{-8} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} Exception?(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} pm′`states

(state(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′)))

Using lemma plain_memory_transformers_ok_read_side_effects_block, Using lemma super_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_read_side_effect_super_transformers, Instantiating the top quantifier in 1 with the terms: (data(linear_resolve(t!1‘1, Read)(s!1)) t!1‘2

TRUE), Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.1.2.

split_linear_read_side_effects_states.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Hiding formulas: 2,

Using lemma same_page_address_block_read,

we get 3 subgoals:

split_linear_read_side_effects_states.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ union(pm′`ro_addr, pm′`rw_addr)(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

⊃

(address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} pm′`states(s′)
{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.2.1.
split_linear_read_side_effects_states.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.2.2.
split_linear_read_side_effects_states.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.2.3.
split_linear_read_side_effects_states.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](t′`1, Read)(s′))

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_read_side_effects_states.1.1.1.1.3.

split_linear_read_side_effects_states.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-8} pm′`states(s′)
{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Hiding formulas: (-7 -13 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.1.1.1.2.

split_linear_read_side_effects_states.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2127 C Proof scripts

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_states.1.1.2.

split_linear_read_side_effects_states.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2129

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_read_side_effects_states.1.1.3.
split_linear_read_side_effects_states.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} ∀ (t: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_read_side_effects_states.1.2.

split_linear_read_side_effects_states.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_read_side_effects_states.1.3.

split_linear_read_side_effects_states.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Hiding formulas: (-1 -2 -3 -7 2),

Expanding the definition of length,

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -6,

Expanding the definition of subset?,

Installing automatic rewrites from: Mem max_linear bus_width min_linear

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_states.2.

split_linear_read_side_effects_states.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} reg_base(min_linear)(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of reg_base, Expanding the definition of min_linear, Expanding the definition of Mem, Expanding the definition of <=, which is trivially true.

This completes the proof of split_linear_read_side_effects_states.3.

Q.E.D.

C.117.76 Linear_Memory_Properties.split_linear_write_side_effects_states_TCC1

Terse proof for split_linear_write_side_effects_states_TCC1.
split_linear_write_side_effects_states_TCC1:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ pm‘rw_addr) ⊃ every[[Address, list[Byte]]]

(λ (t: [Address, list[Byte]]):

Mem?(t`1`type_of) ∧ 0 ≤ t`1`offset ∧ t`1`offset < max_linear_offset) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma address_block_split_type, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-7 1) and hiding *, Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets

pm!1‘rw_addr, c gets union(pm!1‘ro_addr, pm!1‘rw_addr),

C Proof scripts

Keeping (1) and hiding *, Rewriting using union_commutative, matching in *, Rewriting using union_subset1, matching in *,

This completes the proof of split_linear_write_side_effects_states_TCC1.

Q.E.D.

C.117.77 Linear_Memory_Properties.split_linear_write_side_effects_states

Terse proof for split_linear_write_side_effects_states.
split_linear_write_side_effects_states:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ pm‘rw_addr) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]): transformer_invariant?(pm`states,

singleton(expr_2_super(linear_write_side_effect_in_page

(e)))))

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma split_range, Using lemma split_no_null, Using lemma split_type, Using lemma split_pair_cross_size, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

split_linear_write_side_effects_states.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Using lemma every_conjunct_left,

Using lemma every_conjunct_left,

we get 3 subgoals:

split_linear_write_side_effects_states.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′)) we get 3 subgoals:

split_linear_write_side_effects_states.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2138

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3 -4 -5 -6 -7 -11), Installing automatic rewrites from: (min_linear! max_linear! Mem!) Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of transformer_invariant?, Expanding the definition of linear_write_side_effect_in_page, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -9, Hiding formulas: -9, Installing automatic rewrites from: (result_pred! has_next_state! ##! expr_2_super!

expr_2_super_res!) Case splitting on pm!1‘rw_addr(t!1‘1), we get 2 subgoals:

split_linear_write_side_effects_states.1.1.1.1:

{-1} pm′`rw_addr(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-9} pm′`states(s′)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Using lemma pm_linear_resolve_write_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Write)(s!1)), length(t!1‘2)),

pm_phy‘rw_addr), we get 3 subgoals:

split_linear_write_side_effects_states.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm′`rw_addr(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} pm′`states(s′)
{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Using lemma linear_resolve_states,

Using lemma pm_states,

Using lemma pm_plain_phy,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 4 subgoals:

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_states.1.1.1.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-7} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-8} pm′`rw_addr(t′`1)
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} pm′`states

(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′)))

Using lemma plain_memory_transformer_invariant_write_side_effects, Using lemma super_transformer_invariant_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_write_side_effect_super_transformers, Instantiating the top quantifier in 1 with the terms: (data(linear_resolve(t!1‘1, Write)(s!1)) t!1‘2

TRUE), Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.1.1.

C Proof scripts

split_linear_write_side_effects_states.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-7} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-8} pm′`rw_addr(t′`1)
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} Exception?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} pm′`states

(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′)))

Using lemma plain_memory_transformers_ok_write_side_effects_block, Using lemma super_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_write_side_effect_super_transformers, Instantiating the top quantifier in 1 with the terms: (data(linear_resolve(t!1‘1, Write)(s!1)) t!1‘2

TRUE), Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.1.2.

split_linear_write_side_effects_states.1.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-7} pm′`rw_addr(t′`1)
{-8} cons?(t′`2)
{-9} a′ ≤ t′`1
{-10} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-11} type_of(t′`1) = type_of(a′)
{-12} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-13} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-14} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-15} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-16} Mem?(a′`type_of)
{-17} 0 ≤ a′`offset
{-18} a′`offset < max_linear_offset
{-19} cons?[Byte](bl′)
{-20} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} pm′`states

(state(memory_write_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′)))

Keeping (-7 1) and hiding *,

Rewriting using union_right, matching in *,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.1.3.

split_linear_write_side_effects_states.1.1.1.1.1.4:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-7} pm′`rw_addr(t′`1)
{-8} cons?(t′`2)
{-9} a′ ≤ t′`1
{-10} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-11} type_of(t′`1) = type_of(a′)
{-12} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-13} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-14} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-15} Exception?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-16} Mem?(a′`type_of)
{-17} 0 ≤ a′`offset
{-18} a′`offset < max_linear_offset
{-19} cons?[Byte](bl′)
{-20} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} pm′`states

(state(memory_write_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′)))

Rewriting using union_right, matching in *,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.1.4.

split_linear_write_side_effects_states.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Hiding formulas: 2,

Using lemma same_page_address_block_write,

we get 3 subgoals:

split_linear_write_side_effects_states.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`rw_addr(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

⊃

(address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm′`rw_addr(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} pm′`states(s′)
{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.2.1.
split_linear_write_side_effects_states.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.2.2.
split_linear_write_side_effects_states.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.2.3.
split_linear_write_side_effects_states.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} pm′`states(s′)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](t′`1, Write)(s′))

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_write_side_effects_states.1.1.1.1.3.

split_linear_write_side_effects_states.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-8} pm′`states(s′)
{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} pm′`rw_addr(t′`1)

{2} result_pred(pm′`states)

(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G) (ns: Linear_memory[Physical_memory, pm_phy]): memory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s))) (s))

(s′))

Hiding formulas: (-7 -13 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.1.1.1.2.

split_linear_write_side_effects_states.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2149 C Proof scripts

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_write_side_effects_states.1.1.2.

split_linear_write_side_effects_states.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

2151

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_write_side_effects_states.1.1.3.
split_linear_write_side_effects_states.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} ∀ (t: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of max_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_write_side_effects_states.1.2.

split_linear_write_side_effects_states.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_write_side_effects_states.1.3.

split_linear_write_side_effects_states.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Hiding formulas: (-1 -2 -3 -7 2),

Expanding the definition of length,

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -6,

Expanding the definition of subset?,

Installing automatic rewrites from: Mem max_linear bus_width min_linear

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_states.2.

split_linear_write_side_effects_states.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} reg_base(min_linear)(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

Expanding the definition of reg_base, Expanding the definition of min_linear, Expanding the definition of Mem, Expanding the definition of <=, which is trivially true.

This completes the proof of split_linear_write_side_effects_states.3.

Q.E.D.

C.117.78 Linear_Memory_Properties.split_linear_read_side_effects_ok

Terse proof for split_linear_read_side_effects_ok.
split_linear_read_side_effects_ok:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s))) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: Mem!! max_linear!! min_linear!! Using lemma split_range, Using lemma split_no_null, Using lemma split_type, Using lemma split_pair_cross_size,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

split_linear_read_side_effects_ok.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-12} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Using lemma every_conjunct_left,

Using lemma every_conjunct_left,

we get 3 subgoals:

split_linear_read_side_effects_ok.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-14} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

C Proof scripts

Using lemma every_conjunct_left,

we get 3 subgoals:

split_linear_read_side_effects_ok.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-15} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2159

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3 -4 -5 -6 -7 -11), Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res!) Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], we get 3 subgoals:

split_linear_read_side_effects_ok.1.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Using lemma every_implied, we get 3 subgoals:

split_linear_read_side_effects_ok.1.1.1.1.1:

{-1} (∀ (t: [Memory_Address_4G, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page)

⊃ OK?(linear_read_side_effect_in_page(t)(s′))) ∧ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} cons?[Byte](bl′)
{-8} is_linear_plain_memory?(pm′)
{-9} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-10} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2161 C Proof scripts

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of linear_read_side_effect_in_page, Repeatedly Skolemizing and flattening, Case splitting on union(pm!1‘ro_addr, pm!1‘rw_addr)(t!1‘1), we get 2 subgoals:

split_linear_read_side_effects_ok.1.1.1.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-15} pm′`states(s′)

{1} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Using lemma pm_linear_resolve_read_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Read)(s!1)), length(t!1‘2)),

union(pm_phy‘ro_addr, pm_phy‘rw_addr)), we get 3 subgoals:

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_ok.1.1.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-17} pm′`states(s′)

{1} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Using lemma linear_resolve_states, Using lemma pm_states, Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_transformers_ok_read_side_effects_block, Using lemma super_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_read_side_effect_super_transformers, Instantiating quantified variables, Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.1.1.1.

split_linear_read_side_effects_ok.1.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-16} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Hiding formulas: 2,

Using lemma same_page_address_block_read,

we get 3 subgoals:

split_linear_read_side_effects_ok.1.1.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ union(pm′`ro_addr, pm′`rw_addr)(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

⊃

(address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-17} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.1.1.2.1.
split_linear_read_side_effects_ok.1.1.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-16} pm′`states(s′)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.1.1.2.2.
split_linear_read_side_effects_ok.1.1.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-16} pm′`states(s′)
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.1.1.2.3.
split_linear_read_side_effects_ok.1.1.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-16} pm′`states(s′)
{1} OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](t′`1, Read)(s′))

{2} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.1.1.3.

split_linear_read_side_effects_ok.1.1.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset
{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-14} pm′`states(s′)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Hiding formulas: (-7 -12 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.1.2.

split_linear_read_side_effects_ok.1.1.1.1.2:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): reg_base(Mem(0))(type_of(a′)) ≤ s`1 ∧ type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.2.

split_linear_read_side_effects_ok.1.1.1.1.3:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.1.3.

split_linear_read_side_effects_ok.1.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} cons?[Byte](bl′)
{-6} is_linear_plain_memory?(pm′)
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.2.

split_linear_read_side_effects_ok.1.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} cons?[Byte](bl′)
{-6} is_linear_plain_memory?(pm′)
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.1.3.

split_linear_read_side_effects_ok.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-14} pm′`states(s′)

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2)

⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2172

This completes the proof of split_linear_read_side_effects_ok.1.1.2.

split_linear_read_side_effects_ok.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-14} pm′`states(s′)

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2174

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.1.3.

split_linear_read_side_effects_ok.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-13} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.2.

split_linear_read_side_effects_ok.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-13} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.1.3.

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_read_side_effects_ok.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-11} pm′`states(s′)
{1} a′ + length(bl′) ≤

reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)) {2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Hiding formulas: (-1 -2 -3 -7 2), Expanding the definition of length, Using lemma pm_memory_addr, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -6, Expanding the definition of subset?, Installing automatic rewrites from: (bus_width!) Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_ok.2.

split_linear_read_side_effects_ok.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-11} pm′`states(s′)
{1} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Expanding the definition of reg_base, Expanding the definition of <=, which is trivially true.

This completes the proof of split_linear_read_side_effects_ok.3.

Q.E.D.

C.117.79 Linear_Memory_Properties.split_linear_write_side_effects_ok

Terse proof for split_linear_write_side_effects_ok.
split_linear_write_side_effects_ok:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ pm‘rw_addr) ∧ pm`states(s) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s))) (split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: Mem!! max_linear!! min_linear!! Using lemma split_range, Using lemma split_no_null, Using lemma split_type, Using lemma split_pair_cross_size, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

split_linear_write_side_effects_ok.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-12} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Using lemma every_conjunct_left,

Using lemma every_conjunct_left,

we get 3 subgoals:

split_linear_write_side_effects_ok.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-14} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′)) we get 3 subgoals:

split_linear_write_side_effects_ok.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-15} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2182

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3 -4 -5 -6 -7 -11), Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res!) Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], we get 3 subgoals:

split_linear_write_side_effects_ok.1.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Using lemma every_implied, we get 3 subgoals:

split_linear_write_side_effects_ok.1.1.1.1.1:

{-1} (∀ (t: [Memory_Address_4G, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page)

⊃ OK?(linear_write_side_effect_in_page(t)(s′))) ∧ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} cons?[Byte](bl′)
{-8} is_linear_plain_memory?(pm′)
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-10} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2184

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of linear_write_side_effect_in_page, Repeatedly Skolemizing and flattening, Case splitting on pm!1‘rw_addr(t!1‘1), we get 2 subgoals:

split_linear_write_side_effects_ok.1.1.1.1.1.1:

{-1} pm′`rw_addr(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-15} pm′`states(s′)

{1} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Using lemma pm_linear_resolve_write_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Write)(s!1)), length(t!1‘2)),

pm_phy‘rw_addr), we get 3 subgoals:

split_linear_write_side_effects_ok.1.1.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm′`rw_addr(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-17} pm′`states(s′)

{1} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Using lemma linear_resolve_states, Using lemma pm_states, Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

split_linear_write_side_effects_ok.1.1.1.1.1.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-7} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-8} pm′`rw_addr(t′`1)
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-16} Mem?(a′`type_of)
{-17} 0 ≤ a′`offset
{-18} a′`offset < max_linear_offset
{-19} cons?[Byte](bl′)
{-20} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} OK?(memory_write_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma plain_memory_transformers_ok_write_side_effects_block, Using lemma super_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_write_side_effect_super_transformers, Instantiating quantified variables, Rewriting using subset_reflexive, matching in *,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.1.1.1.1.
split_linear_write_side_effects_ok.1.1.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-7} pm′`rw_addr(t′`1)
{-8} cons?(t′`2)
{-9} a′ ≤ t′`1
{-10} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-11} type_of(t′`1) = type_of(a′)
{-12} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-13} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-14} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-15} Mem?(a′`type_of)
{-16} 0 ≤ a′`offset
{-17} a′`offset < max_linear_offset
{-18} cons?[Byte](bl′)
{-19} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

Rewriting using union_right, matching in *,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.1.1.1.2.

split_linear_write_side_effects_ok.1.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-16} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{2} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Hiding formulas: 2,

Using lemma same_page_address_block_write,

we get 3 subgoals:

split_linear_write_side_effects_ok.1.1.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`rw_addr(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

⊃

(address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm′`rw_addr(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-17} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.1.1.2.1.
split_linear_write_side_effects_ok.1.1.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-16} pm′`states(s′)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.1.1.2.2.
split_linear_write_side_effects_ok.1.1.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-16} pm′`states(s′)
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.1.1.2.3.
split_linear_write_side_effects_ok.1.1.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-16} pm′`states(s′)
{1} OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](t′`1, Write)(s′))

{2} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.1.1.3.

split_linear_write_side_effects_ok.1.1.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)
{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset
{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-14} pm′`states(s′)
{1} pm′`rw_addr(t′`1)

{2} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

Hiding formulas: (-7 -12 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.1.2.

split_linear_write_side_effects_ok.1.1.1.1.2:

{-1} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): reg_base(Mem(0))(type_of(a′)) ≤ s`1 ∧ type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.2.

split_linear_write_side_effects_ok.1.1.1.1.3:

{-1} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.1.3.

split_linear_write_side_effects_ok.1.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} cons?[Byte](bl′)
{-6} is_linear_plain_memory?(pm′)
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.2.

split_linear_write_side_effects_ok.1.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} cons?[Byte](bl′)
{-6} is_linear_plain_memory?(pm′)
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.1.3.

split_linear_write_side_effects_ok.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-14} pm′`states(s′)

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2)

⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2196

This completes the proof of split_linear_write_side_effects_ok.1.1.2.

split_linear_write_side_effects_ok.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-14} pm′`states(s′)

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

2198

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.1.3.

split_linear_write_side_effects_ok.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-13} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.2.

split_linear_write_side_effects_ok.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-13} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.1.3.

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_ok.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-11} pm′`states(s′)
{1} a′ + length(bl′) ≤

reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)) {2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Hiding formulas: (-1 -2 -3 -7 2), Expanding the definition of length, Using lemma pm_memory_addr, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -6, Expanding the definition of subset?, Installing automatic rewrites from: (Mem! max_linear! bus_width!) Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_ok.2.

split_linear_write_side_effects_ok.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-11} pm′`states(s′)
{1} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′))) (split(min_page, a′, bl′))

Expanding the definition of reg_base, Expanding the definition of <=, which is trivially true.

This completes the proof of split_linear_write_side_effects_ok.3.

Q.E.D.

C.117.80 Linear_Memory_Properties.split_linear_read_side_effects_data

Terse proof for split_linear_read_side_effects_data.
split_linear_read_side_effects_data:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s)) ⊃ data(linear_read_side_effect_in_page(e)(s)) = e`2)

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: Mem!! max_linear!! min_linear!! Using lemma split_range, Using lemma split_no_null, Using lemma split_type, Using lemma split_pair_cross_size,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

split_linear_read_side_effects_data.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-12} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Using lemma every_conjunct_left,

Using lemma every_conjunct_left,

we get 3 subgoals:

split_linear_read_side_effects_data.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-14} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

2204 (split(min_page, a′, bl′)) we get 3 subgoals:

split_linear_read_side_effects_data.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-15} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

2206

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3 -4 -5 -6 -7 -11), Installing automatic rewrites from: (max_linear! Mem! ##! expr_2_super! expr_2_super_res!) Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], we get 2 subgoals:

split_linear_read_side_effects_data.1.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Using lemma every_implied, we get 2 subgoals:

split_linear_read_side_effects_data.1.1.1.1.1:

{-1} (∀ (t: [Memory_Address_4G, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page)

⊃

OK?(linear_read_side_effect_in_page(t)(s′)) ⊃ data(linear_read_side_effect_in_page(t)(s′)) = t`2)

∧

every(λ (s: [Memory_Address_4G, list[Byte]]): cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} cons?[Byte](bl′)
{-8} is_linear_plain_memory?(pm′)
{-9} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-10} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

2208

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of linear_read_side_effect_in_page, Repeatedly Skolemizing and flattening, Case splitting on union(pm!1‘ro_addr, pm!1‘rw_addr)(t!1‘1), we get 2 subgoals:

split_linear_read_side_effects_data.1.1.1.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-9} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-16} pm′`states(s′)

{1} data((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Using lemma pm_linear_resolve_read_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Read)(s!1)), length(t!1‘2)),

union(pm_phy‘ro_addr, pm_phy‘rw_addr)), we get 3 subgoals:

C Proof scripts

split_linear_read_side_effects_data.1.1.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-11} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-18} pm′`states(s′)

{1} data((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Using lemma linear_resolve_states, Using lemma pm_states, Using lemma pm_plain_phy, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Hiding formulas: (-2 -3 -4 -5 -6 -8), Expanding the definition of side_effect_content_unchanged, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.1.1.1.1.1.1.

split_linear_read_side_effects_data.1.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-10} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-17} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} data((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Hiding formulas: 2,

Using lemma same_page_address_block_read,

we get 3 subgoals:

split_linear_read_side_effects_data.1.1.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ union(pm′`ro_addr, pm′`rw_addr)(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

⊃

(address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-11} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-18} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.1.1.1.1.1.2.1.

split_linear_read_side_effects_data.1.1.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-10} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-17} pm′`states(s′)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.1.1.1.1.1.2.2.
split_linear_read_side_effects_data.1.1.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-10} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-17} pm′`states(s′)
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.1.1.1.1.1.2.3.

split_linear_read_side_effects_data.1.1.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-10} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-17} pm′`states(s′)
{1} OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](t′`1, Read)(s′))

{2} data((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_read_side_effects_data.1.1.1.1.1.1.3.

split_linear_read_side_effects_data.1.1.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-8} OK?((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-15} pm′`states(s′)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} data((linear_resolve(t′`1, Read) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_read_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Hiding formulas: (-7 -8 -13 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.1.1.1.1.2.

split_linear_read_side_effects_data.1.1.1.1.2:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-9} pm′`states(s′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.1.1.1.2.

split_linear_read_side_effects_data.1.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} cons?[Byte](bl′)
{-6} is_linear_plain_memory?(pm′)
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.1.1.2.

split_linear_read_side_effects_data.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-14} pm′`states(s′)

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2)

⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

2218

This completes the proof of split_linear_read_side_effects_data.1.1.2.

split_linear_read_side_effects_data.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-14} pm′`states(s′)

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

2220

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.1.3.
split_linear_read_side_effects_data.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-13} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.2.

split_linear_read_side_effects_data.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-13} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_read_side_effect_in_page(e)(s′)) ⊃ data(linear_read_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.1.3.

split_linear_read_side_effects_data.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-11} pm′`states(s′)
{1} a′ + length(bl′) ≤

reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)) {2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′)) ⊃

data(linear_read_side_effect_in_page(e)(s′)) = e`2) (split(min_page, a′, bl′))

Hiding formulas: (-1 -2 -3 -7 2),

Expanding the definition of length,

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -6,

Expanding the definition of subset?,

Installing automatic rewrites from: (Mem! max_linear! bus_width!)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_data.2.

split_linear_read_side_effects_data.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-11} pm′`states(s′)
{1} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_read_side_effect_in_page(e)(s′)) ⊃

data(linear_read_side_effect_in_page(e)(s′)) = e`2) (split(min_page, a′, bl′))

Expanding the definition of reg_base, Expanding the definition of <=, which is trivially true.

This completes the proof of split_linear_read_side_effects_data.3.

Q.E.D.

C.117.81 Linear_Memory_Properties.split_linear_write_side_effects_data

Terse proof for split_linear_write_side_effects_data.
split_linear_write_side_effects_data:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ pm‘rw_addr) ∧ pm`states(s) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s)) ⊃ data(linear_write_side_effect_in_page(e)(s)) = e`2)

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: Mem!! max_linear!! min_linear!! Using lemma split_range, Using lemma split_no_null, Using lemma split_type,

Using lemma split_pair_cross_size,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

split_linear_write_side_effects_data.1:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset

{-8} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-9} cons?[Byte](bl′)
{-10} is_linear_plain_memory?(pm′)
{-11} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-12} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Using lemma every_conjunct_left,

Using lemma every_conjunct_left,

we get 3 subgoals:

split_linear_write_side_effects_data.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-14} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

2226 (split(min_page, a′, bl′)) we get 3 subgoals:

split_linear_write_side_effects_data.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-15} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

2228

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -3 -4 -5 -6 -7 -11), Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res!) Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], we get 3 subgoals:

split_linear_write_side_effects_data.1.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Using lemma every_implied, we get 3 subgoals:

split_linear_write_side_effects_data.1.1.1.1.1:

{-1} (∀ (t: [Memory_Address_4G, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page)

⊃

OK?(linear_write_side_effect_in_page(t)(s′)) ⊃ data(linear_write_side_effect_in_page(t)(s′)) = t`2)

∧

every(λ (s: [Memory_Address_4G, list[Byte]]): cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} cons?[Byte](bl′)
{-8} is_linear_plain_memory?(pm′)
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-10} pm′`states(s′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

2230

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of linear_write_side_effect_in_page, Repeatedly Skolemizing and flattening, Case splitting on pm!1‘rw_addr(t!1‘1), we get 2 subgoals:

split_linear_write_side_effects_data.1.1.1.1.1.1:

{-1} pm′`rw_addr(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-9} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{-14} is_linear_plain_memory?(pm′)
{-15} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-16} pm′`states(s′)

{1} data((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Using lemma pm_linear_resolve_write_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Write)(s!1)), length(t!1‘2)),

pm_phy‘rw_addr), we get 3 subgoals:

split_linear_write_side_effects_data.1.1.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm′`rw_addr(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-11} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-18} pm′`states(s′)

{1} data((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Using lemma linear_resolve_states,

Using lemma pm_states,

Using lemma pm_plain_phy,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_data.1.1.1.1.1.1.1.1:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-7} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-8} pm′`rw_addr(t′`1)
{-9} cons?(t′`2)
{-10} a′ ≤ t′`1
{-11} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-12} type_of(t′`1) = type_of(a′)
{-13} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-14} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-15} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-16} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-17} Mem?(a′`type_of)
{-18} 0 ≤ a′`offset
{-19} a′`offset < max_linear_offset
{-20} cons?[Byte](bl′)
{-21} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{1} data(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

= t′`2

Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Hiding formulas: (-2 -3 -4 -5 -6 -7), Expanding the definition of side_effect_content_unchanged, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.1.1.1.1.

split_linear_write_side_effects_data.1.1.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′)
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(t′`1, Write)(s′))
{-6} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-7} pm′`rw_addr(t′`1)
{-8} cons?(t′`2)
{-9} a′ ≤ t′`1
{-10} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-11} type_of(t′`1) = type_of(a′)
{-12} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-13} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-14} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-15} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-16} Mem?(a′`type_of)
{-17} 0 ≤ a′`offset
{-18} a′`offset < max_linear_offset
{-19} cons?[Byte](bl′)
{-20} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} data(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

= t′`2

Keeping (-7 1) and hiding *,

Rewriting using union_right, matching in *,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.1.1.1.2.

split_linear_write_side_effects_data.1.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-10} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-17} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{2} data((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Hiding formulas: 2,

Using lemma same_page_address_block_write,

we get 3 subgoals:

split_linear_write_side_effects_data.1.1.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`rw_addr(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

⊃

(address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm′`rw_addr(t′`1)
{-4} cons?(t′`2)
{-5} a′ ≤ t′`1
{-6} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-7} type_of(t′`1) = type_of(a′)
{-8} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-9} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-10} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-11} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset
{-15} cons?[Byte](bl′)
{-16} is_linear_plain_memory?(pm′)
{-17} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-18} pm′`states(s′)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.1.1.2.1.

split_linear_write_side_effects_data.1.1.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-10} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-17} pm′`states(s′)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.1.1.2.2.
split_linear_write_side_effects_data.1.1.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-10} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-17} pm′`states(s′)
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.1.1.2.3.

split_linear_write_side_effects_data.1.1.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} pm′`rw_addr(t′`1)
{-3} cons?(t′`2)
{-4} a′ ≤ t′`1
{-5} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-6} type_of(t′`1) = type_of(a′)
{-7} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-8} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-9} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-10} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)
{-15} is_linear_plain_memory?(pm′)
{-16} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-17} pm′`states(s′)
{1} OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](t′`1, Write)(s′))

{2} data((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.1.1.3.

split_linear_write_side_effects_data.1.1.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-8} OK?((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset
{-12} cons?[Byte](bl′)
{-13} is_linear_plain_memory?(pm′)
{-14} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-15} pm′`states(s′)
{1} pm′`rw_addr(t′`1)

{2} data((linear_resolve(t′`1, Write) ##

(λ (pa: Memory_Address_4G)(ns: Linear_memory[Physical_memory, pm_phy]):

memory_write_side_effect(pm_phy`mem)(pa, t′`2, true)(s′))) (s′))

= t′`2

Hiding formulas: (-7 -8 -13 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.1.2.

split_linear_write_side_effects_data.1.1.1.1.2:

{-1} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): reg_base(Mem(0))(type_of(a′)) ≤ s`1 ∧ type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.2.

split_linear_write_side_effects_data.1.1.1.1.3:

{-1} every(λ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset
{-6} cons?[Byte](bl′)
{-7} is_linear_plain_memory?(pm′)
{-8} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-9} pm′`states(s′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.1.3.

split_linear_write_side_effects_data.1.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} cons?[Byte](bl′)
{-6} is_linear_plain_memory?(pm′)
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.2.

split_linear_write_side_effects_data.1.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < max_linear_offset
{-5} cons?[Byte](bl′)
{-6} is_linear_plain_memory?(pm′)
{-7} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-8} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.1.3.

split_linear_write_side_effects_data.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-14} pm′`states(s′)

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2)

⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

2244

This completes the proof of split_linear_write_side_effects_data.1.1.2.

split_linear_write_side_effects_data.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-11} cons?[Byte](bl′)
{-12} is_linear_plain_memory?(pm′)
{-13} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-14} pm′`states(s′)

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

2246

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.1.3.
split_linear_write_side_effects_data.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-13} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(Mem(0))(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(Mem(max_linear_offset)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.2.

split_linear_write_side_effects_data.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-6} Mem?(a′`type_of)
{-7} 0 ≤ a′`offset
{-8} a′`offset < max_linear_offset

{-9} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-10} cons?[Byte](bl′)
{-11} is_linear_plain_memory?(pm′)
{-12} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-13} pm′`states(s′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(Mem(0)`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]): OK?(linear_write_side_effect_in_page(e)(s′)) ⊃ data(linear_write_side_effect_in_page(e)(s′)) = e`2)

(split(min_page, a′, bl′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.1.3.

split_linear_write_side_effects_data.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-11} pm′`states(s′)
{1} a′ + length(bl′) ≤

reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)) {2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′)) ⊃

data(linear_write_side_effect_in_page(e)(s′)) = e`2) (split(min_page, a′, bl′))

Hiding formulas: (-1 -2 -3 -7 2),

Expanding the definition of length,

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -6,

Expanding the definition of subset?,

Installing automatic rewrites from: (bus_width!)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_data.2.

split_linear_write_side_effects_data.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-8} cons?[Byte](bl′)
{-9} is_linear_plain_memory?(pm′)
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-11} pm′`states(s′)
{1} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

OK?(linear_write_side_effect_in_page(e)(s′)) ⊃

data(linear_write_side_effect_in_page(e)(s′)) = e`2) (split(min_page, a′, bl′))

Expanding the definition of reg_base, Expanding the definition of <=, which is trivially true.

This completes the proof of split_linear_write_side_effects_data.3.

Q.E.D.

C.117.82 Linear_Memory_Properties.split_linear_read_side_effects_unchanged_memory

Terse proof for split_linear_read_side_effects_unchanged_memory.
split_linear_read_side_effects_unchanged_memory:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Using lemma split_range, Using lemma split_no_null, Using lemma split_type,

Using lemma split_pair_cross_size,

Using lemma split_linear_read_side_effects_states,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

split_linear_read_side_effects_unchanged_memory.1:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-3} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′)) {-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-12} cons?[Byte](bl′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Using lemma every_conjunct_left,

Using lemma every_conjunct_left,

we get 3 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} is_linear_plain_memory?(pm′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-7} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-8} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-9} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset

{-13} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-14} cons?[Byte](bl′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2252

we get 3 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} is_linear_plain_memory?(pm′)
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-8} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-9} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-10} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset

{-14} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-15} cons?[Byte](bl′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2254

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]],

we get 3 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1.1.1:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-5} is_linear_plain_memory?(pm′)
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-7} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-8} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-9} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-10} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-11} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset

{-15} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-16} cons?[Byte](bl′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2256

we get 3 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1:

{-1} every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ∧ every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Memory_Address_4G, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

∧

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(t)))))

(split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-3} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-4} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-6} is_linear_plain_memory?(pm′)
{-7} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-8} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-9} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-10} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-11} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-12} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-13} Mem?(a′`type_of)
{-14} 0 ≤ a′`offset
{-15} a′`offset < max_linear_offset

{-16} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-17} cons?[Byte](bl′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2258

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -4 -5 -6 -7 -8 -9 -10 -16), Installing automatic rewrites from: (max_linear! Mem! ##! expr_2_super! expr_2_super_res!) Using lemma every_implied, we get 2 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1:

{-1} (∀ (t: [Memory_Address_4G, list[Byte]]):

cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page) ∧ transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(t))))

⊃

unchanged_memory_invariant?(pm_phy`mem, pm′`states, singleton(expr_2_super(linear_read_side_effect_in_page(t))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

∧

every(λ (s: [Memory_Address_4G, list[Byte]]): cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page) ∧ transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(s)))))

(split(min_page, a′, bl′)) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

{-2} every(λ (t: [Memory_Address_4G, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

∧

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(t)))))

(split(min_page, a′, bl′))

{-3} is_linear_plain_memory?(pm′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} Mem?(a′`type_of)
{-6} 0 ≤ a′`offset
{-7} a′`offset < max_linear_offset
{-8} cons?[Byte](bl′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2260

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of linear_read_side_effect_in_page, Repeatedly Skolemizing and flattening, Case splitting on union(pm!1‘ro_addr, pm!1‘rw_addr)(t!1‘1), we get 2 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-9} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Read) ##

(λ (pa: Mem-

ory_Address_4G)

(ns: Linear_memory [Physical_memory, pm_phy]):

mem-

ory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s)))
(s))))
{-10} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ

(pa: Mem-

ory_Address_4G)

(ns:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s)))
(s))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Using lemma pm_states,

C Proof scripts

Using lemma pm_plain_phy, Expanding the definition of unchanged_memory_invariant?, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -13, Hiding formulas: -13, Using lemma pm_linear_resolve_read_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Read)(s!1)), length(t!1‘2)),

union(pm_phy‘ro_addr, pm_phy‘rw_addr)), we get 3 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-6} cons?(t′`2)
{-7} a′ ≤ t′`1
{-8} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-9} type_of(t′`1) = type_of(a′)
{-10} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-11} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-12} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-13} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Read)(s) of

OK(state, data):

mem-

ory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-14} pm′`states(s′)
{-15} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-16} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-17} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-18} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-19} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-20} Mem?(a′`type_of)
{-21} 0 ≤ a′`offset
{-22} a′`offset < max_linear_offset
{-23} cons?[Byte](bl′)

{1} data(memory_read(pm_phy`mem) (a′′) (state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2263 C Proof scripts

Using lemma linear_resolve_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_unchanged_invariant, Using lemma unchanged_memory_invariant_unchanged, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on memory_read_side_effect_super_transformers(pm_phy‘mem, union (pm_phy‘ro_addr,

pm_phy‘rw_addr)) (expr_2_super (memory_read_side_effect (pm_phy‘mem) (data (linear_resolve (t!1‘1, Read)(s!1)), t!1‘2, TRUE))),

we get 2 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.1.1:

{-1} memory_read_side_effect_super_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

(expr_2_super(memory_read_side_effect(pm_phy`mem)

(data

(linear_resolve

(t′`1, Read)(s′)), t′`2, true)))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)
{-4} OK?(memory_read(pm_phy`mem)(a′′)(s′))
{-5} plain_memory?(pm_phy)
{-6} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-7} pm′`states(s′)
{-8} OK?(linear_resolve(t′`1, Read)(s′))
{-9} pm_phy`states(state(linear_resolve(t′`1, Read)(s′)))
{-10} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-11} pm′`states = pm_phy`states
{-12} cons?(t′`2)
{-13} a′ ≤ t′`1
{-14} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-15} type_of(t′`1) = type_of(a′)
{-16} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-17} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-18} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-19} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Read)(s) of

OK(state, data):

mem-

ory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-20} OK?(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))

{-21} OK?(OK(state(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))))

{-22} OK?(memory_read(pm_phy`mem)

(a′′)

(state(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))))

{-23} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-24} Mem?(a′`type_of)
{-25} 0 ≤ a′`offset
{-26} a′`offset < max_linear_offset
{-27} cons?[Byte](bl′)

{1} union((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))),

(memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))) (expr_2_super(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)))

{2} data(memory_read(pm_phy`mem)

(a′′)

(state(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2265 C Proof scripts

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.1.1.

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)
{-3} OK?(memory_read(pm_phy`mem)(a′′)(s′))
{-4} plain_memory?(pm_phy)
{-5} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-6} pm′`states(s′)
{-7} OK?(linear_resolve(t′`1, Read)(s′))
{-8} pm_phy`states(state(linear_resolve(t′`1, Read)(s′)))
{-9} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))
{-10} pm′`states = pm_phy`states
{-11} cons?(t′`2)
{-12} a′ ≤ t′`1
{-13} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-14} type_of(t′`1) = type_of(a′)
{-15} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-16} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-17} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-18} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Read)(s) of

OK(state, data):

mem-

ory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-19} OK?(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))

{-20} OK?(OK(state(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))))

{-21} OK?(memory_read(pm_phy`mem)

(a′′)

(state(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))))

{-22} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-23} Mem?(a′`type_of)
{-24} 0 ≤ a′`offset
{-25} a′`offset < max_linear_offset
{-26} cons?[Byte](bl′)

{1} memory_read_side_effect_super_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

(expr_2_super(memory_read_side_effect(pm_phy`mem)

(data

(linear_resolve

(t′`1, Read)(s′)), t′`2, true)))

{2} union((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))),

(memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))) (expr_2_super(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)))

{3} data(memory_read(pm_phy`mem)

(a′′)

(state(memory_read_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Read)(s′)), t′`2, true)(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2267 C Proof scripts

Hiding formulas: (-1 -11 2 3), Expanding the definition of memory_read_side_effect_super_transformers, Instantiating quantified variables,

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.1.2.

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-5} cons?(t′`2)
{-6} a′ ≤ t′`1
{-7} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-8} type_of(t′`1) = type_of(a′)
{-9} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-10} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-11} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-12} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Read)(s) of

OK(state, data):

mem-

ory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-13} pm′`states(s′)
{-14} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-15} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-16} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-17} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-18} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-19} Mem?(a′`type_of)
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} cons?[Byte](bl′)
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{2} data(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2269 C Proof scripts

Hiding formulas: 2, Using lemma same_page_address_block_read, we get 3 subgoals:

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ union(pm′`ro_addr, pm′`rw_addr)(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

⊃

(address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-6} cons?(t′`2)
{-7} a′ ≤ t′`1
{-8} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-9} type_of(t′`1) = type_of(a′)
{-10} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-11} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-12} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-13} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Read)(s) of

OK(state, data):

mem-

ory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-14} pm′`states(s′)
{-15} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-16} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-17} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-18} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-19} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-20} Mem?(a′`type_of)
{-21} 0 ≤ a′`offset
{-22} a′`offset < max_linear_offset
{-23} cons?[Byte](bl′)
{1} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

2271

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.2.1.

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-5} cons?(t′`2)
{-6} a′ ≤ t′`1
{-7} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-8} type_of(t′`1) = type_of(a′)
{-9} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-10} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-11} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-12} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Read)(s) of

OK(state, data):

mem-

ory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-13} pm′`states(s′)
{-14} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-15} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-16} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-17} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-18} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-19} Mem?(a′`type_of)
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} cons?[Byte](bl′)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

2273 C Proof scripts

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.2.2.

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-5} cons?(t′`2)
{-6} a′ ≤ t′`1
{-7} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-8} type_of(t′`1) = type_of(a′)
{-9} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-10} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-11} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-12} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Read)(s) of

OK(state, data):

mem-

ory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-13} pm′`states(s′)
{-14} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-15} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-16} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-17} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-18} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-19} Mem?(a′`type_of)
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} cons?[Byte](bl′)
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Read)(s′)), length(t′‘2)) ⊆ (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

2275 C Proof scripts

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.2.3.

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Read)(s′))
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} union(pm′`ro_addr, pm′`rw_addr)(t′`1)
{-5} cons?(t′`2)
{-6} a′ ≤ t′`1
{-7} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-8} type_of(t′`1) = type_of(a′)
{-9} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-10} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-11} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-12} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Read)(s) of

OK(state, data):

mem-

ory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-13} pm′`states(s′)
{-14} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-15} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-16} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-17} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-18} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-19} Mem?(a′`type_of)
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} cons?[Byte](bl′)

{1} OK?[Linear_memory[Physical_memory, pm_phy], Address]

(linear_resolve[Physical_memory, pm_phy](t′`1, Read)(s′))

{2} data(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Read)(s) of

OK(state, data):

memory_read_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2277

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.1.3.
split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base(min_linear)(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-8} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Read) ##

(λ (pa: Mem-

ory_Address_4G)

(ns: Linear_memory [Physical_memory, pm_phy]):

mem-

ory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s)))
(s))))
{-9} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): (linear_resolve(t′`1, Read) ##

(λ

(pa: Mem-

ory_Address_4G)

(ns:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_read_side_effect(pm_phy`mem)

(pa, t′`2, true)(s)))
(s))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Hiding formulas: (-8 -7 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.1.2.

split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.2:

{-1} every(λ (t: [Memory_Address_4G, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤ expt(2, min_page))

∧

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(t)))))

(split(min_page, a′, bl′))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset
{-7} cons?[Byte](bl′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Expanding the definition of min_linear,

Expanding the definition of Mem,

which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.1.2.

split_linear_read_side_effects_unchanged_memory.1.1.1.1.2:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-5} is_linear_plain_memory?(pm′)
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-7} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-8} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-9} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-10} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-11} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset

{-15} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-16} cons?[Byte](bl′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2280

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.2.

split_linear_read_side_effects_unchanged_memory.1.1.1.1.3:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(t_1‘1)) + length(t_1‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (s: [Memory_Address_4G, list[Byte]]):

cons?(s`2) ∧ a′ ≤ s`1 ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ type_of(s`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ s`1 ∧ s`1 < reg_size(max_linear)(type_of(a′)) ∧ rem(expt(2, min_page))(offset(s‘1)) + length(s‘2) ≤ expt(2, min_page))

(split(min_page, a′, bl′))

{-2} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-3} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-5} is_linear_plain_memory?(pm′)
{-6} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-7} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-8} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-9} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-10} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-11} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-12} Mem?(a′`type_of)
{-13} 0 ≤ a′`offset
{-14} a′`offset < max_linear_offset

{-15} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-16} cons?[Byte](bl′)

{1} ∀ (s: [Memory_Address_4G, list[Byte]]): type_of(s`1) = type_of(a′) ∧ s‘1 + length(s‘2) ≤ a′ + length(bl′) ∧ a′ ≤ s`1 ∧ cons?(s`2) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2282

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of min_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.1.3.

split_linear_read_side_effects_unchanged_memory.1.1.1.2:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} is_linear_plain_memory?(pm′)
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-8} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-9} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-10} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset

{-14} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-15} cons?[Byte](bl′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2284

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.2.

split_linear_read_side_effects_unchanged_memory.1.1.1.3:

{-1} every(λ (t_1: [Address, list[Byte]]):

cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ∧ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page))

(split(min_page, a′, bl′)) ⊃ every(λ (t: [Address, list[Byte]]):

(cons?(t`2) ∧ a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

∧

rem(expt(2, min_page))(offset(t‘1)) + length(t‘2) ≤

expt(2, min_page)) (split(min_page, a′, bl′))

{-2} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]):

(cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃ every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-4} is_linear_plain_memory?(pm′)
{-5} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-6} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-8} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-9} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-10} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset

{-14} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-15} cons?[Byte](bl′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t`1 ∧ cons?(t`2) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2286

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of min_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.1.3.

split_linear_read_side_effects_unchanged_memory.1.1.2:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} is_linear_plain_memory?(pm′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-7} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-8} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-9} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset

{-13} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-14} cons?[Byte](bl′)

{1} ∀ (t_1: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2288

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.2.

split_linear_read_side_effects_unchanged_memory.1.1.3:

{-1} every(λ (t: [Address, list[Byte]]):

cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′)) ∧ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′)) ⊃ every(λ (t_1: [Address, list[Byte]]): (cons?(t_1`2) ∧

a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′)) ∧ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-3} is_linear_plain_memory?(pm′)
{-4} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-5} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-7} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-8} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-9} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset

{-13} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-14} cons?[Byte](bl′)

{1} ∀ (t_1: [Address, list[Byte]]):

type_of(t_1`1) = type_of(a′) ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ∧ a′ ≤ t_1`1 ∧ cons?(t_1`2) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

2290

Expanding the definition of min_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.1.3.
split_linear_read_side_effects_unchanged_memory.1.2:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-6} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-8} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset

{-12} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-13} cons?[Byte](bl′)

{1} ∀ (t: [Address, list[Byte]]):

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ type_of(t`1) = type_of(a′) ⊃ Mem?(max_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.2.
split_linear_read_side_effects_unchanged_memory.1.3:

{-1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′)) ∧

every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

⊃

every(λ (t: [Address, list[Byte]]): cons?(t`2) ∧

a′ ≤ t`1 ∧ t‘1 + length(t‘2) ≤ a′ + length(bl′))

(split(min_page, a′, bl′))

{-2} is_linear_plain_memory?(pm′)
{-3} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-4} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-6} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-8} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-9} Mem?(a′`type_of)
{-10} 0 ≤ a′`offset
{-11} a′`offset < max_linear_offset

{-12} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-13} cons?[Byte](bl′)

{1} ∀ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ⊃ Mem?(min_linear`type_of)

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Expanding the definition of min_linear, Expanding the definition of Mem, which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.1.3.

split_linear_read_side_effects_unchanged_memory.2:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-3} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′)) {-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{1} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Hiding formulas: (-3 -4 -5 -6 -10 2),

Expanding the definition of length,

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -2,

Expanding the definition of subset?,

Installing automatic rewrites from: (Mem! max_linear! bus_width!)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_read_side_effects_unchanged_memory.2.

split_linear_read_side_effects_unchanged_memory.3:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-3} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{1} reg_base(min_linear)(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_read_side_effect_in_page

(e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Expanding the definition of reg_base,

Expanding the definition of min_linear,

Expanding the definition of Mem,

Expanding the definition of <=,

which is trivially true.

This completes the proof of split_linear_read_side_effects_unchanged_memory.3.

Q.E.D.

C.117.83 Linear_Memory_Properties.split_linear_write_side_effects_unchanged_memory

Terse proof for split_linear_write_side_effects_unchanged_memory.

C.117 Proofs for Linear_Memory_Properties (challenge-linear.pvs)

split_linear_write_side_effects_unchanged_memory:

{1} ∀ (pm: Plain_Memory[Linear_memory], a: Memory_Address_4G, bl: (cons?[Byte])): is_linear_plain_memory?(pm) ∧ (address_block(a, length(bl)) ⊆ pm‘rw_addr) ⊃ every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm`states,

singleton(expr_2_super(linear_write_side_effect_in_page (e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: (Mem! max_linear! min_linear!) Using lemma split_range, Using lemma split_no_null, Using lemma split_type, Using lemma split_pair_cross_size, Using lemma split_linear_write_side_effects_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

split_linear_write_side_effects_unchanged_memory.1:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-3} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′)) {-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a′) ∧

reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)))

(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-7} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-8} Mem?(a′`type_of)
{-9} 0 ≤ a′`offset
{-10} a′`offset < max_linear_offset

{-11} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧

rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) (bl′)

{-12} cons?[Byte](bl′)

{1} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page (e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Using lemma every_conjunct_left, Using lemma every_conjunct_left, Using lemma every_conjunct_left, Using lemma every_extend[[Address, list[Byte]], [Memory_Address_4G, list[Byte]]], Using lemma every_conjunct_left, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -4 -5 -6 -7 -8 -9 -12 -16), Installing automatic rewrites from: ( ##! expr_2_super! expr_2_super_res!) Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 2), Expanding the definition of linear_write_side_effect_in_page, Repeatedly Skolemizing and flattening, Case splitting on pm!1‘rw_addr(t!1‘1), we get 2 subgoals:

split_linear_write_side_effects_unchanged_memory.1.1:

{-1} pm′`rw_addr(t′`1)
{-2} cons?(t′`2)
{-3} a′ ≤ t′`1
{-4} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-5} type_of(t′`1) = type_of(a′)
{-6} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-7} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-8} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-9} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Write) ##

(λ (pa: Mem-

ory_Address_4G)

(ns: Linear_memory [Physical_memory, pm_phy]):

mem-

ory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s)))
(s))))
{-10} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-11} Mem?(a′`type_of)
{-12} 0 ≤ a′`offset
{-13} a′`offset < max_linear_offset
{-14} cons?[Byte](bl′)

{1} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ

(pa: Mem-

ory_Address_4G)

(ns:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s)))
(s))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Using lemma pm_states, Using lemma pm_plain_phy, Expanding the definition of unchanged_memory_invariant?, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -13,

C Proof scripts

Hiding formulas: -13, Using lemma pm_linear_resolve_write_ok, Case splitting on subset?(address_block(data(linear_resolve(t!1‘1, Write)(s!1)), length(t!1‘2)),

pm_phy‘rw_addr), we get 3 subgoals:

split_linear_write_side_effects_unchanged_memory.1.1.1:

{-1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} pm′`rw_addr(t′`1)
{-6} cons?(t′`2)
{-7} a′ ≤ t′`1
{-8} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-9} type_of(t′`1) = type_of(a′)
{-10} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-11} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-12} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-13} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-14} pm′`states(s′)
{-15} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-16} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-17} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-18} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-19} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-20} Mem?(a′`type_of)
{-21} 0 ≤ a′`offset
{-22} a′`offset < max_linear_offset
{-23} cons?[Byte](bl′)

{1} data(memory_read(pm_phy`mem) (a′′) (state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2299 C Proof scripts

Using lemma linear_resolve_states, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

split_linear_write_side_effects_unchanged_memory.1.1.1.1:

{-1} pm′`states(s′)
{-2} OK?(linear_resolve(t′`1, Write)(s′))
{-3} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-4} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-5} plain_memory?(pm_phy)
{-6} pm′`states = pm_phy`states
{-7} pm′`rw_addr(t′`1)
{-8} cons?(t′`2)
{-9} a′ ≤ t′`1
{-10} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-11} type_of(t′`1) = type_of(a′)
{-12} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-13} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-14} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-15} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-16} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-17} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-18} OK?(OK(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))))

{-19} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-20} OK?(memory_read(pm_phy`mem)

(a′′)

(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))))

{-21} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-22} Mem?(a′`type_of)
{-23} 0 ≤ a′`offset
{-24} a′`offset < max_linear_offset
{-25} cons?[Byte](bl′)

{1} data(memory_read(pm_phy`mem) (a′′) (state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)

(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

Using lemma plain_memory_unchanged_invariant,

C Proof scripts

Using lemma unchanged_memory_invariant_unchanged, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Case splitting on memory_write_side_effect_super_transformers(pm_phy‘mem, pm_phy‘rw_addr)

(expr_2_super (memory_write_side_effect (pm_phy‘mem) (data (linear_resolve (t!1‘1, Write)(s!1)), t!1‘2, TRUE))),

we get 2 subgoals:

split_linear_write_side_effects_unchanged_memory.1.1.1.1.1:

{-1} memory_write_side_effect_super_transformers(pm_phy`mem, pm_phy`rw_addr)

(expr_2_super(memory_write_side_effect(pm_phy`mem)

(data

(linear_resolve

(t′`1, Write)(s′)), t′`2, true)))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-3} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)
{-4} OK?(memory_read(pm_phy`mem)(a′′)(s′))
{-5} plain_memory?(pm_phy)
{-6} pm′`states(s′)
{-7} OK?(linear_resolve(t′`1, Write)(s′))
{-8} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-9} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-10} pm′`states = pm_phy`states
{-11} pm′`rw_addr(t′`1)
{-12} cons?(t′`2)
{-13} a′ ≤ t′`1
{-14} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-15} type_of(t′`1) = type_of(a′)
{-16} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-17} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-18} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-19} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-20} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-21} OK?(OK(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))))

{-22} OK?(memory_read(pm_phy`mem)

(a′′)

(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))))

{-23} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-24} Mem?(a′`type_of)
{-25} 0 ≤ a′`offset
{-26} a′`offset < max_linear_offset
{-27} cons?[Byte](bl′)

{1} union((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))),

(memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))) (expr_2_super(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)))

{2} data(memory_read(pm_phy`mem)

(a′′)

(state(memory_write_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Write)(s′)), t′`2, true) (s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2303 C Proof scripts

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_unchanged_memory.1.1.1.1.1.

split_linear_write_side_effects_unchanged_memory.1.1.1.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, ((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))), (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

{-2} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)
{-3} OK?(memory_read(pm_phy`mem)(a′′)(s′))
{-4} plain_memory?(pm_phy)
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(t′`1, Write)(s′))
{-7} pm_phy`states(state(linear_resolve(t′`1, Write)(s′)))
{-8} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-9} pm′`states = pm_phy`states
{-10} pm′`rw_addr(t′`1)
{-11} cons?(t′`2)
{-12} a′ ≤ t′`1
{-13} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-14} type_of(t′`1) = type_of(a′)
{-15} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-16} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-17} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-18} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-19} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-20} OK?(OK(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))))

{-21} OK?(memory_read(pm_phy`mem)

(a′′)

(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))))

{-22} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-23} Mem?(a′`type_of)
{-24} 0 ≤ a′`offset
{-25} a′`offset < max_linear_offset
{-26} cons?[Byte](bl′)

{1} memory_write_side_effect_super_transformers(pm_phy`mem, pm_phy`rw_addr)

(expr_2_super(memory_write_side_effect(pm_phy`mem)

(data

(linear_resolve

(t′`1, Write)(s′)), t′`2, true)))

{2} union((pm_phy‘other_actions∪ memory_read_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))),

(memory_read_side_effect_super_transformers (pm_phy‘mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm_phy‘mem, pm_phy‘rw_addr))) (expr_2_super(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)))

{3} data(memory_read(pm_phy`mem)

(a′′)

(state(memory_write_side_effect(pm_phy`mem) (data(linear_resolve(t′`1, Write)(s′)), t′`2, true) (s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2305 C Proof scripts

Hiding formulas: (-1 -18 2 3), Expanding the definition of memory_write_side_effect_super_transformers, Instantiating quantified variables,

This completes the proof of split_linear_write_side_effects_unchanged_memory.1.1.1.1.2.

split_linear_write_side_effects_unchanged_memory.1.1.1.2:

{-1} pm′`states(s′)
{-2} OK?(linear_resolve(t′`1, Write)(s′))
{-3} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)
{-4} plain_memory?(pm_phy)
{-5} pm′`states = pm_phy`states
{-6} pm′`rw_addr(t′`1)
{-7} cons?(t′`2)
{-8} a′ ≤ t′`1
{-9} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-10} type_of(t′`1) = type_of(a′)
{-11} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-12} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-13} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-14} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-15} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-16} OK?(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))

{-17} OK?(OK(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))))

{-18} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-19} OK?(memory_read(pm_phy`mem)

(a′′)

(state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)(s′))))

{-20} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-21} Mem?(a′`type_of)
{-22} 0 ≤ a′`offset
{-23} a′`offset < max_linear_offset
{-24} cons?[Byte](bl′)
{1} union(pm′`ro_addr, pm′`rw_addr)(t′`1)

{2} data(memory_read(pm_phy`mem) (a′′) (state(memory_write_side_effect(pm_phy`mem)

(data(linear_resolve(t′`1, Write)(s′)), t′`2, true)

(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

Keeping (-6 1) and hiding *,

C Proof scripts

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_unchanged_memory.1.1.1.2.

split_linear_write_side_effects_unchanged_memory.1.1.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`rw_addr(t′`1)
{-5} cons?(t′`2)
{-6} a′ ≤ t′`1
{-7} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-8} type_of(t′`1) = type_of(a′)
{-9} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-10} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-11} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-12} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-13} pm′`states(s′)
{-14} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-15} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-16} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-17} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-18} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-19} Mem?(a′`type_of)
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} cons?[Byte](bl′)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{2} data(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2309 C Proof scripts

Hiding formulas: 2, Using lemma same_page_address_block_write, we get 3 subgoals:

split_linear_write_side_effects_unchanged_memory.1.1.2.1:

{-1} is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ∧ pm′`rw_addr(t′`1) ∧ a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + length(bl′) ∧ rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page) ∧ (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

⊃

(address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

{-2} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-3} plain_memory?(pm_phy)
{-4} pm′`states = pm_phy`states
{-5} pm′`rw_addr(t′`1)
{-6} cons?(t′`2)
{-7} a′ ≤ t′`1
{-8} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-9} type_of(t′`1) = type_of(a′)
{-10} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-11} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-12} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-13} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-14} pm′`states(s′)
{-15} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-16} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-17} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-18} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-19} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-20} Mem?(a′`type_of)
{-21} 0 ≤ a′`offset
{-22} a′`offset < max_linear_offset
{-23} cons?[Byte](bl′)
{1} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

2311

This completes the proof of split_linear_write_side_effects_unchanged_memory.1.1.2.1.

split_linear_write_side_effects_unchanged_memory.1.1.2.2:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`rw_addr(t′`1)
{-5} cons?(t′`2)
{-6} a′ ≤ t′`1
{-7} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-8} type_of(t′`1) = type_of(a′)
{-9} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-10} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-11} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-12} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-13} pm′`states(s′)
{-14} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-15} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-16} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-17} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-18} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-19} Mem?(a′`type_of)
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} cons?[Byte](bl′)
{1} length[Byte](t′`2) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

2313 C Proof scripts

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_unchanged_memory.1.1.2.2.

split_linear_write_side_effects_unchanged_memory.1.1.2.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`rw_addr(t′`1)
{-5} cons?(t′`2)
{-6} a′ ≤ t′`1
{-7} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-8} type_of(t′`1) = type_of(a′)
{-9} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-10} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-11} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-12} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-13} pm′`states(s′)
{-14} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-15} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-16} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-17} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-18} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-19} Mem?(a′`type_of)
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} cons?[Byte](bl′)
{1} length[Byte](bl′) > 0
{2} (address_block(data(linear_resolve(t′‘1, Write)(s′)), length(t′‘2)) ⊆ pm_phy‘rw_addr)

2315 C Proof scripts

Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of split_linear_write_side_effects_unchanged_memory.1.1.2.3.

split_linear_write_side_effects_unchanged_memory.1.1.3:

{-1} is_linear_plain_memory?(pm′) ⊃ OK?(linear_resolve(t′`1, Write)(s′))
{-2} plain_memory?(pm_phy)
{-3} pm′`states = pm_phy`states
{-4} pm′`rw_addr(t′`1)
{-5} cons?(t′`2)
{-6} a′ ≤ t′`1
{-7} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-8} type_of(t′`1) = type_of(a′)
{-9} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-10} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-11} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-12} transformer_invariant?(pm′`states,

                               {y |

y = expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases lin-

ear_resolve(t′`1, Write)(s) of

OK(state, data):

mem-

ory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state),

Fatal: Fatal, Hang: Hang endcases)})

{-13} pm′`states(s′)
{-14} union(pm_phy`ro_addr, pm_phy`rw_addr)(a′′)

{-15} OK?(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)(data, t′`2, true)(s), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))

{-16} OK?(memory_read(pm_phy`mem)(a′′)(s′))

{-17} OK?(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

{-18} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-19} Mem?(a′`type_of)
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} cons?[Byte](bl′)

{1} OK?[Linear_memory[Physical_memory, pm_phy], Address]

(linear_resolve[Physical_memory, pm_phy](t′`1, Write)(s′))

{2} data(memory_read(pm_phy`mem)

(a′′)

(state(expr_2_super(λ (s: Linear_memory[Physical_memory, pm_phy]):

cases linear_resolve(t′`1, Write)(s) of

OK(state, data):

memory_write_side_effect(pm_phy`mem)

(data, t′`2, true)(s), Exception(ex_type, state): Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

(s′))))

= data(memory_read(pm_phy`mem)(a′′)(s′))

2317

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_linear_write_side_effects_unchanged_memory.1.1.3.
split_linear_write_side_effects_unchanged_memory.1.2:

{-1} cons?(t′`2)
{-2} a′ ≤ t′`1
{-3} t′‘1 + length(t′‘2) ≤ a′ + length(bl′)
{-4} type_of(t′`1) = type_of(a′)
{-5} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ t′`1
{-6} t′`1 < reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′))
{-7} rem(expt(2, min_page))(offset(t′‘1)) + length(t′‘2) ≤ expt(2, min_page)

{-8} transformer_invariant?(pm′`states,

singleton(expr_2_super(λ (s:

Lin-

ear_memory[Physical_memory, pm_phy]):

(linear_resolve(t′`1, Write) ##

(λ (pa: Mem-

ory_Address_4G)

(ns: Linear_memory [Physical_memory, pm_phy]):

mem-

ory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s)))
(s))))
{-9} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-10} Mem?(a′`type_of)
{-11} 0 ≤ a′`offset
{-12} a′`offset < max_linear_offset
{-13} cons?[Byte](bl′)
{1} pm′`rw_addr(t′`1)

{2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(λ (s:

Linear_memory

[Physical_memory, pm_phy]): (linear_resolve(t′`1, Write) ##

(λ

(pa: Mem-

ory_Address_4G)

(ns:

Linear_memory

[Physical_memory, pm_phy]): mem-

ory_write_side_effect(pm_phy`mem)

(pa, t′`2, true)(s)))
(s))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr))

Hiding formulas: (-8 -7 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_unchanged_memory.1.2.

split_linear_write_side_effects_unchanged_memory.2:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-3} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′)) {-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{1} a′ + length(bl′) ≤

reg_size((#type_of := Mem_, offset := max_linear_offset#))(type_of(a′)) {2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page (e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Hiding formulas: (-3 -4 -5 -6 -10 2),

Expanding the definition of length,

Using lemma pm_memory_addr,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -2,

Expanding the definition of subset?,

Installing automatic rewrites from: (Mem! max_linear! bus_width!)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_linear_write_side_effects_unchanged_memory.2.

split_linear_write_side_effects_unchanged_memory.3:

{-1} is_linear_plain_memory?(pm′)
{-2} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)

{-3} every(λ (e: [Memory_Address_4G, list[Byte]]):

transformer_invariant?(pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page(e)))))

(split(min_page, a′, bl′))

{-4} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, min_page))(offset(a_{2})) + length(bl2) ≤ expt(2, min_page)) (split(min_page, a′, bl′))

{-5} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-6} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-7} Mem?(a′`type_of)
{-8} 0 ≤ a′`offset
{-9} a′`offset < max_linear_offset

{-10} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-11} cons?[Byte](bl′)
{1} reg_base((#type_of := Mem_, offset := 0#))(type_of(a′)) ≤ a′

{2} every(λ (e: [Memory_Address_4G, list[Byte]]):

unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super(linear_write_side_effect_in_page (e))),

(pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

(split(min_page, a′, bl′))

Expanding the definition of reg_base,

Expanding the definition of <=,

which is trivially true.

This completes the proof of split_linear_write_side_effects_unchanged_memory.3.

Q.E.D.

C.117.84 Linear_Memory_Properties.linear_unchanged_invariant

Terse proof for linear_unchanged_invariant.

linear_unchanged_invariant:

{1} ∀ (pm: Plain_Memory[Linear_memory], transformers: PRED[[Linear_memory → SuperResult[Linear_memory]]], addresses: PRED[Memory_Address_4G]):

(is_linear_plain_memory?(pm) ∧ (addresses ⊆ restrict [Address, Memory_Address_4G , boolean]((pm‘ro_addr∪ pm‘rw_addr))) ∧ (∀ (s: (pm`states)):

unchanged_memory_invariant?(pm_phy`mem, pm_phy`states, transformers,

extend[Address, Mem-

ory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses, (singleton(Read) ∪ singleton(Execute)))))))

⊃

unchanged_memory_invariant?(pm`mem, pm`states, transformers,

extend[Address, Mem-

ory_Address_4G, bool, false](addresses))

Installing automatic rewrites from: has_next_state fatal_result

Expanding the definition of unchanged_memory_invariant?,

Repeatedly Skolemizing and flattening,

Using lemma pm_states,

Case splitting on transformer_invariant?(pm!1‘states, transformers!1),

we get 2 subgoals:

linear_unchanged_invariant.1:

{-1} transformer_invariant?(pm′`states, transformers′)
{-2} is_linear_plain_memory?(pm′) ⊃ pm′`states = pm_phy`states
{-3} is_linear_plain_memory?(pm′)
{-4} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-5} ∀ (s: (pm′`states)):

transformer_invariant?(pm_phy`states, transformers′) ∧ (∀ (s_1: Physical_memory, q: [Physical_memory → SuperRe-

sult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′,

(singleton(Read) ∪ singleton(Execute))))

(a) ∧ OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1)))

{1} transformer_invariant?(pm′`states, transformers′) ∧

(∀ (s: Linear_memory[Physical_memory, pm_phy],

q: [Linear_memory[Physical_memory, pm_phy] → SuperRe-

sult[Physical_memory]],

a: Address): pm′`states(s) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false](addresses′)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′`mem)(a)(s)) ∧ OK?(memory_read(pm′`mem)(a)(state(q(s))))

⊃

data(memory_read(pm′`mem)(a)(state(q(s)))) = data(memory_read(pm′`mem)(a)(s)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Rewriting using pm_read_linear, matching in *,

Expanding the definition of linear_read,

Installing automatic rewrites from: (expr_2_super! expr_2_super_res! ##! singleton!)

Case splitting on union(pm!1‘ro_addr, pm!1‘rw_addr)(a!1),

we get 2 subgoals:

linear_unchanged_invariant.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} transformer_invariant?(pm′`states, transformers′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states = pm_phy`states
{-5} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute)))) (a)

∧

OK?(q(s_1)) ∧

OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1))

{-7} pm′`states(s′)
{-8} transformers′(q′)
{-9} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-10} OK?(q′(s′))

{-11} OK?(if in_memory(min_linear, max_linear)(a′)

then if Mem?(type_of(a′))

then (linear_resolve(a′, Read) ## (λ (pa: Address): memory_read(pm_phy`mem)(pa))) (s′)

else memory_read(pm_phy`mem)(a′)(s′)

endif else fatal_result(s′) endif)

{-12} OK?(if in_memory(min_linear, max_linear)(a′)

then if Mem?(type_of(a′))

then (linear_resolve(a′, Read) ## (λ (pa: Address): memory_read(pm_phy`mem)(pa))) (state(q′(s′)))

else memory_read(pm_phy`mem)(a′)(state(q′(s′)))

endif else fatal_result(state(q′(s′))) endif)

{1} if in_memory(min_linear, max_linear)(a′)

then if Mem?(type_of(a′))

then data((linear_resolve(a′, Read) ## (λ (pa: Address): memory_read(pm_phy`mem)(pa))) (state(q′(s′)))) else data(memory_read(pm_phy`mem)(a′)(state(q′(s′)))) endif

else data(fatal_result(state(q′(s′))))

endif = if in_memory(min_linear, max_linear)(a′)

then if Mem?(type_of(a′))

then data((linear_resolve(a′, Read) ## (λ (pa: Address): memory_read(pm_phy`mem)(pa))) (s′)) else data(memory_read(pm_phy`mem)(a′)(s′)) endif else data(fatal_result(s′)) endif

2323

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_unchanged_invariant.1.1.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} transformer_invariant?(pm′`states, transformers′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states = pm_phy`states
{-5} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-6} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute)))) (a)

∧

OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1))

{-7} pm′`states(s′)
{-8} transformers′(q′)
{-9} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-10} OK?(q′(s′))
{-11} in_memory(min_linear, max_linear)(a′)
{-12} Mem?(type_of(a′))
{-13} OK?(linear_resolve(a′, Read)(s′))

{-14} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-15} OK?(linear_resolve(a′, Read)(state(q′(s′))))

{-16} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

=

data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

Using lemma super_transformer_invariant_next_ok, Using lemma linear_resolve_same_result, Using lemma linear_resolve_unchanged_pm_phy, Using lemma unchanged_memory_invariant_unchanged, Using lemma unchanged_memory_invariant_unchanged, Case splitting on union(pm_phy‘ro_addr, pm_phy‘rw_addr) (data(linear_resolve(a!1, Read)(s!1))), we get 2 subgoals:

linear_unchanged_invariant.1.1.1.1:

{-1} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(state(q′(s′))) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(state(q′(s′)))) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

∧

OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(s′) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(s′)) ∧

OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′)) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

= data(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))

{-4} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-5} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(state(q′(s′))) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Read)(state(q′(s′)))) ∧ OK?(linear_resolve(a′, Read)(s′))

⊃ data(linear_resolve(a′, Read)(state(q′(s′)))) = data(linear_resolve(a′, Read)(s′))

{-6} transformer_invariant?(pm′`states, transformers′) ∧ pm′`states(s′) ∧ transformers′(q′) ∧ has_next_state(q′(s′)) ⊃ pm′`states(state(q′(s′)))

{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} transformer_invariant?(pm′`states, transformers′)
{-9} is_linear_plain_memory?(pm′)
{-10} pm′`states = pm_phy`states
{-11} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute))))

(a) ∧ OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) =

data(memory_read(pm_phy`mem)(a)(s_1))

{-13} pm′`states(s′)
{-14} transformers′(q′)
{-15} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-16} OK?(q′(s′))
{-17} in_memory(min_linear, max_linear)(a′)
{-18} Mem?(type_of(a′))
{-19} OK?(linear_resolve(a′, Read)(s′))

{-20} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-21} OK?(linear_resolve(a′, Read)(state(q′(s′))))

{-22} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

2325 C Proof scripts

Case splitting on OK?(memory_read(pm_phy‘mem)(data(linear_resolve(a!1, Read)(s!1)))(s!1)), OK?(memory_read(pm_phy‘mem) (data(linear_resolve(a!1, Read)(s!1)))(state(q!1(s!1)))),

we get 3 subgoals:

linear_unchanged_invariant.1.1.1.1.1:

{-1} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-2} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-3} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(state(q′(s′))) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(state(q′(s′)))) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

∧

OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-5} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(s′) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(s′)) ∧

OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′)) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

= data(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))

{-6} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-7} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(state(q′(s′))) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Read)(state(q′(s′)))) ∧ OK?(linear_resolve(a′, Read)(s′))

⊃ data(linear_resolve(a′, Read)(state(q′(s′)))) = data(linear_resolve(a′, Read)(s′))

{-8} transformer_invariant?(pm′`states, transformers′) ∧ pm′`states(s′) ∧ transformers′(q′) ∧ has_next_state(q′(s′)) ⊃ pm′`states(state(q′(s′)))

{-9} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-10} transformer_invariant?(pm′`states, transformers′)
{-11} is_linear_plain_memory?(pm′)
{-12} pm′`states = pm_phy`states
{-13} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-14} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute))))

(a) ∧ OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) =

data(memory_read(pm_phy`mem)(a)(s_1))

{-15} pm′`states(s′)
{-16} transformers′(q′)
{-17} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-18} OK?(q′(s′))
{-19} in_memory(min_linear, max_linear)(a′)
{-20} Mem?(type_of(a′))
{-21} OK?(linear_resolve(a′, Read)(s′))

{-22} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-23} OK?(linear_resolve(a′, Read)(state(q′(s′))))

{-24} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

2327

we get 3 subgoals:

linear_unchanged_invariant.1.1.1.1.1.1:

{-1} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-2} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-3} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-5} pm′`states(state(q′(s′)))

{-6} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(linear_resolve(a′, Read)(state(q′(s′))))))

=

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-7} pm′`states(s′)

{-8} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

= data(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))

{-9} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-10} is_linear_plain_memory?(pm′)
{-11} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-12} OK?(linear_resolve(a′, Read)(s′))

{-13} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-14} transformer_invariant?(pm′`states, transformers′)
{-15} transformers′(q′)
{-16} pm′`states = pm_phy`states
{-17} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-18} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute)))) (a)

∧

OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1))

{-19} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-20} OK?(q′(s′))
{-21} in_memory(min_linear, max_linear)(a′)
{-22} Mem?(type_of(a′))

{-23} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-24} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

=

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

2329 C Proof scripts

Replacing using formula -8, Replacing using formula -13, Instantiating the top quantifier in -18 with the terms: (s!1), Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-4 2), Expanding the definition of extend, Expanding the definition of virt_to_phys_range, Using lemma linear_resolve_memory_address, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.1.1.1.1.

linear_unchanged_invariant.1.1.1.1.1.2:

{-1} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-2} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-3} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-5} pm′`states(state(q′(s′)))
{-6} pm′`states(s′)
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} is_linear_plain_memory?(pm′)
{-9} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-10} OK?(linear_resolve(a′, Read)(s′))

{-11} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-12} transformer_invariant?(pm′`states, transformers′)
{-13} transformers′(q′)
{-14} pm′`states = pm_phy`states
{-15} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute)))) (a)

∧

OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1))

{-17} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-18} OK?(q′(s′))
{-19} in_memory(min_linear, max_linear)(a′)
{-20} Mem?(type_of(a′))

{-21} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-22} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

{2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

=

data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

2331 C Proof scripts

Hiding formulas: (-4 -16 2), Expanding the definition of difference, Expanding the definition of member, Expanding the definition of extend, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -3 -4 -5 -7), Expanding the definition of disjoint?, Expanding the definition of empty?, Expanding the definition of intersection, Expanding the definition of member, Instantiating the top quantifier in -1 with the terms: (data(linear_resolve(a!1, Read)(s!1))), Case splitting on restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr,

pm!1‘rw_addr)) = union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr), restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)),

we get 2 subgoals:

linear_unchanged_invariant.1.1.1.1.1.2.1:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)) {-2} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-3} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-4} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))
{-5} pm′`states(state(q′(s′)))
{-6} Mem?(data(linear_resolve(a′, Read)(s′))`type_of)
{-7} 0 ≤ data(linear_resolve(a′, Read)(s′))`offset
{-8} data(linear_resolve(a′, Read)(s′))`offset < max_linear_offset

{-9} address_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (data(linear_resolve(a′, Read)(s′)))

{-10} pm′`states(s′)
{-11} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-12} is_linear_plain_memory?(pm′)
{-13} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-14} OK?(linear_resolve(a′, Read)(s′))

{-15} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-16} transformer_invariant?(pm′`states, transformers′)
{-17} transformers′(q′)
{-18} pm′`states = pm_phy`states
{-19} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} addresses′(a′)
{-23} OK?(q′(s′))
{-24} in_memory(min_linear, max_linear)(a′)
{-25} Mem?(type_of(a′))

{-26} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-27} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} virt_to_phys_range(s′,

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (data(linear_resolve(a′, Read)(s′)))

∧

address_in_pt_range?(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (data(linear_resolve(a′, Read)(s′)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of virt_to_phys_range,

Expanding the definition of virt_to_phys_range,

Instantiating quantified variables,

we get 2 subgoals:

linear_unchanged_invariant.1.1.1.1.1.2.1.1:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)) {-2} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-3} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-4} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))
{-5} pm′`states(state(q′(s′)))
{-6} Mem?(data(linear_resolve(a′, Read)(s′))`type_of)
{-7} 0 ≤ data(linear_resolve(a′, Read)(s′))`offset
{-8} data(linear_resolve(a′, Read)(s′))`offset < max_linear_offset

{-9} address_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (data(linear_resolve(a′, Read)(s′)))

{-10} pm′`states(s′)
{-11} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-12} is_linear_plain_memory?(pm′)
{-13} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-14} OK?(linear_resolve(a′, Read)(s′))

{-15} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-16} transformer_invariant?(pm′`states, transformers′)
{-17} transformers′(q′)
{-18} pm′`states = pm_phy`states
{-19} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} addresses′(a′)
{-23} OK?(q′(s′))
{-24} in_memory(min_linear, max_linear)(a′)
{-25} Mem?(type_of(a′))

{-26} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-27} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} fullset[Memory_access](Read)

Expanding the definition of fullset,

which is trivially true.

This completes the proof of linear_unchanged_invariant.1.1.1.1.1.2.1.1.

linear_unchanged_invariant.1.1.1.1.1.2.1.2:

{-1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)) {-2} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-3} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-4} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))
{-5} pm′`states(state(q′(s′)))
{-6} Mem?(data(linear_resolve(a′, Read)(s′))`type_of)
{-7} 0 ≤ data(linear_resolve(a′, Read)(s′))`offset
{-8} data(linear_resolve(a′, Read)(s′))`offset < max_linear_offset

{-9} address_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (data(linear_resolve(a′, Read)(s′)))

{-10} pm′`states(s′)
{-11} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-12} is_linear_plain_memory?(pm′)
{-13} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-14} OK?(linear_resolve(a′, Read)(s′))

{-15} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-16} transformer_invariant?(pm′`states, transformers′)
{-17} transformers′(q′)
{-18} pm′`states = pm_phy`states
{-19} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-20} 0 ≤ a′`offset
{-21} a′`offset < max_linear_offset
{-22} addresses′(a′)
{-23} OK?(q′(s′))
{-24} in_memory(min_linear, max_linear)(a′)
{-25} Mem?(type_of(a′))

{-26} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-27} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} union[Memory_Address_4G]

(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr), restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

(a′)

Keeping (-11 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.1.1.1.2.1.2.

linear_unchanged_invariant.1.1.1.1.1.2.2:

{-1} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-2} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-3} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))
{-4} pm′`states(state(q′(s′)))
{-5} Mem?(data(linear_resolve(a′, Read)(s′))`type_of)
{-6} 0 ≤ data(linear_resolve(a′, Read)(s′))`offset
{-7} data(linear_resolve(a′, Read)(s′))`offset < max_linear_offset

{-8} address_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (data(linear_resolve(a′, Read)(s′)))

{-9} pm′`states(s′)
{-10} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-11} is_linear_plain_memory?(pm′)
{-12} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-13} OK?(linear_resolve(a′, Read)(s′))

{-14} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-15} transformer_invariant?(pm′`states, transformers′)
{-16} transformers′(q′)
{-17} pm′`states = pm_phy`states
{-18} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-19} 0 ≤ a′`offset
{-20} a′`offset < max_linear_offset
{-21} addresses′(a′)
{-22} OK?(q′(s′))
{-23} in_memory(min_linear, max_linear)(a′)
{-24} Mem?(type_of(a′))

{-25} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-26} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) =

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)) {2} virt_to_phys_range(s′,

(restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (data(linear_resolve(a′, Read)(s′)))

∧

address_in_pt_range?(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))) (data(linear_resolve(a′, Read)(s′)))

Keeping (1) and hiding *,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.1.1.1.2.2.

linear_unchanged_invariant.1.1.1.1.1.3:

{-1} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-2} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-3} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-5} pm′`states(state(q′(s′)))
{-6} pm′`states(s′)
{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} is_linear_plain_memory?(pm′)
{-9} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-10} OK?(linear_resolve(a′, Read)(s′))

{-11} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-12} transformer_invariant?(pm′`states, transformers′)
{-13} transformers′(q′)
{-14} pm′`states = pm_phy`states
{-15} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-16} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute)))) (a)

∧

OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1))

{-17} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-18} OK?(q′(s′))
{-19} in_memory(min_linear, max_linear)(a′)
{-20} Mem?(type_of(a′))

{-21} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-22} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} expr_2_super(linear_resolve(a′, Read)) =

expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)) {2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

=

data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

C Proof scripts

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.1.1.1.3.

linear_unchanged_invariant.1.1.1.1.2:

{-1} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-2} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(state(q′(s′))) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(state(q′(s′)))) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

∧

OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-4} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(s′) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(s′)) ∧

OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′)) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

= data(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))

{-5} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-6} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(state(q′(s′))) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Read)(state(q′(s′)))) ∧ OK?(linear_resolve(a′, Read)(s′))

⊃ data(linear_resolve(a′, Read)(state(q′(s′)))) = data(linear_resolve(a′, Read)(s′))

{-7} transformer_invariant?(pm′`states, transformers′) ∧ pm′`states(s′) ∧ transformers′(q′) ∧ has_next_state(q′(s′)) ⊃ pm′`states(state(q′(s′)))

{-8} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-9} transformer_invariant?(pm′`states, transformers′)
{-10} is_linear_plain_memory?(pm′)
{-11} pm′`states = pm_phy`states
{-12} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute))))

(a) ∧ OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) =

data(memory_read(pm_phy`mem)(a)(s_1))

{-14} pm′`states(s′)
{-15} transformers′(q′)
{-16} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-17} OK?(q′(s′))
{-18} in_memory(min_linear, max_linear)(a′)
{-19} Mem?(type_of(a′))
{-20} OK?(linear_resolve(a′, Read)(s′))

{-21} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-22} OK?(linear_resolve(a′, Read)(state(q′(s′))))

{-23} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{2} data(memory_read(pm_phy`mem) (data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

2339

Hiding formulas: (-3 -4 -5 -13 2),

Using lemma plain_memory_transformers_ok_read_ro_rw,

Using lemma expr_transformers_ok_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_unchanged_invariant.1.1.1.1.2.1:

{-1} transformers_ok?(pm_phy`states,

memory_read_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-2} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-3} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))
{-4} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-5} is_linear_plain_memory?(pm′)
{-6} pm′`states(state(q′(s′)))
{-7} pm′`states(s′)
{-8} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-9} OK?(linear_resolve(a′, Read)(s′))

{-10} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-11} transformer_invariant?(pm′`states, transformers′)
{-12} transformers′(q′)
{-13} pm′`states = pm_phy`states
{-14} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-15} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-16} OK?(q′(s′))
{-17} in_memory(min_linear, max_linear)(a′)
{-18} Mem?(type_of(a′))

{-19} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-20} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} memory_read_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

(expr_2_super(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))))

{2} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

Using lemma memory_read_transformers_memory_read,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.1.1.2.1.

linear_unchanged_invariant.1.1.1.1.2.2:

{-1} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{-2} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))
{-3} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(state(q′(s′)))
{-6} pm′`states(s′)
{-7} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-8} OK?(linear_resolve(a′, Read)(s′))

{-9} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-10} transformer_invariant?(pm′`states, transformers′)
{-11} transformers′(q′)
{-12} pm′`states = pm_phy`states
{-13} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-14} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-15} OK?(q′(s′))
{-16} in_memory(min_linear, max_linear)(a′)
{-17} Mem?(type_of(a′))

{-18} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-19} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} transformers_ok?(pm_phy`states,

memory_read_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{2} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{3} plain_memory?(pm_phy)

Using lemma pm_plain_phy,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_unchanged_invariant.1.1.1.1.2.2.

linear_unchanged_invariant.1.1.1.1.3:

{-1} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(state(q′(s′))) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(state(q′(s′)))) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

∧

OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-3} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(s′) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(s′)) ∧

OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′)) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

= data(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))

{-4} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-5} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(state(q′(s′))) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Read)(state(q′(s′)))) ∧ OK?(linear_resolve(a′, Read)(s′))

⊃ data(linear_resolve(a′, Read)(state(q′(s′)))) = data(linear_resolve(a′, Read)(s′))

{-6} transformer_invariant?(pm′`states, transformers′) ∧ pm′`states(s′) ∧ transformers′(q′) ∧ has_next_state(q′(s′)) ⊃ pm′`states(state(q′(s′)))

{-7} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-8} transformer_invariant?(pm′`states, transformers′)
{-9} is_linear_plain_memory?(pm′)
{-10} pm′`states = pm_phy`states
{-11} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute))))

(a) ∧ OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) =

data(memory_read(pm_phy`mem)(a)(s_1))

{-13} pm′`states(s′)
{-14} transformers′(q′)
{-15} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-16} OK?(q′(s′))
{-17} in_memory(min_linear, max_linear)(a′)
{-18} Mem?(type_of(a′))
{-19} OK?(linear_resolve(a′, Read)(s′))

{-20} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-21} OK?(linear_resolve(a′, Read)(state(q′(s′))))

{-22} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))

{2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

2342

Hiding formulas: (-2 -3 -4 -12 2),

Using lemma plain_memory_transformers_ok_read_ro_rw,

Using lemma expr_transformers_ok_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

linear_unchanged_invariant.1.1.1.1.3.1:

{-1} transformers_ok?(pm_phy`states,

memory_read_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-2} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))
{-3} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-4} is_linear_plain_memory?(pm′)
{-5} pm′`states(state(q′(s′)))
{-6} pm′`states(s′)
{-7} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-8} OK?(linear_resolve(a′, Read)(s′))

{-9} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-10} transformer_invariant?(pm′`states, transformers′)
{-11} transformers′(q′)
{-12} pm′`states = pm_phy`states
{-13} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-14} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-15} OK?(q′(s′))
{-16} in_memory(min_linear, max_linear)(a′)
{-17} Mem?(type_of(a′))

{-18} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-19} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} memory_read_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr))

(expr_2_super(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))))

{2} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))

Using lemma memory_read_transformers_memory_read,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of linear_unchanged_invariant.1.1.1.1.3.1.

linear_unchanged_invariant.1.1.1.1.3.2:

{-1} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))
{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(state(q′(s′)))
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-7} OK?(linear_resolve(a′, Read)(s′))

{-8} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-9} transformer_invariant?(pm′`states, transformers′)
{-10} transformers′(q′)
{-11} pm′`states = pm_phy`states
{-12} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-13} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-14} OK?(q′(s′))
{-15} in_memory(min_linear, max_linear)(a′)
{-16} Mem?(type_of(a′))

{-17} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-18} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} transformers_ok?(pm_phy`states,

memory_read_transformers(pm_phy`mem, (pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{2} OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))
{3} plain_memory?(pm_phy)

Using lemma pm_plain_phy,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.1.1.3.2.

linear_unchanged_invariant.1.1.1.2:

{-1} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(state(q′(s′))) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(state(q′(s′)))) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

∧

OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))(state(q′(s′))))

{-2} unchanged_memory_invariant?(pm_phy`mem, pm′`states,

singleton(expr_2_super[Physical_memory, Address]

(linear_resolve(a′, Read))),

((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

∧ pm′`states(s′) ∧ singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read)))

(expr_2_super(linear_resolve(a′, Read)))

∧

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(data(linear_resolve(a′, Read)(s′)))

∧

OK?(expr_2_super(linear_resolve(a′, Read))(s′)) ∧

OK?(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′)) ∧ OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

⊃ data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′)))

(state(expr_2_super(linear_resolve(a′, Read))(s′))))

= data(memory_read(pm_phy`mem)(data(linear_resolve(a′, Read)(s′)))(s′))

{-3} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(s′) ⊃ unchanged_memory_invariant?[Physical_memory]

(pm_phy`mem, pm′`states, singleton(expr_2_super[Physical_memory, Address](linear_resolve(a′, Read))), ((pm_phy‘ro_addr∪ pm_phy‘rw_addr) \ extend [Address, Memory_Address_4G , bool, false](address_in_pt_range? (s′, restrict [Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr))))))

{-4} union(pm′`ro_addr, pm′`rw_addr)(a′) ∧ is_linear_plain_memory?(pm′) ∧ pm′`states(state(q′(s′))) ∧ pm′`states(s′) ∧ OK?(linear_resolve(a′, Read)(state(q′(s′)))) ∧ OK?(linear_resolve(a′, Read)(s′))

⊃ data(linear_resolve(a′, Read)(state(q′(s′)))) = data(linear_resolve(a′, Read)(s′))

{-5} transformer_invariant?(pm′`states, transformers′) ∧ pm′`states(s′) ∧ transformers′(q′) ∧ has_next_state(q′(s′)) ⊃ pm′`states(state(q′(s′)))

{-6} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-7} transformer_invariant?(pm′`states, transformers′)
{-8} is_linear_plain_memory?(pm′)
{-9} pm′`states = pm_phy`states
{-10} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-11} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute))))

(a) ∧ OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) =

data(memory_read(pm_phy`mem)(a)(s_1))

{-12} pm′`states(s′)
{-13} transformers′(q′)
{-14} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-15} OK?(q′(s′))
{-16} in_memory(min_linear, max_linear)(a′)
{-17} Mem?(type_of(a′))
{-18} OK?(linear_resolve(a′, Read)(s′))

{-19} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-20} OK?(linear_resolve(a′, Read)(state(q′(s′))))

{-21} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

{2} data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

= data(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

2345 C Proof scripts

Hiding formulas: (-1 -2 -3 -11 2), Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -4 -5 -6 -7), Expanding the definition of subset?, Instantiating the top quantifier in -1 with the terms: (data(linear_resolve(a!1, Read)(s!1))), we get 2 subgoals:

linear_unchanged_invariant.1.1.1.2.1:

{-1} (data(linear_resolve(a′, Read)(s′)) ∈ virt_to_phys_range (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict  [Address,  Memory_Address_4G ,  boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))))

⇒

(data(linear_resolve(a′, Read)(s′)) ∈ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(state(q′(s′)))
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-7} OK?(linear_resolve(a′, Read)(s′))

{-8} data(linear_resolve(a′, Read)(state(q′(s′)))) = data(linear_resolve(a′, Read)(s′))

{-9} transformer_invariant?(pm′`states, transformers′)
{-10} transformers′(q′)
{-11} pm′`states = pm_phy`states

{-12} ∀ (x: Memory_Address_4G): (x ∈ addresses′) ⇒ (x ∈ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-13} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-14} OK?(q′(s′))
{-15} in_memory(min_linear, max_linear)(a′)
{-16} Mem?(type_of(a′))

{-17} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-18} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

Expanding the definition of member, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

linear_unchanged_invariant.1.1.1.2.1.1:

{-1} restrict[Address, Memory_Address_4G, boolean]

((pm_phy‘ro_addr∪ pm_phy‘rw_addr))(data(linear_resolve(a′, Read)(s′)))

{-2} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states(state(q′(s′)))
{-5} pm′`states(s′)
{-6} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-7} OK?(linear_resolve(a′, Read)(s′))

{-8} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-9} transformer_invariant?(pm′`states, transformers′)
{-10} transformers′(q′)
{-11} pm′`states = pm_phy`states

{-12} ∀ (x: Memory_Address_4G):

addresses′(x) ⇒ restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(x)

{-13} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-14} OK?(q′(s′))
{-15} in_memory(min_linear, max_linear)(a′)
{-16} Mem?(type_of(a′))

{-17} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-18} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

Expanding the definition of restrict,

which is trivially true.

This completes the proof of linear_unchanged_invariant.1.1.1.2.1.1.

linear_unchanged_invariant.1.1.1.2.1.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(state(q′(s′)))
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-6} OK?(linear_resolve(a′, Read)(s′))

{-7} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-8} transformer_invariant?(pm′`states, transformers′)
{-9} transformers′(q′)
{-10} pm′`states = pm_phy`states

{-11} ∀ (x: Memory_Address_4G):

addresses′(x) ⇒ restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(x)

{-12} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-13} OK?(q′(s′))
{-14} in_memory(min_linear, max_linear)(a′)
{-15} Mem?(type_of(a′))

{-16} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-17} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} virt_to_phys_range(s′, (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(data(linear_resolve(a′, Read)(s′)))

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

Hiding formulas: 2,

Expanding the definition of virt_to_phys_range,

Instantiating quantified variables,

we get 2 subgoals:

linear_unchanged_invariant.1.1.1.2.1.2.1:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(state(q′(s′)))
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-6} OK?(linear_resolve(a′, Read)(s′))

{-7} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-8} transformer_invariant?(pm′`states, transformers′)
{-9} transformers′(q′)
{-10} pm′`states = pm_phy`states

{-11} ∀ (x: Memory_Address_4G):

addresses′(x) ⇒ restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(x)

{-12} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-13} OK?(q′(s′))
{-14} in_memory(min_linear, max_linear)(a′)
{-15} Mem?(type_of(a′))

{-16} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-17} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} union[Memory_access] (singleton[Memory_access](Read), singleton[Memory_access](Execute))(Read)

Keeping (1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.1.2.1.2.1.

linear_unchanged_invariant.1.1.1.2.1.2.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(state(q′(s′)))
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-6} OK?(linear_resolve(a′, Read)(s′))

{-7} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-8} transformer_invariant?(pm′`states, transformers′)
{-9} transformers′(q′)
{-10} pm′`states = pm_phy`states

{-11} ∀ (x: Memory_Address_4G):

addresses′(x) ⇒ restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))(x)

{-12} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-13} OK?(q′(s′))
{-14} in_memory(min_linear, max_linear)(a′)
{-15} Mem?(type_of(a′))

{-16} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-17} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} union[Memory_Address_4G]

(restrict[Address, Memory_Address_4G, boolean](pm′`ro_addr), restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr))

(a′)

Keeping (-1 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.1.2.1.2.2.

linear_unchanged_invariant.1.1.1.2.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states(state(q′(s′)))
{-4} pm′`states(s′)
{-5} OK?(linear_resolve(a′, Read)(state(q′(s′))))
{-6} OK?(linear_resolve(a′, Read)(s′))

{-7} data(linear_resolve(a′, Read)(state(q′(s′)))) =

data(linear_resolve(a′, Read)(s′))

{-8} transformer_invariant?(pm′`states, transformers′)
{-9} transformers′(q′)
{-10} pm′`states = pm_phy`states

{-11} ∀ (x: Memory_Address_4G):

(x ∈ addresses′) ⇒

(x ∈ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-12} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-13} OK?(q′(s′))
{-14} in_memory(min_linear, max_linear)(a′)
{-15} Mem?(type_of(a′))

{-16} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(s′))) (state(linear_resolve(a′, Read)(s′))))

{-17} OK?(memory_read(pm_phy`mem)

(data(linear_resolve(a′, Read)(state(q′(s′))))) (state(linear_resolve(a′, Read)(state(q′(s′))))))

{1} Mem?(data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Read)(s′))`type_of)

∧ 0 ≤ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Read)(s′))`offset ∧ data[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a′, Read)(s′))`offset < max_linear_offset

{2} union(pm_phy`ro_addr, pm_phy`rw_addr)(data(linear_resolve(a′, Read)(s′)))

Using lemma linear_resolve_memory_address,

Expanding the definition of every,

which is trivially true.

This completes the proof of linear_unchanged_invariant.1.1.1.2.2.

linear_unchanged_invariant.1.1.2:

{-1} union(pm′`ro_addr, pm′`rw_addr)(a′)
{-2} transformer_invariant?(pm′`states, transformers′)
{-3} is_linear_plain_memory?(pm′)
{-4} pm′`states = pm_phy`states
{-5} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-6} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute)))) (a)

∧

OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1))

{-7} pm′`states(s′)
{-8} transformers′(q′)
{-9} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-10} OK?(q′(s′))
{-11} in_memory(min_linear, max_linear)(a′)
{-12} OK?(memory_read(pm_phy`mem)(a′)(s′))
{-13} OK?(memory_read(pm_phy`mem)(a′)(state(q′(s′))))
{1} Mem?(type_of(a′))

{2} data(memory_read(pm_phy`mem)(a′)(state(q′(s′)))) = data(memory_read(pm_phy`mem)(a′)(s′))

Using lemma pm_memory_addr,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.1.2.

linear_unchanged_invariant.1.2:

{-1} transformer_invariant?(pm′`states, transformers′)
{-2} is_linear_plain_memory?(pm′)
{-3} pm′`states = pm_phy`states
{-4} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))

{-5} ∀ (s: (pm′`states)):

∀ (s_1: Physical_memory, q: [Physical_memory → SuperResult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′, (singleton(Read) ∪ singleton(Execute)))) (a)

∧

OK?(q(s_1)) ∧

OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1))

{-6} pm′`states(s′)
{-7} transformers′(q′)
{-8} extend[Address, Memory_Address_4G, bool, false](addresses′)(a′)
{-9} OK?(q′(s′))

{-10} OK?(if in_memory(min_linear, max_linear)(a′)

then if Mem?(type_of(a′))

then (linear_resolve(a′, Read) ## (λ (pa: Address): memory_read(pm_phy`mem)(pa))) (s′)

else memory_read(pm_phy`mem)(a′)(s′)

endif else fatal_result(s′) endif)

{-11} OK?(if in_memory(min_linear, max_linear)(a′)

then if Mem?(type_of(a′))

then (linear_resolve(a′, Read) ## (λ (pa: Address): memory_read(pm_phy`mem)(pa))) (state(q′(s′)))

else memory_read(pm_phy`mem)(a′)(state(q′(s′)))

endif else fatal_result(state(q′(s′))) endif)

{1} union(pm′`ro_addr, pm′`rw_addr)(a′)

{2} if in_memory(min_linear, max_linear)(a′)

then if Mem?(type_of(a′))

then data((linear_resolve(a′, Read) ## (λ (pa: Address): memory_read(pm_phy`mem)(pa))) (state(q′(s′)))) else data(memory_read(pm_phy`mem)(a′)(state(q′(s′)))) endif

else data(fatal_result(state(q′(s′))))

endif = if in_memory(min_linear, max_linear)(a′)

then if Mem?(type_of(a′))

then data((linear_resolve(a′, Read) ## (λ (pa: Address): memory_read(pm_phy`mem)(pa))) (s′)) else data(memory_read(pm_phy`mem)(a′)(s′)) endif else data(fatal_result(s′)) endif

2353

Keeping (-4 -8 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of linear_unchanged_invariant.1.2.
linear_unchanged_invariant.2:

{-1} is_linear_plain_memory?(pm′) ⊃ pm′`states = pm_phy`states
{-2} is_linear_plain_memory?(pm′)
{-3} (addresses′ ⊆ restrict[Address, Memory_Address_4G , boolean]((pm′‘ro_addr∪ pm′‘rw_addr)))
{-4} ∀ (s: (pm′`states)):

transformer_invariant?(pm_phy`states, transformers′) ∧ (∀ (s_1: Physical_memory, q: [Physical_memory → SuperRe-

sult[Physical_memory]],

a: Address): pm_phy`states(s_1) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false]

(virt_to_phys_range(s, addresses′,

(singleton(Read) ∪ singleton(Execute))))

(a) ∧ OK?(q(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(s_1)) ∧ OK?(memory_read(pm_phy`mem)(a)(state(q(s_1))))

⊃

data(memory_read(pm_phy`mem)(a)(state(q(s_1)))) = data(memory_read(pm_phy`mem)(a)(s_1)))

{1} transformer_invariant?(pm′`states, transformers′)

{2} transformer_invariant?(pm′`states, transformers′) ∧

(∀ (s: Linear_memory[Physical_memory, pm_phy],

q: [Linear_memory[Physical_memory, pm_phy] → SuperRe-

sult[Physical_memory]],

a: Address): pm′`states(s) ∧ transformers′(q) ∧ extend[Address, Memory_Address_4G, bool, false](addresses′)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′`mem)(a)(s)) ∧ OK?(memory_read(pm′`mem)(a)(state(q(s))))

⊃

data(memory_read(pm′`mem)(a)(state(q(s)))) = data(memory_read(pm′`mem)(a)(s)))

Hiding formulas: 2, Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of linear_unchanged_invariant.2.

Q.E.D.

C.117.85 Linear_Memory_Properties.pm_phy_read_after_resolve_ok_TCC1

Terse proof for pm_phy_read_after_resolve_ok_TCC1.
pm_phy_read_after_resolve_ok_TCC1:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], a_{2}: Mem-

ory_Address_4G, ac: Memory_access): plain_memory?(pm_phy) ∧ OK?(linear_resolve(a_{2}, ac)(s)) ⊃ OK?[Physical_memory, Address](linear_resolve[Physical_memory, pm_phy](a_{2}, ac)(s)) ∨ Exception?[Physical_memory, Address]

(linear_resolve[Physical_memory, pm_phy](a_{2}, ac)(s))

Repeatedly Skolemizing and flattening,

This completes the proof of pm_phy_read_after_resolve_ok_TCC1.

Q.E.D.

C.117.86 Linear_Memory_Properties.pm_phy_read_after_resolve_ok

Terse proof for pm_phy_read_after_resolve_ok.
pm_phy_read_after_resolve_ok:

{1} ∀ (s: Linear_memory[Physical_memory, pm_phy], a_{1}: Address, a_{2}: Mem-

ory_Address_4G,

ac: Memory_access): OK?(linear_resolve(a_{2}, ac)(s)) ∧ plain_memory?(pm_phy) ∧ pm_phy`states(state(linear_resolve(a_{2}, ac)(s))) ∧ union(pm_phy`ro_addr, pm_phy`rw_addr)(a_{1})

⊃ OK?(memory_read(pm_phy`mem)(a_{1})(state(linear_resolve(a_{2}, ac)(s))))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformers_ok_read_ro_rw, Using lemma expr_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_read_transformers, Instantiating quantified variables,

This completes the proof of pm_phy_read_after_resolve_ok.

Q.E.D.

C.117.87 Linear_Memory_Properties.pm_resolve_address

Terse proof for pm_resolve_address.

pm_resolve_address:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a: Memory_Address_4G): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ virt_to_phys_range(s,

restrict[Address, Memory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(a)

⊃

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))))

(a)

Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -3 -4 -6 -7 -9), Case splitting on union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)) = restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr)),

we get 2 subgoals:

pm_resolve_address.1:

{-1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))

{-2} (virt_to_phys_range (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))) ⊆ restrict [Address, Memory_Address_4G , boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-3} disjoint?(virt_to_phys_range(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))),

address_in_pt_range?(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(a′) {1} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(a′)

Replacing using formula -1, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, we get 2 subgoals:

pm_resolve_address.1.1:

{-1} pm_phy`ro_addr(a′)
{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < expt(2, bus_width)

{-5} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(a′)

{-6} address_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (a′)

{1} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (a′)

Keeping (-5 1) and hiding *, Expanding the definition of virt_to_phys_range, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_resolve_address.1.1.

pm_resolve_address.1.2:

{-1} pm_phy`rw_addr(a′)
{-2} Mem?(a′`type_of)
{-3} 0 ≤ a′`offset
{-4} a′`offset < expt(2, bus_width)

{-5} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(a′)

{-6} address_in_pt_range?(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (a′)

{1} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr))) (a′)

Keeping (-5 1) and hiding *, Expanding the definition of virt_to_phys_range, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pm_resolve_address.1.2.

pm_resolve_address.2:

{-1} (virt_to_phys_range (s′, (restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute))) ⊆ restrict  [Address,  Memory_Address_4G ,  boolean]((pm_phy‘ro_addr∪ pm_phy‘rw_addr)))

{-2} disjoint?(virt_to_phys_range(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))),

address_in_pt_range?(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset

{-6} virt_to_phys_range(s′,

restrict[Address, Memory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)), (singleton(Read) ∪ singleton(Execute)))

(a′)

{1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) {2} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(a′)

Keeping (1) and hiding *,

Applying decompose-equality,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_resolve_address.2.

Q.E.D.

C.117.88 Linear_Memory_Properties.pm_resolve_address_write

Terse proof for pm_resolve_address_write.

pm_resolve_address_write:

{1} ∀ (pm: Plain_Memory[Linear_memory], s: Linear_memory[Physical_memory, pm_phy],

a: Memory_Address_4G): is_linear_plain_memory?(pm) ∧ pm`states(s) ∧ virt_to_phys_range(s, restrict[Address, Memory_Address_4G, boolean](pm`rw_addr),

singleton(Write)) (a)

⊃

difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm‘ro_addr∪ pm‘rw_addr)))))

(a)

Repeatedly Skolemizing and flattening, Using lemma pm_linear_blessed, Expanding the definition of linear_blessed?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 -2 -3 -4 -5 -7 -9), Case splitting on union(restrict[Address, Memory_Address_4G, boolean](pm!1‘ro_addr),

restrict[Address, Memory_Address_4G, boolean](pm!1‘rw_addr)) = restrict[Address, Memory_Address_4G, boolean] (union(pm!1‘ro_addr, pm!1‘rw_addr)),

we get 2 subgoals:

pm_resolve_address_write.1:

{-1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr))

{-2} (virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr), singleton(Write)) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-3} disjoint?(virt_to_phys_range(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))),

address_in_pt_range?(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))))

{-4} Mem?(a′`type_of)
{-5} 0 ≤ a′`offset
{-6} a′`offset < max_linear_offset

{-7} virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (a′) {1} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(a′)

Replacing using formula -1, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting,

C Proof scripts

Keeping (-5 1) and hiding *, Expanding the definition of virt_to_phys_range, Expanding the definition of virt_to_phys_range, Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 2 subgoals:

pm_resolve_address_write.1.1:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(lin_a′)
{-5} singleton(Write)(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = a′

{1} OK?(linear_resolve(lin_a′, ac′)(s′)) ∧

data(linear_resolve(lin_a′, ac′)(s′)) = a′

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pm_resolve_address_write.1.1.
pm_resolve_address_write.1.2:

{-1} Mem?(lin_a′`type_of)
{-2} 0 ≤ lin_a′`offset
{-3} lin_a′`offset < max_linear_offset
{-4} restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr)(lin_a′)
{-5} singleton(Write)(ac′)
{-6} OK?(linear_resolve(lin_a′, ac′)(s′))
{-7} data(linear_resolve(lin_a′, ac′)(s′)) = a′
{1} pm′`ro_addr(lin_a′) ∨ pm′`rw_addr(lin_a′)

Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_resolve_address_write.1.2.

C.118 Proofs for List_Split (linear_memory.pvs)

pm_resolve_address_write.2:

{-1} (virt_to_phys_range (s′, restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr), singleton(Write)) ⊆ restrict [Address, Memory_Address_4G , boolean](pm_phy‘rw_addr))

{-2} disjoint?(virt_to_phys_range(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))),

address_in_pt_range?(s′,

(restrict [Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))))

{-3} Mem?(a′`type_of)
{-4} 0 ≤ a′`offset
{-5} a′`offset < max_linear_offset

{-6} virt_to_phys_range(s′, restrict[Address, Memory_Address_4G, boolean](pm′`rw_addr),

singleton(Write)) (a′)

{1} (restrict[Address, Memory_Address_4G , boolean](pm′‘ro_addr) ∪ restrict [Address, Memory_Address_4G , boolean](pm′‘rw_addr))

= restrict[Address, Memory_Address_4G, boolean]((pm′‘ro_addr∪ pm′‘rw_addr)) {2} difference((pm_phy‘ro_addr∪ pm_phy‘rw_addr),

extend[Address, Memory_Address_4G, bool, false]

(address_in_pt_range?(s′,

restrict[Address, Mem-

ory_Address_4G, boolean]

((pm′‘ro_addr∪ pm′‘rw_addr)))))

(a′)

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_resolve_address_write.2.

Q.E.D.

C.118 Proofs for List_Split (linear_memory.pvs)

C.118.1 List_Split.split_TCC1

Terse proof for split_TCC1.

split_TCC1:

{1} ∀ (size: nat, a: Address, bl: list[Byte], e2size: posnat): ¬ a + length(bl) ≤ floor(e2size)(a) + e2size ∧ ¬ null?(bl) ∧ e2size = expt(2, size) ⊃ (∀ (δ: {r: mod(e2size) | ∃ q: offset(a) = r + e2size × q}):

δ = rem(e2size)(offset(a)) ⊃ e2size − δ ≥ 0 ∧ e2size − δ ≤ length[Byte](bl))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_TCC1. Q.E.D.

C.118.2 List_Split.split_TCC2

Terse proof for split_TCC2.

split_TCC2:

{1} ∀ (size: nat, a: Address, bl: list[Byte], e2size: posnat): ¬ a + length(bl) ≤ floor(e2size)(a) + e2size ∧ ¬ null?(bl) ∧ e2size = expt(2, size) ⊃ (∀ (δ: {r: mod(e2size) | ∃ q: offset(a) = r + e2size × q}):

δ = rem(e2size)(offset(a)) ⊃ length[Byte](tail[Byte](bl, e2size − δ)) < length[Byte](bl))

Repeatedly Skolemizing and flattening, Replacing using formula -8, Rewriting using length_tail, matching in *, we get 2 subgoals:

split_TCC2.1:

{-1} integer_pred(q′)
{-2} rem(e2size′)(offset(a′)) < e2size′
{-3} offset(a′) = rem(e2size′)(offset(a′)) + e2size′ × q′
{-4} size′ ≥ 0

{-5} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-6} e2size′ > 0
{-7} e2size′ = expt(2, size′)
{-8} delta′ = rem(e2size′)(offset(a′))
{1} a′ + length(bl′) ≤ floor(e2size′)(a′) + e2size′
{2} null?(bl′)
{3} rem(e2size′)(offset(a′)) + length(bl′) − e2size′ < length[Byte](bl′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_TCC2.1.

split_TCC2.2:

{-1} integer_pred(q′)
{-2} rem(e2size′)(offset(a′)) < e2size′
{-3} offset(a′) = rem(e2size′)(offset(a′)) + e2size′ × q′
{-4} size′ ≥ 0

{-5} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-6} e2size′ > 0
{-7} e2size′ = expt(2, size′)
{-8} delta′ = rem(e2size′)(offset(a′))
{1} e2size′ − rem(e2size′)(offset(a′)) ≤ length(bl′)
{2} a′ + length(bl′) ≤ floor(e2size′)(a′) + e2size′
{3} null?(bl′)

{4} length[Byte](tail[Byte](bl′, e2size′ − rem(e2size′)(offset(a′)))) < length[Byte](bl′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_TCC2.2. Q.E.D.

C.118.3 List_Split.split_pair_cross_size

Terse proof for split_pair_cross_size.
split_pair_cross_size:

{1} ∀ (size: nat, a_{1}: Address, bl1: list[Byte], n: nat):

let e2size = expt(2, size) in n = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(e2size)(offset(a_{2})) + length(bl2) ≤ e2size) (split(size, a_{1}, bl1))

Inducting on n on formula 1 using induction scheme NAT_induction, we get 2 subgoals:

split_pair_cross_size.1:

{-1} ∀ (size: nat, a_{1}: Address, bl1: list[Byte]): n′ = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)) {1} ∀ (size: nat, a_{1}: Address, bl1: list[Byte]): let e2size = expt(2, size) in

n′ = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(e2size)(offset(a_{2})) + length(bl2) ≤ e2size) (split(size, a_{1}, bl1))

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -3 with the terms: (size!1 a1!1 bl1!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of split_pair_cross_size.1.

split_pair_cross_size.2:

{1} ∀ j:
(∀ k:

k < j ⊃ (∀ (size: nat, a_{1}: Address, bl1: list[Byte]):

k = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1))))

⊃

(∀ (size: nat, a_{1}: Address, bl1: list[Byte]): j = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)))

Repeatedly Skolemizing and flattening, Expanding the definition of split, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

split_pair_cross_size.2.1:

{-1} size′ ≥ 0

{-2} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0
{-4} ∀ k:

k < j′ ⊃ (∀ (size: nat, a_{1}: Address, bl1: list[Byte]):

k = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)))

{-5} j′ = length(bl1′)
{-6} null?(bl1′)

{1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size′))(offset(a_{2})) + length(bl2) ≤ expt(2, size′)) (null)

Expanding the definition of every, which is trivially true.

This completes the proof of split_pair_cross_size.2.1.
split_pair_cross_size.2.2:

{-1} size′ ≥ 0

{-2} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0
{-4} ∀ k:

k < j′ ⊃ (∀ (size: nat, a_{1}: Address, bl1: list[Byte]):

k = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)))

{-5} j′ = length(bl1′)
{-6} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)
{1} null?(bl1′)

{2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size′))(offset(a_{2})) + length(bl2) ≤ expt(2, size′)) (cons((a′_{1}, bl1′), null))

Expanding the definition of every, Expanding the definition of every, Keeping (-6 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_pair_cross_size.2.2.
split_pair_cross_size.2.3:

{-1} size′ ≥ 0

{-2} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0

{-4} ∀ k:

k < j′ ⊃ (∀ (size: nat, a_{1}: Address, bl1: list[Byte]):

k = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)))

{-5} j′ = length(bl1′)
{1} null?(bl1′)
{2} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

{3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size′))(offset(a_{2})) + length(bl2) ≤ expt(2, size′)) (cons((a′_{1},

head(bl1′,

expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))),

split(size′, floor(expt(2, size′))(a′_{1}) + expt(2, size′),

tail(bl1′, expt(2, size′) − rem(expt(2, size′))(offset(a′_{1}))))))

Expanding the definition of every, Applying propositional simplification, we get 2 subgoals:

split_pair_cross_size.2.3.1:

{-1} size′ ≥ 0

{-2} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0

{-4} ∀ k:

k < j′ ⊃ (∀ (size: nat, a_{1}: Address, bl1: list[Byte]):

k = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)))

{-5} j′ = length(bl1′)

{1} rem(expt(2, size′))(offset(a′_{1})) + length(head(bl1′, expt(2, size′) − rem(expt(2, size′))(offset(a′_{1}))))

≤ expt(2, size′)

{2} null?(bl1′)
{3} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

Rewriting using length_head, matching in *, we get 2 subgoals:

split_pair_cross_size.2.3.1.1:

{-1} size′ ≥ 0

{-2} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0
{-4} ∀ k:

k < j′ ⊃ (∀ (size: nat, a_{1}: Address, bl1: list[Byte]):

k = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)))

{-5} j′ = length(bl1′)

{1} rem(expt(2, size′))(offset(a′_{1})) + expt(2, size′) − rem(expt(2, size′))(offset(a′_{1}))

≤ expt(2, size′)

{2} null?(bl1′)
{3} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_pair_cross_size.2.3.1.1.
split_pair_cross_size.2.3.1.2:

{-1} size′ ≥ 0

{-2} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0
{-4} ∀ k:

k < j′ ⊃ (∀ (size: nat, a_{1}: Address, bl1: list[Byte]):

k = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)))

{-5} j′ = length(bl1′)
{1} expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})) ≤ length(bl1′)

{2} rem(expt(2, size′))(offset(a′_{1})) + length(head(bl1′, expt(2, size′) − rem(expt(2, size′))(offset(a′_{1}))))

≤ expt(2, size′)

{3} null?(bl1′)
{4} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

Expanding the definition of floor, Expanding the definition of floor, Expanding the definition of <=, Expanding the definition of +, which is trivially true.

This completes the proof of split_pair_cross_size.2.3.1.2.

split_pair_cross_size.2.3.2:

{-1} size′ ≥ 0

{-2} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0

{-4} ∀ k:

k < j′ ⊃

(∀ (size: nat, a_{1}: Address, bl1: list[Byte]): k = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1)))

{-5} j′ = length(bl1′)

{1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size′))(offset(a_{2})) + length(bl2) ≤ expt(2, size′)) (split(size′, floor(expt(2, size′))(a′_{1}) + expt(2, size′),

tail(bl1′,

expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))))

{2} null?(bl1′)
{3} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

Instantiating the top quantifier in -4 with the terms: (length(tail(bl1!1, expt(2, size!1) - rem(expt(2, size!1))(offset(a1!1))))),

Splitting conjunctions, we get 2 subgoals:

split_pair_cross_size.2.3.2.1:

{-1} ∀ (size: nat, a_{1}: Address, bl1: list[Byte]): length(tail(bl1′, expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))) = length(bl1) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size))(offset(a_{2})) + length(bl2) ≤ expt(2, size)) (split(size, a_{1}, bl1))

{-2} size′ ≥ 0

{-3} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-4} j′ ≥ 0
{-5} j′ = length(bl1′)

{1} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size′))(offset(a_{2})) + length(bl2) ≤ expt(2, size′)) (split(size′, floor(expt(2, size′))(a′_{1}) + expt(2, size′),

tail(bl1′,

expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))))

{2} null?(bl1′)
{3} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

Instantiating the top quantifier in -1 with the terms: (size!1 floor(expt(2, size!1))(a1!1) + expt(2, size!1) tail(bl1!1, expt(2, size!1) - rem(expt(2, size!1))(offset(a1!1)))),

which is trivially true.

This completes the proof of split_pair_cross_size.2.3.2.1.
split_pair_cross_size.2.3.2.2:

{-1} size′ ≥ 0

{-2} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0
{-4} j′ = length(bl1′)

{1} length(tail(bl1′, expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))) <

j′ {2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size′))(offset(a_{2})) + length(bl2) ≤ expt(2, size′)) (split(size′, floor(expt(2, size′))(a′_{1}) + expt(2, size′),

tail(bl1′,

expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))))

{3} null?(bl1′)
{4} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

Rewriting using length_tail, matching in *,

we get 2 subgoals:

split_pair_cross_size.2.3.2.2.1:

{-1} size′ ≥ 0

{-2} every(λ (x: number): number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0
{-4} j′ = length(bl1′)
{1} rem(expt(2, size′))(offset(a′_{1})) + length(bl1′) − expt(2, size′) < j′

{2} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size′))(offset(a_{2})) + length(bl2) ≤ expt(2, size′)) (split(size′, floor(expt(2, size′))(a′_{1}) + expt(2, size′),

tail(bl1′,

expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))))

{3} null?(bl1′)
{4} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_pair_cross_size.2.3.2.2.1.

split_pair_cross_size.2.3.2.2.2:

{-1} size′ ≥ 0

{-2} every(λ (x: number):

number_field_pred(x) ∧

real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl1′)

{-3} j′ ≥ 0
{-4} j′ = length(bl1′)
{1} expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})) ≤ length(bl1′)

{2} length(tail(bl1′, expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))) <

j′ {3} every(λ (a_{2}: Address, bl2: list[Byte]):

rem(expt(2, size′))(offset(a_{2})) + length(bl2) ≤ expt(2, size′)) (split(size′, floor(expt(2, size′))(a′_{1}) + expt(2, size′),

tail(bl1′,

expt(2, size′) − rem(expt(2, size′))(offset(a′_{1})))))

{4} null?(bl1′)
{5} a′_{1} + length(bl1′) ≤ floor(expt(2, size′))(a′_{1}) + expt(2, size′)

Hiding formulas: -2, 3,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_pair_cross_size.2.3.2.2.2.

Q.E.D.

C.118.4 List_Split.split_pair_concat

Terse proof for split_pair_concat.
split_pair_concat:

{1} ∀ (size: nat, a: Address, bl: list[Byte], n: nat):

let e2size = expt(2, size) in n = length(bl) ⊃ reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(split(size, a, bl)) = bl

Inducting on n on formula 1 using induction scheme NAT_induction,

we get 2 subgoals:

split_pair_concat.1:

{-1} ∀ (size: nat, a: Address, bl: list[Byte]): n′ = length(bl) ⊃ reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(split(size, a, bl)) = bl

{1} ∀ (size: nat, a: Address, bl: list[Byte]): let e2size = expt(2, size) in

n′ = length(bl) ⊃ reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): let head = e`2 in append(head, tail))

(split(size, a, bl)) = bl

Repeatedly Skolemizing and flattening,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -2,

Instantiating quantified variables,

This completes the proof of split_pair_concat.1.

split_pair_concat.2:

{1} ∀ j:
(∀ k:

k < j ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]):

append(e`2, tail)) (split(size, a, bl))

= bl))

⊃

(∀ (size: nat, a: Address, bl: list[Byte]): j = length(bl) ⊃ reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (split(size, a, bl))

= bl)

Repeatedly Skolemizing and flattening,

Expanding the definition of split,

Expanding the definition of reduce,

Hiding formulas: -2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

split_pair_concat.2.1:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (split(size, a, bl))

= bl)

{-4} j′ = length(bl′)
{-5} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)
{1} null?(bl′)

{2} append(bl′,

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (null))

= bl′

Expanding the definition of reduce,

Rewriting using append_null, matching in *,

This completes the proof of split_pair_concat.2.1.

split_pair_concat.2.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (split(size, a, bl))

= bl)

{-4} j′ = length(bl′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{3} append(head(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′))),

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′,

expt(2, size′) − rem(expt(2, size′))(offset(a′))))))

= bl′

Instantiating the top quantifier in -3 with the terms: (length(tail(bl!1, expt(2, size!1) - rem(expt(2, size!1))(offset(a!1))))),

Splitting conjunctions,

we get 2 subgoals:

split_pair_concat.2.2.1:

{-1} ∀ (size: nat, a: Address, bl: list[Byte]): length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) = length(bl) ⊃ reduce(null, λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail))

(split(size, a, bl))

= bl {-2} size′ ≥ 0

{-3} j′ ≥ 0
{-4} j′ = length(bl′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{3} append(head(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′))),

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′,

expt(2, size′) − rem(expt(2, size′))(offset(a′))))))

= bl′

Instantiating the top quantifier in -1 with the terms: (size!1 floor(expt(2, size!1))(a!1) + expt(2, size!1) tail(bl!1, expt(2, size!1) - rem(expt(2, size!1))(offset(a!1)))),

Replacing using formula -1,

Rewriting using head_tail, matching in *,

Expanding the definition of floor,

Expanding the definition of floor,

Expanding the definition of +,

Expanding the definition of <=,

which is trivially true.

This completes the proof of split_pair_concat.2.2.1.

split_pair_concat.2.2.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} j′ = length(bl′)
{1} length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) < j′
{2} null?(bl′)
{3} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{4} append(head(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′))),

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′,

expt(2, size′) − rem(expt(2, size′))(offset(a′))))))

= bl′

Rewriting using length_tail, matching in *,

we get 2 subgoals:

split_pair_concat.2.2.2.1:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} j′ = length(bl′)

{1} rem(expt(2, size′))(offset(a′)) + length[Byte](bl′) − expt(2, size′) <

j′

{2} null?(bl′)
{3} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{4} append(head(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′))),

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′,

expt(2, size′) − rem(expt(2, size′))(offset(a′))))))

= bl′

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_pair_concat.2.2.2.1.
split_pair_concat.2.2.2.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} j′ = length(bl′)
{1} expt(2, size′) − rem(expt(2, size′))(offset(a′)) ≤ length[Byte](bl′)
{2} length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) < j′
{3} null?(bl′)
{4} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{5} append(head(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′))),

reduce(null,

λ (e: [Address, list[Byte]], tail: list[Byte]): append(e`2, tail)) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′,

expt(2, size′) − rem(expt(2, size′))(offset(a′))))))

= bl′

Hiding formulas: 2, 5, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_pair_concat.2.2.2.2.

Q.E.D.

C.118.5 List_Split.split_range

Terse proof for split_range.

split_range:

{1} ∀ (size: nat, a: Address, bl: list[Byte], n: nat):

let e2size = expt(2, size) in n = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + n) (split(size, a, bl))

Inducting on n on formula 1 using induction scheme NAT_induction, we get 2 subgoals:

split_range.1:

{-1} ∀ (size: nat, a: Address, bl: list[Byte]): n′ = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + n′) (split(size, a, bl)) {1} ∀ (size: nat, a: Address, bl: list[Byte]): let e2size = expt(2, size) in

n′ = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + n′) (split(size, a, bl))

Repeatedly Skolemizing and flattening,

Simplifying, rewriting, and recording with decision procedures,

Instantiating the top quantifier in -3 with the terms: (size!1 a!1 bl!1),

which is trivially true.

This completes the proof of split_range.1.

split_range.2:

{1} ∀ j:
(∀ k:

k < j ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl))))

⊃

(∀ (size: nat, a: Address, bl: list[Byte]): j = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + j) (split(size, a, bl)))

Repeatedly Skolemizing and flattening,

Hiding formulas: -2,

Expanding the definition of every,

Expanding the definition of split,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 6 subgoals:

split_range.2.1:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl)))

{-4} j′ = length(bl′)
{-5} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)
{1} null?(bl′)

{2} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + j′) (null)

Expanding the definition of every, which is trivially true. This completes the proof of split_range.2.1.

split_range.2.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl)))

{-4} j′ = length(bl′)
{-5} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ a′ + j′

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_range.2.2.

split_range.2.3:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl)))

{-4} j′ = length(bl′)
{-5} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)
{1} null?(bl′)
{2} a′ ≤ a′

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_range.2.3.

split_range.2.4:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} ∀ k:

k < j′ ⊃

(∀ (size: nat, a: Address, bl: list[Byte]): k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl)))

{-4} j′ = length(bl′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + j′) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

Instantiating the top quantifier in -3 with the terms: (length(tail(bl!1, expt(2, size!1) - rem(expt(2, size!1))(offset(a!1))))),

Splitting conjunctions, we get 2 subgoals:

split_range.2.4.1:

{-1} ∀ (size: nat, a: Address, bl: list[Byte]): length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

(split(size, a, bl))

{-2} size′ ≥ 0
{-3} j′ ≥ 0
{-4} j′ = length(bl′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + j′) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

Instantiating the top quantifier in -1 with the terms: (size!1 floor(expt(2, size!1))(a!1) + expt(2, size!1) tail(bl!1, expt(2, size!1) - rem(expt(2, size!1))(offset(a!1)))),

Using lemma every_implied, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: (-1 4), Repeatedly Skolemizing and flattening, Rewriting using length_tail, matching in *, we get 2 subgoals:

C.118 Proofs for List_Split (linear_memory.pvs)

split_range.2.4.1.1:

{-1} floor(expt(2, size′))(a′) + expt(2, size′) ≤ t′`1

{-2} t′‘1 + length(t′‘2) ≤

floor(expt(2, size′))(a′) + expt(2, size′) + rem(expt(2, size′))(offset(a′)) + length [Byte](bl′) − expt(2, size′)

{-3} size′ ≥ 0
{-4} j′ ≥ 0
{-5} j′ = length(bl′)
{1} a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + j′
{2} null?(bl′)
{3} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_range.2.4.1.1.

split_range.2.4.1.2:

{-1} floor(expt(2, size′))(a′) + expt(2, size′) ≤ t′`1

{-2} t′‘1 + length(t′‘2) ≤

floor(expt(2, size′))(a′) + expt(2, size′) + length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′))))

{-3} size′ ≥ 0
{-4} j′ ≥ 0
{-5} j′ = length(bl′)
{1} expt(2, size′) − rem(expt(2, size′))(offset(a′)) ≤ length[Byte](bl′)
{2} a′ ≤ t′`1 ∧ t′‘1 + length(t′‘2) ≤ a′ + j′
{3} null?(bl′)
{4} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_range.2.4.1.2.

split_range.2.4.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} j′ = length(bl′)
{1} length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) < j′
{2} null?(bl′)
{3} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + j′) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

Rewriting using length_tail, matching in *, we get 2 subgoals:

split_range.2.4.2.1:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} j′ = length(bl′)

{1} rem(expt(2, size′))(offset(a′)) + length[Byte](bl′) − expt(2, size′) <

j′

{2} null?(bl′)
{3} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{4} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + j′) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of split_range.2.4.2.1.

split_range.2.4.2.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} j′ = length(bl′)
{1} expt(2, size′) − rem(expt(2, size′))(offset(a′)) ≤ length[Byte](bl′)
{2} length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) < j′
{3} null?(bl′)
{4} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{5} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + j′) (split(size′, floor(expt(2, size′))(a′) + expt(2, size′),

tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of split_range.2.4.2.2.

split_range.2.5:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl)))

{-4} j′ = length(bl′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{3} a′ + length(head(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) ≤ a′ + j′

Rewriting using length_head, matching in *,

we get 2 subgoals:

split_range.2.5.1:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl)))

{-4} j′ = length(bl′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)
{3} a′ + expt(2, size′) − rem(expt(2, size′))(offset(a′)) ≤ a′ + j′

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_range.2.5.1.

split_range.2.5.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl)))

{-4} j′ = length(bl′)
{1} expt(2, size′) − rem(expt(2, size′))(offset(a′)) ≤ length[Byte](bl′)
{2} null?(bl′)
{3} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{4} a′ + length(head(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) ≤ a′ + j′

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_range.2.5.2.

split_range.2.6:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]):

k = length(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]):

a ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a + k) (split(size, a, bl)))

{-4} j′ = length(bl′)
{1} null?(bl′)
{2} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)
{3} a′ ≤ a′

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_range.2.6. Q.E.D.

C.118.6 List_Split.split_no_null

Terse proof for split_no_null.

split_no_null:

{1} ∀ (size: nat, a: Address, bl: list[Byte], n: nat):

let e2size = expt(2, size) in n = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(size, a, bl))

Inducting on n on formula 1 using induction scheme NAT_induction, we get 2 subgoals:

split_no_null.1:

{-1} ∀ (size: nat, a: Address, bl: list[Byte]): n′ = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(size, a, bl))

{1} ∀ (size: nat, a: Address, bl: list[Byte]): let e2size = expt(2, size) in n′ = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(size, a, bl))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_no_null.1.

split_no_null.2:

{1} ∀ j:
(∀ k:

k < j ⊃ (∀ (size: nat, a: Address, bl: list[Byte]): k = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))

(split(size, a, bl))))

⊃

(∀ (size: nat, a: Address, bl: list[Byte]): j = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(size, a, bl)))

Repeatedly Skolemizing and flattening, Hiding formulas: -2, Expanding the definition of every, Expanding the definition of split, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

split_no_null.2.1:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃

(∀ (size: nat, a: Address, bl: list[Byte]): k = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(size, a, bl)))

{-4} j′ = length(bl′)
{-5} cons?(bl′)
{-6} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)
{1} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(null)

Expanding the definition of every, which is trivially true. This completes the proof of split_no_null.2.1.

split_no_null.2.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0

{-3} ∀ k:

k < j′ ⊃

(∀ (size: nat, a: Address, bl: list[Byte]): k = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(size, a, bl)))

{-4} j′ = length(bl′)
{-5} cons?(bl′)
{1} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))

(split(size′, floor(expt(2, size′))(a′) + expt(2, size′), tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

Instantiating the top quantifier in -3 with the terms: (length(tail(bl!1, expt(2, size!1) - rem(expt(2, size!1))(offset(a!1))))),

Splitting conjunctions, we get 2 subgoals:

split_no_null.2.2.1:

{-1} ∀ (size: nat, a: Address, bl: list[Byte]):

length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(size, a, bl))

{-2} size′ ≥ 0
{-3} j′ ≥ 0
{-4} j′ = length(bl′)
{-5} cons?(bl′)
{1} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))

(split(size′, floor(expt(2, size′))(a′) + expt(2, size′), tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

Instantiating the top quantifier in -1 with the terms: (size!1 floor(expt(2, size!1))(a!1) + expt(2, size!1) tail(bl!1, expt(2, size!1) - rem(expt(2, size!1))(offset(a!1)))), Simplifying, rewriting, and recording with decision procedures, Using lemma length_tail, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_no_null.2.2.1.

split_no_null.2.2.2:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} j′ = length(bl′)
{-4} cons?(bl′)
{1} length(tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))) < j′
{2} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)

{3} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))

(split(size′, floor(expt(2, size′))(a′) + expt(2, size′), tail(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′)))))

Hiding formulas: 3, Using lemma length_tail, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_no_null.2.2.2.

split_no_null.2.3:

{-1} size′ ≥ 0
{-2} j′ ≥ 0
{-3} ∀ k:

k < j′ ⊃ (∀ (size: nat, a: Address, bl: list[Byte]): k = length(bl) ∧ cons?(bl) ⊃ every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(size, a, bl)))

{-4} j′ = length(bl′)
{-5} cons?(bl′)
{1} a′ + length(bl′) ≤ floor(expt(2, size′))(a′) + expt(2, size′)
{2} cons?(head(bl′, expt(2, size′) − rem(expt(2, size′))(offset(a′))))

Expanding the definition of head, which is trivially true. This completes the proof of split_no_null.2.3. Q.E.D.

C.118.7 List_Split.split_null

Terse proof for split_null.

split_null:

{1} ∀ (size: nat, a: Address): split(size, a, null) = null

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_null. Q.E.D.

C.118.8 List_Split.split_type_TCC1

Terse proof for split_type_TCC1.

split_type_TCC1:

{1} Mem?(min_linear`type_of)

Expanding the definition of min_linear, Expanding the definition of Mem, which is trivially true. This completes the proof of split_type_TCC1. Q.E.D.

C.118.9 List_Split.split_type_TCC2

Terse proof for split_type_TCC2.
split_type_TCC2:

{1} ∀ (a: Address): reg_base(min_linear)(type_of(a)) ≤ a ⊃ Mem?(max_linear`type_of)

Expanding the definition of max_linear, Expanding the definition of Mem, which is trivially true. This completes the proof of split_type_TCC2. Q.E.D.

C.118.10 List_Split.split_type

Terse proof for split_type.

split_type:

{1} ∀ (size: nat, a: Address, bl: list[Byte], n: nat): reg_base(min_linear)(type_of(a)) ≤ a ∧ a + length(bl) ≤ reg_size(max_linear)(type_of(a)) ⊃ every(λ (t: [Address, list[Byte]]):

type_of(t`1) = type_of(a) ∧ reg_base(min_linear)(type_of(a)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a)))

(split(min_page, a, bl))

Repeatedly Skolemizing and flattening, Hiding formulas: -2, Case splitting on bl!1 = null, we get 2 subgoals:

split_type.1:

{-1} bl′ = null
{-2} size′ ≥ 0
{-3} n′ ≥ 0
{-4} reg_base(min_linear)(type_of(a′)) ≤ a′
{-5} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{1} every(λ (t: [Address, list[Byte]]): type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

Using lemma split_null, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_type.1.

split_type.2:

{-1} size′ ≥ 0
{-2} n′ ≥ 0
{-3} reg_base(min_linear)(type_of(a′)) ≤ a′
{-4} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))
{1} bl′ = null

{2} every(λ (t: [Address, list[Byte]]): type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

Using lemma split_range, Using lemma split_no_null, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma every_implied, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

split_type.2.1:

{-1} cons?(bl′)
{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} size′ ≥ 0
{-5} n′ ≥ 0
{-6} reg_base(min_linear)(type_of(a′)) ≤ a′
{-7} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{1} every(λ (a_{2}: Address, bl2: list[Byte]):

cons?(bl2) ∧ a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{2} every(λ (t: [Address, list[Byte]]): type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

C.119 Proofs for LogicalExpressions (expressions.pvs)

Using lemma every_conjunct_left, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of split_type.2.1.

split_type.2.2:

{-1} cons?(bl′)
{-2} every(λ (a_{2}: Address, bl2: list[Byte]): cons?(bl2))(split(min_page, a′, bl′))

{-3} every(λ (a_{2}: Address, bl2: list[Byte]):

a′ ≤ a_{2} ∧ a_{2} + length(bl2) ≤ a′ + length(bl′)) (split(min_page, a′, bl′))

{-4} size′ ≥ 0
{-5} n′ ≥ 0
{-6} reg_base(min_linear)(type_of(a′)) ≤ a′
{-7} a′ + length(bl′) ≤ reg_size(max_linear)(type_of(a′))

{1} ∀ (t_1: [Address, list[Byte]]): cons?(t_1`2) ∧ a′ ≤ t_1`1 ∧ t_1‘1 + length(t_1‘2) ≤ a′ + length(bl′) ⊃ type_of(t_1`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t_1`1 ∧ t_1`1 < reg_size(max_linear)(type_of(a′))

{2} every(λ (t: [Address, list[Byte]]): type_of(t`1) = type_of(a′) ∧ reg_base(min_linear)(type_of(a′)) ≤ t`1 ∧ t`1 < reg_size(max_linear)(type_of(a′)))

(split(min_page, a′, bl′))

Hiding formulas: (-2 -3 2), Repeatedly Skolemizing and flattening, Expanding the definition of <=, Expanding the definition of <, Expanding the definition of +, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of length, Keeping (-5 -12 1) and hiding *, Adding type constraints for length(cdr(t!1‘2)), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of split_type.2.2. Q.E.D.

C.119 Proofs for LogicalExpressions (expressions.pvs)

This theory contains no provable formal statements.

C.120 Proofs for LvalueToRvalueConversion (conversions.pvs)

This theory contains no provable formal statements.

C.121 Proofs for Memory (memory.pvs)

C.121.1 Memory.memory_write_list_nse_TCC1

Terse proof for memory_write_list_nse_TCC1.
memory_write_list_nse_TCC1:

{1} ∀ (bl: list[Byte], b: Byte, rl: list[Byte]): bl = cons(b, rl) ⊃ cons?[Byte](bl)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of memory_write_list_nse_TCC1.

Q.E.D.

C.121.2 Memory.memory_write_list_nse_TCC2

Terse proof for memory_write_list_nse_TCC2.
memory_write_list_nse_TCC2:

{1} ∀ (bl: list[Byte], b: Byte, rl: list[Byte]):

bl = cons(b, rl) ⊃ length[Byte](cdr[Byte](bl)) < length[Byte](bl)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of memory_write_list_nse_TCC2.

Q.E.D.

C.121.3 Memory.memory_read_list_nse_TCC1

Terse proof for memory_read_list_nse_TCC1.
memory_read_list_nse_TCC1:

{1} ∀ (size: nat): size > 0 ⊃ size − 1 ≥ 0

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of memory_read_list_nse_TCC1.

Q.E.D.

C.121.4 Memory.memory_read_list_nse_TCC2

Terse proof for memory_read_list_nse_TCC2.
memory_read_list_nse_TCC2:

{1} ∀ (size: nat): size > 0 ⊃ size − 1 < size

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of memory_read_list_nse_TCC2.

Q.E.D.

C.121.5 Memory.memory_read_list_ok_length

Terse proof for memory_read_list_ok_length.

C.121 Proofs for Memory (memory.pvs)

memory_read_list_ok_length:

{1} ∀ (addr: Address, pm: Memory_struct, s: State, size: nat): OK?(memory_read_list_nse(pm)(addr, size)(s)) ⊃ length(data(memory_read_list_nse(pm)(addr, size)(s))) = size

Inducting on size on formula 1, we get 2 subgoals:

memory_read_list_ok_length.1:

{1} ∀ (addr: Address, pm: Memory_struct, s: State):

OK?(memory_read_list_nse(pm)(addr, 0)(s)) ⊃ length(data(memory_read_list_nse(pm)(addr, 0)(s))) = 0

Repeatedly Skolemizing and flattening, Expanding the definition of memory_read_list_nse, Expanding the definition of ok_result, Expanding the definition of length, which is trivially true.

This completes the proof of memory_read_list_ok_length.1.
memory_read_list_ok_length.2:

{1} ∀ j:

(∀ (addr: Address, pm: Memory_struct, s: State): OK?(memory_read_list_nse(pm)(addr, j)(s)) ⊃ length(data(memory_read_list_nse(pm)(addr, j)(s))) = j)

⊃

(∀ (addr: Address, pm: Memory_struct, s: State): OK?(memory_read_list_nse(pm)(addr, j + 1)(s)) ⊃ length(data(memory_read_list_nse(pm)(addr, j + 1)(s))) = j + 1)

Repeatedly Skolemizing and flattening, Expanding the definition of memory_read_list_nse, Expanding the definition of ##, Expanding the definition of ok_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of length, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_ok_length.2.

Q.E.D.

C.121.6 Memory.memory_read_transformers_memory_read

Terse proof for memory_read_transformers_memory_read.
memory_read_transformers_memory_read:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct, addr: Address): addresses(addr) ⊃ memory_read_transformers(pm, addresses)(expr_2_super(memory_read(pm)(addr)))

Repeatedly Skolemizing and flattening, Expanding the definition of memory_read_transformers, Instantiating quantified variables,

This completes the proof of memory_read_transformers_memory_read.

Q.E.D.

C.121.7 Memory.memory_read_transformers_mono

Terse proof for memory_read_transformers_mono.
memory_read_transformers_mono:

{1} ∀ (pm: Memory_struct, addresses_1, addresses_2: PRED[Address]): (addresses_1⊆ addresses_2) ⊃ (memory_read_transformers (pm, addresses_1) ⊆ memory_read_transformers (pm, addresses_2))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of memory_read_transformers_mono.

Q.E.D.

C.121.8 Memory.memory_read_transformers_union

Terse proof for memory_read_transformers_union.
memory_read_transformers_union:

{1} ∀ (pm: Memory_struct, addresses_1, addresses_2: PRED[Address]): (memory_read_transformers (pm, addresses_1) ∪ memory_read_transformers (pm, addresses_2)) = memory_read_transformers(pm, (addresses_1∪ addresses_2))

Repeatedly Skolemizing and flattening, Expanding the definition of memory_read_transformers, Expanding the definition of union, Expanding the definition of member, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of memory_read_transformers_union.

Q.E.D.

C.121.9 Memory.memory_write_transformers_memory_write

Terse proof for memory_write_transformers_memory_write.
memory_write_transformers_memory_write:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct, addr: Address, b: Byte): addresses(addr) ⊃ memory_write_transformers(pm, addresses)(expr_2_super(memory_write(pm)(addr, b)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of memory_write_transformers_memory_write.

Q.E.D.

C.121.10 Memory.memory_write_transformers_mono

Terse proof for memory_write_transformers_mono.
memory_write_transformers_mono:

{1} ∀ (pm: Memory_struct, addresses_1, addresses_2: PRED[Address]): (addresses_1⊆ addresses_2) ⊃ (memory_write_transformers (pm, addresses_1) ⊆ memory_write_transformers (pm, addresses_2))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of memory_write_transformers_mono.

Q.E.D.

C.121.11 Memory.memory_read_side_effect_super_transformers_memory_read_side_effect

Terse proof for memory_read_side_effect_super_transformers_memory_read_side_effect.
memory_read_side_effect_super_transformers_memory_read_side_effect:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct, a: Ad-

dress, bl: list[Byte], cp: bool): (address_block(a, length(bl)) ⊆ addresses) ⊃ memory_read_side_effect_super_transformers(pm, addresses)

(expr_2_super(memory_read_side_effect(pm) (a, bl, cp)))

Repeatedly Skolemizing and flattening, Expanding the definition of memory_read_side_effect_super_transformers, Instantiating quantified variables,

This completes the proof of memory_read_side_effect_super_transformers_memory_read_side_effect.

Q.E.D.

C.121.12 Memory.memory_read_side_effect_super_transformers_mono

Terse proof for memory_read_side_effect_super_transformers_mono.
memory_read_side_effect_super_transformers_mono:

{1} ∀ (pm: Memory_struct, addresses_1, addresses_2: PRED[Address]): (addresses_1⊆ addresses_2) ⊃ (memory_read_side_effect_super_transformers (pm, addresses_1) ⊆ memory_read_side_effect_super_transformers (pm, addresses_2))

Repeatedly Skolemizing and flattening, Expanding the definition of subset?, Expanding the definition of member, Expanding the definition of memory_read_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Forward chaining on subset_transitive,

This completes the proof of memory_read_side_effect_super_transformers_mono.

Q.E.D.

C.121.13 Memory.memory_write_side_effect_super_transformers_memory_write_side_effect

Terse proof for memory_write_side_effect_super_transformers_memory_write_side_effect.
memory_write_side_effect_super_transformers_memory_write_side_effect:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct, a: Ad-

dress, bl: list[Byte], cp: bool): (address_block(a, length(bl)) ⊆ addresses) ⊃ memory_write_side_effect_super_transformers(pm, addresses)

(expr_2_super(memory_write_side_effect(pm) (a, bl, cp)))

Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_side_effect_super_transformers, Instantiating quantified variables,

This completes the proof of memory_write_side_effect_super_transformers_memory_write_side_effect.

Q.E.D.

C.121.14 Memory.memory_write_side_effect_super_transformers_mono

Terse proof for memory_write_side_effect_super_transformers_mono.
memory_write_side_effect_super_transformers_mono:

{1} ∀ (pm: Memory_struct, addresses_1, addresses_2: PRED[Address]): (addresses_1⊆ addresses_2) ⊃ (memory_write_side_effect_super_transformers (pm, addresses_1) ⊆ memory_write_side_effect_super_transformers (pm, addresses_2))

Repeatedly Skolemizing and flattening, Expanding the definition of subset?, Expanding the definition of member, Expanding the definition of memory_write_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Forward chaining on subset_transitive,

This completes the proof of memory_write_side_effect_super_transformers_mono.

Q.E.D.

C.121.15 Memory.side_effect_content_unchanged_content

Terse proof for side_effect_content_unchanged_content.

side_effect_content_unchanged_content:

{1} ∀ (se_transformer:

[[Address, list[Byte], bool] → [State → ExprResult[State, list[Byte]]]], states: PRED[State], addresses: PRED[Address], s: State, a: Ad-

dress, bl: list[Byte], cp: bool):

side_effect_content_unchanged(addresses, states, se_transformer) ∧ states(s) ∧ (address_block(a, length(bl)) ⊆ addresses) ∧ OK?(se_transformer(a, bl, cp)(s)) ⊃ data(se_transformer(a, bl, cp)(s)) = bl

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of side_effect_content_unchanged_content.

Q.E.D.

C.121.16 Memory.side_effect_content_unchanged_mono

Terse proof for side_effect_content_unchanged_mono.
side_effect_content_unchanged_mono:

{1} ∀ (se_transformer:

[[Address, list[Byte], bool] → [State → ExprResult[State, list[Byte]]]], states: PRED[State], addresses_1, addresses_2: PRED[Address]):

(addresses_1⊆ addresses_2) ∧

side_effect_content_unchanged(addresses_2, states, se_transformer) ⊃ side_effect_content_unchanged(addresses_1, states, se_transformer)

Expanding the definition of side_effect_content_unchanged,

Repeatedly Skolemizing and flattening,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-2 -5 1) and hiding *,

Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets addresses!1, c gets addresses!2,

This completes the proof of side_effect_content_unchanged_mono.

Q.E.D.

C.121.17 Memory.side_effect_content_unchanged_composition

Terse proof for side_effect_content_unchanged_composition.

side_effect_content_unchanged_composition:

{1} ∀ (addresses: PRED[Address], se_transformer1, se_transformer2:

[[Address, list[Byte], bool] → [State → ExprResult[State, list[Byte]]]], states: PRED[State]):

transformer_invariant?(states, se_super_transformers(addresses, se_transformer1)) ∧ side_effect_content_unchanged(addresses, states, se_transformer1) ∧ side_effect_content_unchanged(addresses, states, se_transformer2) ⊃ side_effect_content_unchanged(addresses, states,

λ (a: Address, bl: list[Byte], cp: bool): se_transformer1(a, bl, cp) ## (λ (bl1: list[Byte]): se_transformer2(a, bl1, cp)))

Expanding the definition of side_effect_content_unchanged, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -3 with the terms: (s!1 a!1 bl!1 cp!1), Expanding the definition of ##, Installing automatic rewrites from: has_next_state Using lemma expr_transformer_invariant_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

side_effect_content_unchanged_composition.1:

{-1} transformer_invariant?(states′, se_super_transformers(addresses′, se_transformer1′))
{-2} states′(s′)
{-3} states′(state(se_transformer1′(a′, bl′, cp′)(s′)))

{-4} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-5} (address_block(a′, length(bl′)) ⊆ addresses′)
{-6} data(se_transformer1′(a′, bl′, cp′)(s′)) = bl′

{-7} ∀ (s: State, a: Address, bl: list[Byte], cp: bool):

states′(s) ∧ (address_block(a, length(bl)) ⊆ addresses′) ∧ OK?(se_transformer2′(a, bl, cp)(s)) ⊃ data(se_transformer2′(a, bl, cp)(s)) = bl

{-8} OK?(se_transformer1′(a′, bl′, cp′)(s′))

{-9} OK?(se_transformer2′(a′, data(se_transformer1′(a′, bl′, cp′)(s′)), cp′)

(state(se_transformer1′(a′, bl′, cp′)(s′))))

{1} data(se_transformer2′(a′, data(se_transformer1′(a′, bl′, cp′)(s′)), cp′)

(state(se_transformer1′(a′, bl′, cp′)(s′))))

= bl′

Instantiating the top quantifier in -7 with the terms: (state(se_transformer1!1(a!1, bl!1, cp!1)(s!1)) a!1 bl!1 cp!1),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of side_effect_content_unchanged_composition.1.

C.122 Proofs for Memory_Change (memory.pvs)

side_effect_content_unchanged_composition.2:

{-1} transformer_invariant?(states′, se_super_transformers(addresses′, se_transformer1′))
{-2} states′(s′)

{-3} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-4} (address_block(a′, length(bl′)) ⊆ addresses′)
{-5} data(se_transformer1′(a′, bl′, cp′)(s′)) = bl′

{-6} ∀ (s: State, a: Address, bl: list[Byte], cp: bool):

states′(s) ∧ (address_block(a, length(bl)) ⊆ addresses′) ∧ OK?(se_transformer2′(a, bl, cp)(s)) ⊃ data(se_transformer2′(a, bl, cp)(s)) = bl

{-7} OK?(se_transformer1′(a′, bl′, cp′)(s′))

{-8} OK?(se_transformer2′(a′, data(se_transformer1′(a′, bl′, cp′)(s′)), cp′)

(state(se_transformer1′(a′, bl′, cp′)(s′))))

{1} se_super_transformers(addresses′, se_transformer1′)

(expr_2_super(se_transformer1′(a′, bl′, cp′)))

{2} data(se_transformer2′(a′, data(se_transformer1′(a′, bl′, cp′)(s′)), cp′)

(state(se_transformer1′(a′, bl′, cp′)(s′))))

= bl′

Expanding the definition of se_super_transformers, Instantiating quantified variables,

This completes the proof of side_effect_content_unchanged_composition.2.

Q.E.D.

C.122 Proofs for Memory_Change (memory.pvs)

C.122.1 Memory_Change.unchanged_memory_invariant?_TCC1

Terse proof for unchanged_memory_invariant?_TCC1.
unchanged_memory_invariant?_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State],

transformers: PRED[[State → SuperResult[State]]], addresses: PRED[Address]):

transformer_invariant?(states, transformers) ⊃ (∀ (s: State, q: [State → SuperResult[State]], a: Address):

OK?(memory_read(pm)(a)(s)) ∧ OK?(q(s)) ∧ addresses(a) ∧ transformers(q) ∧ states(s) ⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_invariant?_TCC1.

Q.E.D.

C.122.2 Memory_Change.unchanged_memory_invariant_unchanged_TCC1

Terse proof for unchanged_memory_invariant_unchanged_TCC1.
unchanged_memory_invariant_unchanged_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → SuperResult[State]], a: Address): OK?(memory_read(pm)(a)(s)) ∧ OK?(q(s)) ∧ addresses(a) ∧ transformers(q) ∧ states(s) ∧ unchanged_memory_invariant?(pm, states, transformers, addresses) ⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_TCC1.

Q.E.D.

C.122.3 Memory_Change.unchanged_memory_invariant_unchanged

Terse proof for unchanged_memory_invariant_unchanged.
unchanged_memory_invariant_unchanged:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → SuperResult[State]], a: Address):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(q) ∧ addresses(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm)(a)(s)) ∧ OK?(memory_read(pm)(a)(state(q(s))))

⊃ data(memory_read(pm)(a)(state(q(s)))) = data(memory_read(pm)(a)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of unchanged_memory_invariant?, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_unchanged.

Q.E.D.

C.122.4 Memory_Change.unchanged_memory_invariant_invariant

Terse proof for unchanged_memory_invariant_invariant.

unchanged_memory_invariant_invariant:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State],

transformers: PRED[[State → SuperResult[State]]]): unchanged_memory_invariant?(pm, states, transformers, addresses) ⊃ transformer_invariant?(states, transformers)

Repeatedly Skolemizing and flattening, Expanding the definition of unchanged_memory_invariant?, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_invariant.

Q.E.D.

C.122.5 Memory_Change.unchanged_memory_invariant_mono

Terse proof for unchanged_memory_invariant_mono.
unchanged_memory_invariant_mono:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], transformers_1, transformers_2: PRED[[State → SuperResult[State]]], addresses_1, addresses_2: PRED[Address]):

(transformers_1⊆ transformers_2) ∧ (addresses_1⊆ addresses_2) ∧ unchanged_memory_invariant?(pm, states, transformers_2, addresses_2) ⊃ unchanged_memory_invariant?(pm, states, transformers_1, addresses_1)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_invariant_mono.

Q.E.D.

C.122.6 Memory_Change.unchanged_memory_invariant_next_ok_TCC1

Terse proof for unchanged_memory_invariant_next_ok_TCC1.
unchanged_memory_invariant_next_ok_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(q) ∧ has_next_state(q(s)) ⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_invariant_next_ok_TCC1.

Q.E.D.

C.122.7 Memory_Change.unchanged_memory_invariant_next_ok

Terse proof for unchanged_memory_invariant_next_ok.

unchanged_memory_invariant_next_ok:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(q) ∧ has_next_state(q(s)) ⊃ states(state(q(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of unchanged_memory_invariant?, Applying disjunctive simplification to flatten sequent, Using lemma super_transformer_invariant_next_ok[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_next_ok.

Q.E.D.

C.122.8 Memory_Change.unchanged_memory_invariant_union_transformers

Terse proof for unchanged_memory_invariant_union_transformers.
unchanged_memory_invariant_union_transformers:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers_1, transformers_2: PRED[[State → SuperResult[State]]]): unchanged_memory_invariant?(pm, states, transformers_1, addresses) ∧ unchanged_memory_invariant?(pm, states, transformers_2, addresses) ⊃ unchanged_memory_invariant?(pm, states, (transformers_1∪ transformers_2), ad- dresses)

Installing automatic rewrites from: member Repeatedly Skolemizing and flattening, Expanding the definition of unchanged_memory_invariant?, Applying propositional simplification, we get 2 subgoals:

unchanged_memory_invariant_union_transformers.1:

{-1} transformer_invariant?(states′, transformers′)

{-2} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃ data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-3} transformer_invariant?(states′, transformers′′)

{-4} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃ data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, (transformers′ ∪ transformers′′))

Rewriting using transformer_invariant_union_transformers, matching in *,

This completes the proof of unchanged_memory_invariant_union_transformers.1.

unchanged_memory_invariant_union_transformers.2:

{-1} transformer_invariant?(states′, transformers′)

{-2} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃ data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-3} transformer_invariant?(states′, transformers′′)

{-4} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃ data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ union(transformers′, transformers′′)(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃ data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

Hiding formulas: (-1 -3),

Repeatedly Skolemizing and flattening,

Expanding the definition of union,

Splitting conjunctions,

we get 2 subgoals:

unchanged_memory_invariant_union_transformers.2.1:

{-1} (q′ ∈ transformers′)
{-2} states′(s′)
{-3} addresses′(a′)
{-4} OK?(q′(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state(q′(s′))))

{-7} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-8} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} data(memory_read(pm′)(a′)(state(q′(s′)))) = data(memory_read(pm′)(a′)(s′))

Instantiating quantified variables,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_union_transformers.2.1.

unchanged_memory_invariant_union_transformers.2.2:

{-1} (q′ ∈ transformers′′)
{-2} states′(s′)
{-3} addresses′(a′)
{-4} OK?(q′(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state(q′(s′))))

{-7} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-8} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} data(memory_read(pm′)(a′)(state(q′(s′)))) = data(memory_read(pm′)(a′)(s′))

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_union_transformers.2.2.

Q.E.D.

C.122.9 Memory_Change.unchanged_memory_invariant_union_addresses

Terse proof for unchanged_memory_invariant_union_addresses.
unchanged_memory_invariant_union_addresses:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], addresses_1, addresses_2: PRED[Address]):

unchanged_memory_invariant?(pm, states, transformers, addresses_1) ∧ unchanged_memory_invariant?(pm, states, transformers, addresses_2) ⊃ unchanged_memory_invariant?(pm, states, transform-

ers, (addresses_1∪ addresses_2))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_invariant_union_addresses.

Q.E.D.

C.122.10 Memory_Change.unchanged_memory_invariant_empty

Terse proof for unchanged_memory_invariant_empty.
unchanged_memory_invariant_empty:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State],

transformers: PRED[[State → SuperResult[State]]]): empty?(states) ∨ empty?(transformers) ⊃ unchanged_memory_invariant?(pm, states, transformers, addresses)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_invariant_empty.

Q.E.D.

C.122.11 Memory_Change.unchanged_memory_invariant_all_transformers

Terse proof for unchanged_memory_invariant_all_transformers.
unchanged_memory_invariant_all_transformers:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]]): (∀ (q: [State → SuperResult[State]]): transformers(q) ⊃ unchanged_memory_invariant?(pm, states, singleton(q), ad- dresses)) ⊃ unchanged_memory_invariant?(pm, states, transformers, addresses)

Expanding the definition of unchanged_memory_invariant?, Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

unchanged_memory_invariant_all_transformers.1:

{-1} ∀ (q: [State → SuperResult[State]]):

transformers′(q) ⊃ transformer_invariant?(states′, singleton(q)) ∧ (∀ (s: State, q_1: [State → SuperResult[State]], a: Address):

states′(s) ∧ singleton(q)(q_1) ∧ addresses′(a) ∧ OK?(q_1(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q_1(s))))

⊃

data(memory_read(pm′)(a)(state(q_1(s)))) = data(memory_read(pm′)(a)(s)))

{1} transformer_invariant?(states′, transformers′)

Rewriting using transformer_invariant_all_transformers, matching in *, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_all_transformers.1.

unchanged_memory_invariant_all_transformers.2:

{-1} ∀ (q: [State → SuperResult[State]]):

transformers′(q) ⊃ transformer_invariant?(states′, singleton(q)) ∧ (∀ (s: State, q_1: [State → SuperResult[State]], a: Address):

states′(s) ∧ singleton(q)(q_1) ∧ addresses′(a) ∧ OK?(q_1(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q_1(s))))

⊃

data(memory_read(pm′)(a)(state(q_1(s)))) = data(memory_read(pm′)(a)(s))) {1} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧

transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of singleton, which is trivially true.

This completes the proof of unchanged_memory_invariant_all_transformers.2.

Q.E.D.

C.123 Proofs for Memory_Change_2 (memory.pvs)

C.123.1 Memory_Change_2.unchanged_memory_write_invariant_mono_addresses

Terse proof for unchanged_memory_write_invariant_mono_addresses.
unchanged_memory_write_invariant_mono_addresses:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], addresses_1, addresses_2: PRED[Address]): (addresses_1⊆ addresses_2) ∧ unchanged_memory_write_invariant?(pm, states, ad- dresses_2) ⊃ unchanged_memory_write_invariant?(pm, states, addresses_1)

C.123 Proofs for Memory_Change_2 (memory.pvs)

Repeatedly Skolemizing and flattening, Expanding the definition of unchanged_memory_write_invariant?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Applying propositional simplification, we get 2 subgoals:

unchanged_memory_write_invariant_mono_addresses.1:

{-1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_write(pm′)(waddr′, b′))), (addresses′′ \ {waddr′}))

{-2} b′ < max_byte
{-3} (addresses′ ⊆ addresses′′)
{-4} addresses′(waddr′)

{1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_write(pm′)(waddr′, b′))), (addresses′ \ {waddr′}))

Using lemma unchanged_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_equal, matching in *, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_write_invariant_mono_addresses.1.
unchanged_memory_write_invariant_mono_addresses.2:

{-1} b′ < max_byte
{-2} (addresses′ ⊆ addresses′′)
{-3} addresses′(waddr′)
{1} addresses′′(waddr′)

{2} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_write(pm′)(waddr′, b′))), (addresses′ \ {waddr′}))

Installing automatic rewrites from: subset? singleton member Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement,

This completes the proof of unchanged_memory_write_invariant_mono_addresses.2.

Q.E.D.

C.123.2 Memory_Change_2.unchanged_memory_write_invariant_transformer_invariant

Terse proof for unchanged_memory_write_invariant_transformer_invariant.
unchanged_memory_write_invariant_transformer_invariant:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State]): unchanged_memory_write_invariant?(pm, states, addresses) ⊃ transformer_invariant?(states, memory_write_transformers(pm, addresses))

Repeatedly Skolemizing and flattening, Expanding the definition of unchanged_memory_write_invariant?, Expanding the definition of unchanged_memory_invariant?, Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -5, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Applying disjunctive simplification to flatten sequent, Expanding the definition of singleton, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_write_invariant_transformer_invariant.

Q.E.D.

C.123.3 Memory_Change_2.unchanged_memory_write_invariant_unchanged_memory_invariant

Terse proof for unchanged_memory_write_invariant_unchanged_memory_invariant.
unchanged_memory_write_invariant_unchanged_memory_invariant:

{1} ∀ (pm: Memory_struct[State], states: PRED[State],

all_addresses, unchanged_addresses, changed_addresses: PRED[Address]): unchanged_memory_write_invariant?(pm, states, all_addresses) ∧ (unchanged_addresses⊆ all_addresses) ∧ (changed_addresses⊆ all_addresses) ∧ disjoint?(unchanged_addresses, changed_addresses) ⊃ unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, changed_addresses),

unchanged_addresses)

Repeatedly Skolemizing and flattening, Expanding the definition of unchanged_memory_invariant?, Applying propositional simplification, we get 2 subgoals:

unchanged_memory_write_invariant_unchanged_memory_invariant.1:

{-1} unchanged_memory_write_invariant?(pm′, states′, all_addresses′)
{-2} (unchanged_addresses′ ⊆ all_addresses′)
{-3} (changed_addresses′ ⊆ all_addresses′)
{-4} disjoint?(unchanged_addresses′, changed_addresses′)
{1} transformer_invariant?(states′, memory_write_transformers(pm′, changed_addresses′))

Rewriting using unchanged_memory_write_invariant_transformer_invariant, matching in *, Hiding formulas: -2, Forward chaining on unchanged_memory_write_invariant_mono_addresses,

This completes the proof of unchanged_memory_write_invariant_unchanged_memory_invariant.1.

unchanged_memory_write_invariant_unchanged_memory_invariant.2:

{-1} unchanged_memory_write_invariant?(pm′, states′, all_addresses′)
{-2} (unchanged_addresses′ ⊆ all_addresses′)
{-3} (changed_addresses′ ⊆ all_addresses′)
{-4} disjoint?(unchanged_addresses′, changed_addresses′)

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ memory_write_transformers(pm′, changed_addresses′)(q) ∧ unchanged_addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

Expanding the definition of memory_write_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -4, Expanding the definition of unchanged_memory_write_invariant?, Expanding the definition of unchanged_memory_invariant?, Instantiating quantified variables, Applying propositional simplification, we get 2 subgoals:

unchanged_memory_write_invariant_unchanged_memory_invariant.2.1:

{-1} transformer_invariant?(states′, singleton(expr_2_super(memory_write(pm′)(a′′, b′))))

{-2} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ singleton(expr_2_super(memory_write(pm′)(a′′, b′)))(q) ∧ remove(a′′, all_addresses′)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-3} b′ < max_byte
{-4} states′(s′)
{-5} changed_addresses′(a′′)
{-6} q′ = expr_2_super(memory_write(pm′)(a′′, b′))
{-7} unchanged_addresses′(a′)
{-8} OK?(expr_2_super(memory_write(pm′)(a′′, b′))(s′))
{-9} OK?(memory_read(pm′)(a′)(s′))

{-10} OK?(memory_read(pm′)

(a′)(state(expr_2_super(memory_write(pm′)(a′′, b′))(s′))))

{-11} (unchanged_addresses′ ⊆ all_addresses′)
{-12} (changed_addresses′ ⊆ all_addresses′)
{-13} disjoint?(unchanged_addresses′, changed_addresses′)

{1} data(memory_read(pm′)

(a′)(state(expr_2_super(memory_write(pm′)(a′′, b′))(s′))))

= data(memory_read(pm′)(a′)(s′))

Rewriting using -2, matching in *, we get 2 subgoals:

unchanged_memory_write_invariant_unchanged_memory_invariant.2.1.1:

{-1} transformer_invariant?(states′, singleton(expr_2_super(memory_write(pm′)(a′′, b′))))

{-2} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ singleton(expr_2_super(memory_write(pm′)(a′′, b′)))(q) ∧ remove(a′′, all_addresses′)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-3} b′ < max_byte
{-4} states′(s′)
{-5} changed_addresses′(a′′)
{-6} q′ = expr_2_super(memory_write(pm′)(a′′, b′))
{-7} unchanged_addresses′(a′)
{-8} OK?(expr_2_super(memory_write(pm′)(a′′, b′))(s′))
{-9} OK?(memory_read(pm′)(a′)(s′))

{-10} OK?(memory_read(pm′)

(a′)(state(expr_2_super(memory_write(pm′)(a′′, b′))(s′))))

{-11} (unchanged_addresses′ ⊆ all_addresses′)
{-12} (changed_addresses′ ⊆ all_addresses′)
{-13} disjoint?(unchanged_addresses′, changed_addresses′)

{1} singleton(expr_2_super(memory_write(pm′)(a′′, b′)))

(expr_2_super(memory_write(pm′)(a′′, b′)))

{2} data(memory_read(pm′)

(a′)(state(expr_2_super(memory_write(pm′)(a′′, b′))(s′))))

= data(memory_read(pm′)(a′)(s′))

Expanding the definition of singleton,

which is trivially true.

This completes the proof of unchanged_memory_write_invariant_unchanged_memory_invariant.2.1.1.

unchanged_memory_write_invariant_unchanged_memory_invariant.2.1.2:

{-1} transformer_invariant?(states′, singleton(expr_2_super(memory_write(pm′)(a′′, b′))))

{-2} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ singleton(expr_2_super(memory_write(pm′)(a′′, b′)))(q) ∧ remove(a′′, all_addresses′)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-3} b′ < max_byte
{-4} states′(s′)
{-5} changed_addresses′(a′′)
{-6} q′ = expr_2_super(memory_write(pm′)(a′′, b′))
{-7} unchanged_addresses′(a′)
{-8} OK?(expr_2_super(memory_write(pm′)(a′′, b′))(s′))
{-9} OK?(memory_read(pm′)(a′)(s′))

{-10} OK?(memory_read(pm′)

(a′)(state(expr_2_super(memory_write(pm′)(a′′, b′))(s′))))

{-11} (unchanged_addresses′ ⊆ all_addresses′)
{-12} (changed_addresses′ ⊆ all_addresses′)
{-13} disjoint?(unchanged_addresses′, changed_addresses′)
{1} remove(a′′, all_addresses′)(a′)

{2} data(memory_read(pm′)

(a′)(state(expr_2_super(memory_write(pm′)(a′′, b′))(s′))))

= data(memory_read(pm′)(a′)(s′))

Keeping (-5 -7 -11 -12 -13 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_write_invariant_unchanged_memory_invariant.2.1.2.
unchanged_memory_write_invariant_unchanged_memory_invariant.2.2:

{-1} b′ < max_byte
{-2} states′(s′)
{-3} changed_addresses′(a′′)
{-4} q′ = expr_2_super(memory_write(pm′)(a′′, b′))
{-5} unchanged_addresses′(a′)
{-6} OK?(expr_2_super(memory_write(pm′)(a′′, b′))(s′))
{-7} OK?(memory_read(pm′)(a′)(s′))

{-8} OK?(memory_read(pm′)

(a′)(state(expr_2_super(memory_write(pm′)(a′′, b′))(s′))))

{-9} (unchanged_addresses′ ⊆ all_addresses′)
{-10} (changed_addresses′ ⊆ all_addresses′)
{-11} disjoint?(unchanged_addresses′, changed_addresses′)
{1} all_addresses′(a′′)

{2} data(memory_read(pm′)

(a′)(state(expr_2_super(memory_write(pm′)(a′′, b′))(s′))))

= data(memory_read(pm′)(a′)(s′))

Keeping (-3 -10 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_write_invariant_unchanged_memory_invariant.2.2.

Q.E.D.

C.123.4 Memory_Change_2.unchanged_memory_invariant_union

Terse proof for unchanged_memory_invariant_union.
unchanged_memory_invariant_union:

{1} ∀ (pm: Memory_struct[State], states: PRED[State],

ro_addr, rw_addr, mod_addr: PRED[Address]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, rw_addr), ro_addr) ∧ unchanged_memory_write_invariant?(pm, states, rw_addr) ∧ (mod_addr⊆ rw_addr) ⊃ unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, mod_addr),

((ro_addr∪ rw_addr) \ mod_addr))

Repeatedly Skolemizing and flattening, Case splitting on difference(union(ro_addr!1, rw_addr!1), mod_addr!1) = union(difference(ro_addr!1,

mod_addr!1), difference(rw_addr!1, mod_addr!1)), we get 2 subgoals:

unchanged_memory_invariant_union.1:

{-1} ((ro_addr′ ∪ rw_addr′) \ mod_addr′) =

((ro_addr′ \ mod_addr′) ∪ (rw_addr′ \ mod_addr′)) {-2} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, rw_addr′),

ro_addr′)

{-3} unchanged_memory_write_invariant?(pm′, states′, rw_addr′)
{-4} (mod_addr′ ⊆ rw_addr′)

{1} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, mod_addr′), ((ro_addr′ ∪ rw_addr′) \ mod_addr′))

Replacing using formula -1, Hiding formulas: -1, Rewriting using unchanged_memory_invariant_union_addresses, matching in *, we get 2 subgoals:

unchanged_memory_invariant_union.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, rw_addr′),

ro_addr′)

{-2} unchanged_memory_write_invariant?(pm′, states′, rw_addr′)
{-3} (mod_addr′ ⊆ rw_addr′)

{1} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, mod_addr′), (ro_addr′ \ mod_addr′)) {2} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, mod_addr′),

((ro_addr′ \ mod_addr′) ∪ (rw_addr′ \ mod_addr′)))

Hiding formulas: -2, 2, Using lemma unchanged_memory_invariant_mono, Installing automatic rewrites from: memory_write_transformers_mono Simplifying, rewriting, and recording with decision procedures, Keeping 1 and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_invariant_union.1.1.

unchanged_memory_invariant_union.1.2:

{-1} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, rw_addr′),

ro_addr′)

{-2} unchanged_memory_write_invariant?(pm′, states′, rw_addr′)
{-3} (mod_addr′ ⊆ rw_addr′)

{1} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, mod_addr′), (rw_addr′ \ mod_addr′)) {2} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, mod_addr′),

((ro_addr′ \ mod_addr′) ∪ (rw_addr′ \ mod_addr′)))

Hiding formulas: -1, 2, Using lemma unchanged_memory_write_invariant_unchanged_memory_invariant, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: difference_subset difference_disjoint_3 Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_union.1.2.
unchanged_memory_invariant_union.2:

{-1} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, rw_addr′),

ro_addr′)

{-2} unchanged_memory_write_invariant?(pm′, states′, rw_addr′)
{-3} (mod_addr′ ⊆ rw_addr′)

{1} ((ro_addr′ ∪ rw_addr′) \ mod_addr′) =

((ro_addr′ \ mod_addr′) ∪ (rw_addr′ \ mod_addr′)) {2} unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, mod_addr′),

((ro_addr′ ∪ rw_addr′) \ mod_addr′))

Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, if-lifting, and extensionality,

This completes the proof of unchanged_memory_invariant_union.2.

Q.E.D.

C.123.5 Memory_Change_2.transformer_invariant_write_list_nse

Terse proof for transformer_invariant_write_list_nse.
transformer_invariant_write_list_nse:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

transformer_invariant?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ states(s) ⊃ result_pred(states)(expr_2_super(memory_write_list_nse(pm)(waddr, bl))(s))

For the top quantifier in 1, we introduce Skolem constants: (pm′ ), Inducting on bl on formula 1, we get 2 subgoals:

transformer_invariant_write_list_nse.1:

{1} ∀ (states: PRED[State], waddr: Address, s: State): transformer_invariant?(states, memory_write_transformers(pm′, ad- dress_block(waddr, length(null)))) ∧ states(s) ⊃ result_pred(states)(expr_2_super(memory_write_list_nse(pm′)(waddr, null))(s))

Expanding the definition of memory_write_list_nse, Expanding the definition(s) of (ok_result expr_2_super expr_2_super_res result_pred has_next_state), Repeatedly Skolemizing and flattening,

This completes the proof of transformer_invariant_write_list_nse.1.
transformer_invariant_write_list_nse.2:

{1} ∀ (cons1_var: Byte, cons2_var: list[Byte]):

(∀ (states: PRED[State], waddr: Address, s: State):

transformer_invariant?(states,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var))))

∧ states(s)

⊃

result_pred(states)

(expr_2_super(memory_write_list_nse(pm′)(waddr, cons2_var))(s)))

⊃

(∀ (states: PRED[State], waddr: Address, s: State):

transformer_invariant?(states,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧ states(s)

⊃

result_pred(states)

(expr_2_super(memory_write_list_nse(pm′)

(waddr, cons(cons1_var, cons2_var)))

(s)))

Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_list_nse, Installing automatic rewrites from: length super_comp_expr_forget_expr! address_block Using lemma memory_write_transformers_memory_write[State], Simplifying, rewriting, and recording with decision procedures, Case splitting on OK?(expr_2_super(memory_write(pm!1)(waddr!1, cons1_var!1))(s!1)), we get 2 subgoals:

transformer_invariant_write_list_nse.2.1:

{-1} OK?(expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′))

{-2} memory_write_transformers(pm′, address_block(waddr′, 1 + length(cons2_var′)))

(expr_2_super(memory_write(pm′)(waddr′, cons1_var′)))

{-3} ∀ (states: PRED[State], waddr: Address, s: State):

transformer_invariant?(states,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states(s)

⊃

result_pred(states)

(expr_2_super(memory_write_list_nse(pm′)(waddr, cons2_var′))(s))

{-4} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-5} states′(s′)

{1} result_pred(states′)

(cases expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′) of

OK(state):

expr_2_super(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′))

(state)

else expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′)

endcases)

Simplifying, rewriting, and recording with decision procedures,

Rewriting using -3, matching in *,

we get 2 subgoals:

transformer_invariant_write_list_nse.2.1.1:

{-1} OK?(expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′))

{-2} memory_write_transformers(pm′, address_block(waddr′, 1 + length(cons2_var′)))

(expr_2_super(memory_write(pm′)(waddr′, cons1_var′)))

{-3} ∀ (states: PRED[State], waddr: Address, s: State):

transformer_invariant?(states,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states(s)

⊃

result_pred(states)

(expr_2_super(memory_write_list_nse(pm′)(waddr, cons2_var′))(s))

{-4} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-5} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′))

(state(expr_2_super(memory_write(pm′)(waddr′, cons1_var′)) (s′))))

Keeping (-4 1) and hiding *,

Installing automatic rewrites from: address_block_subset_1 memory_write_transformers_mono

Using lemma transformer_invariant_mono_transformers[State],

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of transformer_invariant_write_list_nse.2.1.1.

transformer_invariant_write_list_nse.2.1.2:

{-1} OK?(expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′))

{-2} memory_write_transformers(pm′, address_block(waddr′, 1 + length(cons2_var′)))

(expr_2_super(memory_write(pm′)(waddr′, cons1_var′)))

{-3} ∀ (states: PRED[State], waddr: Address, s: State):

transformer_invariant?(states,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states(s)

⊃

result_pred(states)

(expr_2_super(memory_write_list_nse(pm′)(waddr, cons2_var′))(s))

{-4} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-5} states′(s′)
{1} states′(state(expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′)))

{2} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′))

(state(expr_2_super(memory_write(pm′)(waddr′, cons1_var′)) (s′))))

Using lemma super_transformer_invariant_next_ok[State], Installing automatic rewrites from: has_next_state Simplifying, rewriting, and recording with decision procedures,

This completes the proof of transformer_invariant_write_list_nse.2.1.2.
transformer_invariant_write_list_nse.2.2:

{-1} memory_write_transformers(pm′, address_block(waddr′, 1 + length(cons2_var′)))

(expr_2_super(memory_write(pm′)(waddr′, cons1_var′)))

{-2} ∀ (states: PRED[State], waddr: Address, s: State):

transformer_invariant?(states,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states(s)

⊃

result_pred(states)

(expr_2_super(memory_write_list_nse(pm′)(waddr, cons2_var′))(s))

{-3} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} states′(s′)
{1} OK?(expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′))

{2} result_pred(states′)

(cases expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′) of

OK(state):

expr_2_super(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′))

(state)

else expr_2_super(memory_write(pm′)(waddr′, cons1_var′))(s′)

endcases)

Hiding formulas: -2, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of transformer_invariant?, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of transformer_invariant_write_list_nse.2.2.

Q.E.D.

C.123.6 Memory_Change_2.transformer_invariant_write_list

Terse proof for transformer_invariant_write_list.
transformer_invariant_write_list:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

transformer_invariant?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ {expr_2_super (memory_write_side_effect (pm)(waddr, bl, false))}))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s)

⊃ result_pred(states)(expr_2_super(memory_write_list(pm)(waddr, bl))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_list, Rewriting using super_comp_expr_expr, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

transformer_invariant_write_list.1:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-2} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ {expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false))}))

{-3} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-4} states′(s′)
{-5} OK?(expr_2_super(memory_write_side_effect(pm′)(waddr′, bl′, false))(s′))

{1} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)

(waddr′,

data(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))

(state(expr_2_super(memory_write_side_effect(pm′)

(waddr′, bl′, false)) (s′))))

Using lemma side_effect_content_unchanged_content[State], Installing automatic rewrites from: subset_equal ok_expr_2_super Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Rewriting using transformer_invariant_write_list_nse, matching in *, we get 2 subgoals:

transformer_invariant_write_list.1.1:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-2} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ {expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false))}))

{-3} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-4} states′(s′)
{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {2} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)(waddr′, bl′))

(state(expr_2_super(memory_write_side_effect(pm′)

(waddr′, bl′, false)) (s′))))

Keeping (-2 1) and hiding *, Rewriting using add_as_union, matching in *, Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures, Rewriting using union_subset1, matching in *,

This completes the proof of transformer_invariant_write_list.1.1.
transformer_invariant_write_list.1.2:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-2} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ {expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false))}))

{-3} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-4} states′(s′)
{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{1} states′(state(expr_2_super(memory_write_side_effect(pm′)(waddr′, bl′, false))(s′)))

{2} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)(waddr′, bl′))

(state(expr_2_super(memory_write_side_effect(pm′)

(waddr′, bl′, false)) (s′))))

Hiding formulas: -1, -3, 2, Using lemma super_transformer_invariant_next_ok[State], Installing automatic rewrites from: has_next_state add Simplifying, rewriting, and recording with decision procedures,

This completes the proof of transformer_invariant_write_list.1.2.
transformer_invariant_write_list.2:

{-1} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-2} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ {expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false))}))

{-3} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-4} states′(s′)
{1} OK?(expr_2_super(memory_write_side_effect(pm′)(waddr′, bl′, false))(s′))

{2} result_pred(states′)

(expr_2_super(memory_write_side_effect(pm′)(waddr′, bl′, false))(s′))

Hiding formulas: -1, -3, Expanding the definition of transformer_invariant?, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of add, which is trivially true.

This completes the proof of transformer_invariant_write_list.2.

Q.E.D.

C.123.7 Memory_Change_2.changed_memory_invariant?_TCC1

Terse proof for changed_memory_invariant?_TCC1.
changed_memory_invariant?_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], addresses: PRED[Address]): transformer_invariant?(states, memory_write_transformers(pm, addresses)) ∧ transformer_invariant?(states, memory_read_transformers(pm, addresses)) ⊃ (∀ (s: State, a: Address, b: Byte):

OK?(memory_write(pm)(a, b)(s)) ∧ addresses(a) ∧ states(s) ⊃ OK?[State, Unit](memory_write(pm)(a, b)(s)) ∨ Exception?[State, Unit](memory_write(pm)(a, b)(s)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of changed_memory_invariant?_TCC1.

Q.E.D.

C.123.8 Memory_Change_2.changed_memory_invariant_mono

Terse proof for changed_memory_invariant_mono.

changed_memory_invariant_mono:

{1} ∀ (pm: Memory_struct[State], states: PRED[State],

addresses_1, addresses_2: PRED[Address]): (addresses_1⊆ addresses_2) ∧ changed_memory_invariant?(pm, states, ad-

dresses_2) ⊃ changed_memory_invariant?(pm, states, addresses_1)

Repeatedly Skolemizing and flattening, Expanding the definition of changed_memory_invariant?, Applying disjunctive simplification to flatten sequent, Applying propositional simplification, we get 3 subgoals:

changed_memory_invariant_mono.1:

{-1} (addresses′ ⊆ addresses′′)
{-2} transformer_invariant?(states′, memory_read_transformers(pm′, addresses′′))
{-3} transformer_invariant?(states′, memory_write_transformers(pm′, addresses′′))

{-4} ∀ (s: State, a: Address, b: Byte):

states′(s) ∧ addresses′′(a) ∧ OK?(memory_write(pm′)(a, b)(s)) ∧ OK?(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) ⊃ data(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) = b

{1} transformer_invariant?(states′, memory_read_transformers(pm′, addresses′))

Hiding formulas: -3, -4, Installing automatic rewrites from: memory_read_transformers_mono Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of changed_memory_invariant_mono.1.
changed_memory_invariant_mono.2:

{-1} (addresses′ ⊆ addresses′′)
{-2} transformer_invariant?(states′, memory_read_transformers(pm′, addresses′′))
{-3} transformer_invariant?(states′, memory_write_transformers(pm′, addresses′′))

{-4} ∀ (s: State, a: Address, b: Byte):

states′(s) ∧ addresses′′(a) ∧ OK?(memory_write(pm′)(a, b)(s)) ∧ OK?(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) ⊃ data(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) = b

{1} transformer_invariant?(states′, memory_write_transformers(pm′, addresses′))

Hiding formulas: -2, -4, Installing automatic rewrites from: memory_write_transformers_mono Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of changed_memory_invariant_mono.2.

changed_memory_invariant_mono.3:

{-1} (addresses′ ⊆ addresses′′)
{-2} transformer_invariant?(states′, memory_read_transformers(pm′, addresses′′))
{-3} transformer_invariant?(states′, memory_write_transformers(pm′, addresses′′))

{-4} ∀ (s: State, a: Address, b: Byte):

states′(s) ∧ addresses′′(a) ∧ OK?(memory_write(pm′)(a, b)(s)) ∧ OK?(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) ⊃ data(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) = b

{1} ∀ (s: State, a: Address, b: Byte): states′(s) ∧ addresses′(a) ∧ OK?(memory_write(pm′)(a, b)(s)) ∧ OK?(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) ⊃ data(memory_read(pm′)(a)(state(memory_write(pm′)(a, b)(s)))) = b

Hiding formulas: -2, -3, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of changed_memory_invariant_mono.3.

Q.E.D.

C.123.9 Memory_Change_2.memory_read_list_nse_ok

Terse proof for memory_read_list_nse_ok.
memory_read_list_nse_ok:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress, size: nat, s: State):

transformer_invariant?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

transformers_ok?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

states(s)

⊃ OK?(memory_read_list_nse(pm)(raddr, size)(s))

For the top quantifier in 1, we introduce Skolem constants: (pm′ states′ ), Inducting on size on formula 1, we get 2 subgoals:

memory_read_list_nse_ok.1:

{1} ∀ (raddr: Address, s: State):

transformer_invariant?(states′, memory_read_transformers(pm′, address_block(raddr, 0)))

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, 0))) ∧

states′(s)

⊃ OK?(memory_read_list_nse(pm′)(raddr, 0)(s))

Expanding the definition of memory_read_list_nse, Expanding the definition of ok_result, which is trivially true.

This completes the proof of memory_read_list_nse_ok.1.
memory_read_list_nse_ok.2:

{1} ∀ j:

(∀ (raddr: Address, s: State):

transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, j))) ∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, j))) ∧ states′(s) ⊃ OK?(memory_read_list_nse(pm′)(raddr, j)(s)))

⊃

(∀ (raddr: Address, s: State):

transformer_invariant?(states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr, j + 1))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, j + 1))) ∧ states′(s) ⊃ OK?(memory_read_list_nse(pm′)(raddr, j + 1)(s)))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: memory_read_transformers_memory_read address_block

Expanding the definition of memory_read_list_nse,

Using lemma expr_transformers_ok_ok[State, Byte],

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of ##,

Instantiating quantified variables,

Applying propositional simplification,

we get 4 subgoals:

memory_read_list_nse_ok.2.1:

{-1} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-2} OK?(memory_read(pm′)(raddr′)(s′))
{-3} j′ ≥ 0

{-4} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, 1 + j′))) {-5} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-6} states′(s′)

{1} OK?(cases memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))) of

OK(state_1, data_2):

ok_result(cons(data(memory_read(pm′)(raddr′)(s′)), data_2))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ok_result, which is trivially true.

This completes the proof of memory_read_list_nse_ok.2.1.
memory_read_list_nse_ok.2.2:

{-1} OK?(memory_read(pm′)(raddr′)(s′))
{-2} j′ ≥ 0

{-3} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, 1 + j′))) {-4} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-5} states′(s′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′ + 1, j′))) {2} OK?(cases memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))) of

OK(state_1, data_2):

ok_result(cons(data(memory_read(pm′)(raddr′)(s′)), data_2))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

Keeping (-3 1) and hiding *, Installing automatic rewrites from: memory_read_transformers_mono address_block_subset_1 Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_nse_ok.2.2.

memory_read_list_nse_ok.2.3:

{-1} OK?(memory_read(pm′)(raddr′)(s′))
{-2} j′ ≥ 0

{-3} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, 1 + j′))) {-4} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-5} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′ + 1, j′)))

{2} OK?(cases memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))) of

OK(state_1, data_2):

ok_result(cons(data(memory_read(pm′)(raddr′)(s′)), data_2))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

Keeping (-4 1) and hiding *, Installing automatic rewrites from: memory_read_transformers_mono address_block_subset_1 Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_read_list_nse_ok.2.3.
memory_read_list_nse_ok.2.4:

{-1} OK?(memory_read(pm′)(raddr′)(s′))
{-2} j′ ≥ 0

{-3} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, 1 + j′))) {-4} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-5} states′(s′)
{1} states′(state(memory_read(pm′)(raddr′)(s′)))

{2} OK?(cases memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))) of

OK(state_1, data_2):

ok_result(cons(data(memory_read(pm′)(raddr′)(s′)), data_2))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

Hiding formulas: 2, Using lemma expr_transformer_invariant_next_ok[State, Byte], Simplifying, rewriting, and recording with decision procedures, Expanding the definition of has_next_state, which is trivially true.

This completes the proof of memory_read_list_nse_ok.2.4.

Q.E.D.

C.123.10 Memory_Change_2.memory_read_list_nse_next_length_TCC1

Terse proof for memory_read_list_nse_next_length_TCC1.
memory_read_list_nse_next_length_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress, size: nat, s: State):

transformer_invariant?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

transformers_ok?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

states(s)

⊃

OK?[State, list[Byte]](memory_read_list_nse[State](pm)(raddr, size)(s)) ∨ Exception?[State, list[Byte]](memory_read_list_nse[State](pm)(raddr, size)(s))

Repeatedly Skolemizing and flattening, Using lemma memory_read_list_nse_ok, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_nse_next_length_TCC1.

Q.E.D.

C.123.11 Memory_Change_2.memory_read_list_nse_next_length_TCC2

Terse proof for memory_read_list_nse_next_length_TCC2.
memory_read_list_nse_next_length_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress, size: nat, s: State): states(state(memory_read_list_nse(pm)(raddr, size)(s))) ∧ transformer_invariant?(states, memory_read_transformers(pm, ad-

dress_block(raddr, size))) ∧ transformers_ok?(states, memory_read_transformers(pm, ad-

dress_block(raddr, size))) ∧

states(s) ⊃ OK?[State, list[Byte]](memory_read_list_nse[State](pm)(raddr, size)(s))

Repeatedly Skolemizing and flattening, Using lemma memory_read_list_nse_ok, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_nse_next_length_TCC2.

Q.E.D.

C.123.12 Memory_Change_2.memory_read_list_nse_next_length

Terse proof for memory_read_list_nse_next_length.

memory_read_list_nse_next_length:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress, size: nat, s: State):

transformer_invariant?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

transformers_ok?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

states(s)

⊃

states(state(memory_read_list_nse(pm)(raddr, size)(s))) ∧ length(data(memory_read_list_nse(pm)(raddr, size)(s))) = size

For the top quantifier in 1, we introduce Skolem constants: (pm′ states′ ),

Inducting on size on formula 1,

we get 4 subgoals:

memory_read_list_nse_next_length.1:

{1} ∀ (raddr: Address, s: State):

transformer_invariant?(states′, memory_read_transformers(pm′, address_block(raddr, 0)))

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, 0))) ∧

states′(s)

⊃

states′(state(memory_read_list_nse(pm′)(raddr, 0)(s))) ∧ length(data(memory_read_list_nse(pm′)(raddr, 0)(s))) = 0

Expanding the definition of memory_read_list_nse,

Repeatedly Skolemizing and flattening,

Expanding the definition of ok_result,

Expanding the definition of length,

which is trivially true.

This completes the proof of memory_read_list_nse_next_length.1.

memory_read_list_nse_next_length.2:

{1} ∀ j:

(∀ (raddr: Address, s: State):

transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, j))) ∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, j))) ∧ states′(s) ⊃ states′(state(memory_read_list_nse(pm′)(raddr, j)(s))) ∧ length(data(memory_read_list_nse(pm′)(raddr, j)(s))) = j)

⊃

(∀ (raddr: Address, s: State):

transformer_invariant?(states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr, j + 1))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, j + 1))) ∧ states′(s) ⊃ states′(state(memory_read_list_nse(pm′)(raddr, j + 1)(s))) ∧ length(data(memory_read_list_nse(pm′)(raddr, j + 1)(s))) = j + 1)

Repeatedly Skolemizing and flattening,

Using lemma memory_read_list_nse_ok,

Simplifying, rewriting, and recording with decision procedures,

Installing automatic rewrites from: memory_read_transformers_memory_read address_block

Using lemma expr_transformers_ok_ok,

Simplifying, rewriting, and recording with decision procedures,

Instantiating the top quantifier in -4 with the terms: raddr′ + 1, state(memory_read(pm′)(raddr′)(s′)),

Splitting conjunctions,

we get 4 subgoals:

memory_read_list_nse_next_length.2.1:

{-1} states′(state(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′)))))

∧

length(data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′)))))

= j′

{-2} OK?(memory_read(pm′)(raddr′)(s′))
{-3} OK?(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))
{-4} j′ ≥ 0

{-5} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, 1 + j′))) {-6} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-7} states′(s′)

{1} states′(state(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))) ∧ length(data(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))) = 1 + j′

Applying disjunctive simplification to flatten sequent,

Installing automatic rewrites from: length ##! ok_result

Expanding the definition of memory_read_list_nse,

Expanding the definition of memory_read_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_read_list_nse_next_length.2.1.
memory_read_list_nse_next_length.2.2:

{-1} OK?(memory_read(pm′)(raddr′)(s′))
{-2} OK?(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))
{-3} j′ ≥ 0

{-4} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, 1 + j′))) {-5} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-6} states′(s′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′ + 1, j′))) {2} states′(state(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))) ∧

length(data(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))) = 1 + j′

Installing automatic rewrites from: address_block_subset_1 memory_read_transformers_mono

Using lemma transformer_invariant_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_nse_next_length.2.2.

memory_read_list_nse_next_length.2.3:

{-1} OK?(memory_read(pm′)(raddr′)(s′))
{-2} OK?(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))
{-3} j′ ≥ 0

{-4} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, 1 + j′))) {-5} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-6} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′ + 1, j′)))

{2} states′(state(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))) ∧ length(data(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))) = 1 + j′

Installing automatic rewrites from: address_block_subset_1 memory_read_transformers_mono

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_nse_next_length.2.3.
memory_read_list_nse_next_length.2.4:

{-1} OK?(memory_read(pm′)(raddr′)(s′))
{-2} OK?(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))
{-3} j′ ≥ 0

{-4} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, 1 + j′))) {-5} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-6} states′(s′)
{1} states′(state(memory_read(pm′)(raddr′)(s′)))

{2} states′(state(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))) ∧ length(data(memory_read_list_nse(pm′)(raddr′, 1 + j′)(s′))) = 1 + j′

Hiding formulas: 2,

Using lemma expr_transformer_invariant_next_ok,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of has_next_state,

which is trivially true.

This completes the proof of memory_read_list_nse_next_length.2.4.

memory_read_list_nse_next_length.3:

{1} ∀ (size: nat, raddr: Address, s: State): states′(state(memory_read_list_nse(pm′)(raddr, size)(s))) ∧ transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, size))) ∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, size))) ∧

states′(s) ⊃ OK?[State, list[Byte]](memory_read_list_nse[State](pm′)(raddr, size)(s))

{2} ∀ (raddr: Address, s: State):

transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, size′))) ∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, size′))) ∧ states′(s) ⊃ states′(state(memory_read_list_nse(pm′)(raddr, size′)(s))) ∧ length(data(memory_read_list_nse(pm′)(raddr, size′)(s))) = size′

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma memory_read_list_nse_ok,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_nse_next_length.3.

memory_read_list_nse_next_length.4:

{1} ∀ (size: nat, raddr: Address, s: State): transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, size))) ∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, size))) ∧ states′(s) ⊃ OK?[State, list[Byte]](memory_read_list_nse[State](pm′)(raddr, size)(s)) ∨ Exception?[State, list[Byte]](memory_read_list_nse[State](pm′)(raddr, size)(s))

{2} ∀ (raddr: Address, s: State):

transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, size′))) ∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, size′))) ∧ states′(s) ⊃ states′(state(memory_read_list_nse(pm′)(raddr, size′)(s))) ∧ length(data(memory_read_list_nse(pm′)(raddr, size′)(s))) = size′

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma memory_read_list_nse_ok, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_nse_next_length.4.

Q.E.D.

C.123.13 Memory_Change_2.memory_read_list_ok

Terse proof for memory_read_list_ok.
memory_read_list_ok:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress, size: nat, s: State):

transformer_invariant?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧

transformers_ok?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧ states(s)

⊃ OK?(memory_read_list(pm)(raddr, size)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: union_subset1 Expanding the definition of memory_read_list, Using lemma memory_read_list_nse_ok, Using lemma memory_read_list_nse_next_length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

memory_read_list_ok.1:

{-1} states′(s′)
{-2} states′(state(memory_read_list_nse(pm′)(raddr′, size′)(s′)))
{-3} length(data(memory_read_list_nse(pm′)(raddr′, size′)(s′))) = size′
{-4} OK?(memory_read_list_nse(pm′)(raddr′, size′)(s′))
{-5} size′ ≥ 0

{-6} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{1} OK?((memory_read_list_nse(pm′)(raddr′, size′) ## (λ (bl1: list[Byte]): memory_read_side_effect(pm′)(raddr′, bl1, false))) (s′))

Expanding the definition of ##, Hiding formulas: -2, -5, -6, Using lemma expr_transformers_ok_ok, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -4, 2, Installing automatic rewrites from: union_right memory_read_side_effect_super_transformers_memory_read_side_effect

subset_equal Simplifying, rewriting, and recording with decision procedures, This completes the proof of memory_read_list_ok.1.

memory_read_list_ok.2:

{-1} states′(s′)
{-2} size′ ≥ 0

{-3} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-4} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr′, size′)))

{2} OK?((memory_read_list_nse(pm′)(raddr′, size′) ## (λ (bl1: list[Byte]): memory_read_side_effect(pm′)(raddr′, bl1, false))) (s′))

Hiding formulas: 2, Keeping (-4 1) and hiding *, Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures, This completes the proof of memory_read_list_ok.2.

memory_read_list_ok.3:

{-1} states′(s′)
{-2} size′ ≥ 0

{-3} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-4} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, size′))) {2} OK?((memory_read_list_nse(pm′)(raddr′, size′) ##

(λ (bl1: list[Byte]): memory_read_side_effect(pm′)(raddr′, bl1, false))) (s′))

Keeping (-3 1) and hiding *, Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures, This completes the proof of memory_read_list_ok.3. Q.E.D.

C.123.14 Memory_Change_2.memory_read_list_next_ok_TCC1

Terse proof for memory_read_list_next_ok_TCC1.
memory_read_list_next_ok_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress, size: nat, s: State):

transformer_invariant?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧

transformers_ok?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧ states(s)

⊃

OK?[State, list[Byte]](memory_read_list[State](pm)(raddr, size)(s)) ∨ Exception?[State, list[Byte]](memory_read_list[State](pm)(raddr, size)(s))

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement,

Using lemma memory_read_list_ok, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_next_ok_TCC1.

Q.E.D.

C.123.15 Memory_Change_2.memory_read_list_next_ok

Terse proof for memory_read_list_next_ok.

memory_read_list_next_ok:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress, size: nat, s: State):

transformer_invariant?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧

transformers_ok?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧ states(s)

⊃ states(state(memory_read_list(pm)(raddr, size)(s)))

Repeatedly Skolemizing and flattening,

Using lemma memory_read_list_ok,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of memory_read_list,

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma memory_read_list_nse_next_length,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

memory_read_list_next_ok.1:

{-1} states′(s′)
{-2} states′(state(memory_read_list_nse(pm′)(raddr′, size′)(s′)))
{-3} length(data(memory_read_list_nse(pm′)(raddr′, size′)(s′))) = size′
{-4} OK?(memory_read_list_nse(pm′)(raddr′, size′)(s′))

{-5} OK?(memory_read_side_effect(pm′)

(raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

{-6} size′ ≥ 0

{-7} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{1} states′(state(memory_read_side_effect(pm′)

(raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′)))))

Hiding formulas: -1, -6, -8,

Installing automatic rewrites from: has_next_state union_right memory_read_side_effect_super_transformers_memory_read_side_effect subset_equal

Using lemma expr_transformer_invariant_next_ok,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_next_ok.1.

memory_read_list_next_ok.2:

{-1} states′(s′)
{-2} OK?(memory_read_list_nse(pm′)(raddr′, size′)(s′))

{-3} OK?(memory_read_side_effect(pm′)

(raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

{-4} size′ ≥ 0

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-6} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr′, size′)))

{2} states′(state(memory_read_side_effect(pm′)

(raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′)))))

Keeping (-6 1) and hiding *, Installing automatic rewrites from: union_subset1 Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_next_ok.2.
memory_read_list_next_ok.3:

{-1} states′(s′)
{-2} OK?(memory_read_list_nse(pm′)(raddr′, size′)(s′))

{-3} OK?(memory_read_side_effect(pm′)

(raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

{-4} size′ ≥ 0

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-6} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, size′))) {2} states′(state(memory_read_side_effect(pm′)

(raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′)))))

Keeping (-5 1) and hiding *, Installing automatic rewrites from: union_subset1 Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of memory_read_list_next_ok.3.

Q.E.D.

C.123.16 Memory_Change_2.unchanged_memory_read_list_nse_TCC1

Terse proof for unchanged_memory_read_list_nse_TCC1.

unchanged_memory_read_list_nse_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress,

size: nat, s: State, q: [State → SuperResult[State]]): unchanged_memory_invariant?(pm, states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ singleton(q)), addresses)

∧

transformers_ok?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

(address_block(raddr, size) ⊆ addresses) ∧ states(s) ∧ OK?(q(s))

⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s))

Repeatedly Skolemizing and flattening,

This completes the proof of unchanged_memory_read_list_nse_TCC1.

Q.E.D.

C.123.17 Memory_Change_2.unchanged_memory_read_list_nse_TCC2

Terse proof for unchanged_memory_read_list_nse_TCC2.
unchanged_memory_read_list_nse_TCC2:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress,

size: nat, s: State, q: [State → SuperResult[State]]): unchanged_memory_invariant?(pm, states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ singleton(q)), addresses)

∧

transformers_ok?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

(address_block(raddr, size) ⊆ addresses) ∧ states(s) ∧ OK?(q(s))

⊃

OK?[State, list[Byte]] (memory_read_list_nse[State](pm)(raddr, size)(state[State](q(s))))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: has_next_state union_right singleton union_subset1

Using lemma memory_read_list_nse_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_read_list_nse_TCC2.1:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr′, size′)))
{-2} size′ ≥ 0

{-3} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ singleton(q′)), addresses′)

{-4} (address_block(raddr′, size′) ⊆ addresses′)
{-5} states′(s′)
{-6} OK?(q′(s′))
{1} states′(state[State](q′(s′)))

{2} OK?[State, list[Byte]] (memory_read_list_nse[State](pm′)(raddr′, size′)(state[State](q′(s′))))

Using lemma unchanged_memory_invariant_next_ok[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse_TCC2.1.
unchanged_memory_read_list_nse_TCC2.2:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr′, size′)))
{-2} size′ ≥ 0

{-3} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ singleton(q′)), addresses′)

{-4} (address_block(raddr′, size′) ⊆ addresses′)
{-5} states′(s′)
{-6} OK?(q′(s′))

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, size′))) {2} OK?[State, list[Byte]]

(memory_read_list_nse[State](pm′)(raddr′, size′)(state[State](q′(s′))))

Forward chaining on unchanged_memory_invariant_invariant, Keeping (-1 1) and hiding *, Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_nse_TCC2.2.

Q.E.D.

C.123.18 Memory_Change_2.unchanged_memory_read_list_nse_TCC3

Terse proof for unchanged_memory_read_list_nse_TCC3.

unchanged_memory_read_list_nse_TCC3:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress,

size: nat, s: State, q: [State → SuperResult[State]]): unchanged_memory_invariant?(pm, states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ singleton(q)), addresses)

∧

transformers_ok?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

(address_block(raddr, size) ⊆ addresses) ∧ states(s) ∧ OK?(q(s))

⊃ OK?[State, list[Byte]](memory_read_list_nse[State](pm)(raddr, size)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: union_subset1 Using lemma memory_read_list_nse_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Forward chaining on unchanged_memory_invariant_invariant, Keeping (-1 1) and hiding *, Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_nse_TCC3.

Q.E.D.

C.123.19 Memory_Change_2.unchanged_memory_read_list_nse

Terse proof for unchanged_memory_read_list_nse.
unchanged_memory_read_list_nse:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress,

size: nat, s: State, q: [State → SuperResult[State]]): unchanged_memory_invariant?(pm, states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ singleton(q)), addresses)

∧

transformers_ok?(states, memory_read_transformers(pm, address_block(raddr, size))) ∧

(address_block(raddr, size) ⊆ addresses) ∧ states(s) ∧ OK?(q(s))

⊃

data(memory_read_list_nse(pm)(raddr, size)(state(q(s)))) =

data(memory_read_list_nse(pm)(raddr, size)(s))

For the top quantifier in 1, we introduce Skolem constants: (addresses′ pm′ states′ ), Inducting on size on formula 1, we get 5 subgoals:

unchanged_memory_read_list_nse.1:

{1} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, 0)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, 0))) ∧

(address_block(raddr, 0) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, 0)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, 0)(s))

Expanding the definition of memory_read_list_nse, Expanding the definition of ok_result, which is trivially true.

This completes the proof of unchanged_memory_read_list_nse.1.
unchanged_memory_read_list_nse.2:

{1} ∀ j:

(∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j)))

∧ (address_block(raddr, j) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j)(s)))

⊃

(∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j + 1)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr, j + 1))) ∧ (address_block(raddr, j + 1) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s))

⊃

data(memory_read_list_nse(pm′)(raddr, j + 1)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j + 1)(s)))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_read_list_nse_TCC2, Using lemma unchanged_memory_read_list_nse_TCC3, Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of memory_read_list_nse,

Expanding the definition of memory_read_list_nse,

Expanding the definition of memory_read_list_nse,

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: -3, -6, -7,

Expanding the definition of ok_result,

Applying extensionality,

we get 2 subgoals:

unchanged_memory_read_list_nse.2.1:

{-1} OK?(memory_read(pm′)(raddr′)(s′))

{-2} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-3} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-4} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-5} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-7} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-8} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-9} states′(s′)
{-10} OK?(q′(s′))

{1} data(memory_read(pm′)(raddr′)(state(q′(s′)))) = data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -2, -4, -5, -7,

Using lemma unchanged_memory_invariant_unchanged[State],

Installing automatic rewrites from: union_right singleton

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-6 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse.2.1.

unchanged_memory_read_list_nse.2.2:

{-1} OK?(memory_read(pm′)(raddr′)(s′))

{-2} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-3} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-4} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-5} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-7} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-8} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-9} states′(s′)
{-10} OK?(q′(s′))

{1} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

=

data(memory_read_list_nse(pm′)(raddr′ + 1, j′) (state(memory_read(pm′)(raddr′)(s′))))

Installing automatic rewrites from: state_expr_2_super has_next_state address_block_subset_2 ok_expr_2_super subset_equal union_subset1 union_subset3 unchanged_memory_invariant_union_transformers union_right singleton memory_read_transformers_mono

Case splitting on unchanged_memory_invariant?(pm!1, states!1, memory_read_transformers(pm!1, address_block (raddr!1 + 1, j!1)), addresses!1),

we get 2 subgoals:

unchanged_memory_read_list_nse.2.2.1:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-2} OK?(memory_read(pm′)(raddr′)(s′))

{-3} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-4} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-5} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-6} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-8} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-9} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-10} states′(s′)
{-11} OK?(q′(s′))

{1} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

=

data(memory_read_list_nse(pm′)(raddr′ + 1, j′) (state(memory_read(pm′)(raddr′)(s′))))

Case splitting on unchanged_memory_invariant?(pm!1, states!1, singleton(expr_2_super (memory_read(pm!1)(raddr!1))), addresses!1),

we get 2 subgoals:

unchanged_memory_read_list_nse.2.2.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(raddr′))), addresses′)

{-2} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-3} OK?(memory_read(pm′)(raddr′)(s′))

{-4} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-5} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-6} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-7} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-8} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-9} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-10} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-11} states′(s′)
{-12} OK?(q′(s′))

{1} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

=

data(memory_read_list_nse(pm′)(raddr′ + 1, j′) (state(memory_read(pm′)(raddr′)(s′))))

Case splitting on transformers_ok?(states!1, memory_read_transformers(pm!1, address_block (raddr!1 + 1, j!1))),

we get 2 subgoals:

unchanged_memory_read_list_nse.2.2.1.1.1:

{-1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′ + 1, j′)))

{-2} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(raddr′))), addresses′)

{-3} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-4} OK?(memory_read(pm′)(raddr′)(s′))

{-5} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-6} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-7} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-8} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-10} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-11} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-12} states′(s′)
{-13} OK?(q′(s′))

{1} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

=

data(memory_read_list_nse(pm′)(raddr′ + 1, j′) (state(memory_read(pm′)(raddr′)(s′))))

Copying formula number: -8 Instantiating the top quantifier in -1 with the terms: raddr′ + 1, s′, expr_2_super(memory_read(pm′)(raddr′)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -3, Hiding formulas: -3, Copying formula number: -9 Instantiating the top quantifier in -1 with the terms: raddr′ + 1, state(q′(s′)), expr_2_super(memory_read(pm′)(raddr′)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unchanged_memory_read_list_nse.2.2.1.1.1.1:

{-1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′ + 1, j′)))

{-2} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

= data(memory_read_list_nse(pm′)(raddr′ + 1, j′)(state(q′(s′))))

{-3} states′(s′)

{-4} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(raddr′))), addresses′)

{-5} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-6} OK?(memory_read(pm′)(raddr′)(s′))

{-7} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-8} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-9} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-10} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-11} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-12} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-13} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-14} OK?(q′(s′))

{1} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

= data(memory_read_list_nse(pm′)(raddr′ + 1, j′)(s′))

Replacing using formula -2,

Hiding formulas: -2,

Case splitting on unchanged_memory_invariant?(pm!1, states!1, singleton(q!1), addresses!1),

we get 2 subgoals:

unchanged_memory_read_list_nse.2.2.1.1.1.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, singleton(q′), addresses′)

{-2} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′ + 1, j′)))

{-3} states′(s′)

{-4} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(raddr′))), addresses′)

{-5} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-6} OK?(memory_read(pm′)(raddr′)(s′))

{-7} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-8} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-9} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-10} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-11} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-12} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-13} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-14} OK?(q′(s′))

{1} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)(state(q′(s′)))) = data(memory_read_list_nse(pm′)(raddr′ + 1, j′)(s′))

Rewriting using -10, matching in *,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_nse.2.2.1.1.1.1.1.

unchanged_memory_read_list_nse.2.2.1.1.1.1.2:

{-1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′ + 1, j′)))

{-2} states′(s′)

{-3} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(raddr′))), addresses′)

{-4} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-5} OK?(memory_read(pm′)(raddr′)(s′))

{-6} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-7} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-8} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-9} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-10} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-11} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-12} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-13} OK?(q′(s′))
{1} unchanged_memory_invariant?(pm′, states′, singleton(q′), addresses′)

{2} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)(state(q′(s′)))) = data(memory_read_list_nse(pm′)(raddr′ + 1, j′)(s′))

Keeping (-10 1) and hiding *,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse.2.2.1.1.1.1.2.

unchanged_memory_read_list_nse.2.2.1.1.1.2:

{-1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′ + 1, j′)))

{-2} states′(s′)

{-3} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(raddr′))), addresses′)

{-4} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-5} OK?(memory_read(pm′)(raddr′)(s′))

{-6} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-7} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-8} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-9} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-10} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-11} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-12} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-13} OK?(q′(s′))
{1} states′(state(q′(s′)))

{2} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

= data(memory_read_list_nse(pm′)(raddr′ + 1, j′)(s′))

Keeping (-10 1) and hiding *,

Using lemma unchanged_memory_invariant_next_ok[State],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse.2.2.1.1.1.2.

unchanged_memory_read_list_nse.2.2.1.1.2:

{-1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(raddr′))), addresses′)

{-2} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-3} OK?(memory_read(pm′)(raddr′)(s′))

{-4} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-5} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-6} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-7} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-8} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-9} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-10} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-11} states′(s′)
{-12} OK?(q′(s′))

{1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′ + 1, j′)))

{2} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

=

data(memory_read_list_nse(pm′)(raddr′ + 1, j′) (state(memory_read(pm′)(raddr′)(s′))))

Keeping (-9 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse.2.2.1.1.2.

unchanged_memory_read_list_nse.2.2.1.2:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{-2} OK?(memory_read(pm′)(raddr′)(s′))

{-3} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-4} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-5} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-6} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-8} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-9} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-10} states′(s′)
{-11} OK?(q′(s′))

{1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(raddr′))), addresses′)

{2} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

=

data(memory_read_list_nse(pm′)(raddr′ + 1, j′) (state(memory_read(pm′)(raddr′)(s′))))

Keeping (-7 1) and hiding *, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: -1, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using singleton_subset, matching in *, Expanding the definition of member, Rewriting using memory_read_transformers_memory_read, matching in *, Keeping 1 and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse.2.2.1.2.

unchanged_memory_read_list_nse.2.2.2:

{-1} OK?(memory_read(pm′)(raddr′)(s′))

{-2} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(s′))))

{-3} OK?(memory_read(pm′)(raddr′)(state[State](q′(s′))))

{-4} OK?(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)

(raddr′)(state[State](q′(s′))))))

{-5} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, j′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, j′))) ∧

(address_block(raddr, j′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, j′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, j′)(s))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr′, 1 + j′)) ∪ singleton(q′)), addresses′)

{-7} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(raddr′, 1 + j′)))

{-8} (address_block(raddr′, 1 + j′) ⊆ addresses′)
{-9} states′(s′)
{-10} OK?(q′(s′))

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(raddr′ + 1, j′)),

addresses′)

{2} data(memory_read_list_nse(pm′)(raddr′ + 1, j′)

(state(memory_read(pm′)(raddr′)(state(q′(s′))))))

=

data(memory_read_list_nse(pm′)(raddr′ + 1, j′) (state(memory_read(pm′)(raddr′)(s′))))

Keeping (-6 1) and hiding *,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: -1,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse.2.2.2.

unchanged_memory_read_list_nse.3:

{1} ∀ (size: nat, raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, size)) ∪ singleton(q)), addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, size))) ∧ (address_block(raddr, size) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ OK?[State, list[Byte]](memory_read_list_nse[State](pm′)(raddr, size)(s))

{2} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, size′)) ∪ singleton(q)), addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, size′))) ∧ (address_block(raddr, size′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, size′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, size′)(s))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_read_list_nse_TCC3, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse.3.
unchanged_memory_read_list_nse.4:

{1} ∀ (size: nat, raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, size)) ∪ singleton(q)), addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, size))) ∧ (address_block(raddr, size) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ OK?[State, list[Byte]]

(memory_read_list_nse[State](pm′)(raddr, size)(state[State](q(s))))

{2} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, size′)) ∪ singleton(q)), addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, ad-

dress_block(raddr, size′))) ∧ (address_block(raddr, size′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, size′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, size′)(s))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_read_list_nse_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_nse.4.
unchanged_memory_read_list_nse.5:

{1} ∀ (size: nat, raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, size)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, size))) ∧

(address_block(raddr, size) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s))

{2} ∀ (raddr: Address, s: State, q: [State → SuperResult[State]]):

unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(raddr, size′)) ∪ singleton(q)), addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr, size′)))

∧ (address_block(raddr, size′) ⊆ addresses′) ∧ states′(s) ∧ OK?(q(s)) ⊃ data(memory_read_list_nse(pm′)(raddr, size′)(state(q(s)))) = data(memory_read_list_nse(pm′)(raddr, size′)(s))

Hiding formulas: 2, Repeatedly Skolemizing and flattening,

This completes the proof of unchanged_memory_read_list_nse.5.

Q.E.D.

C.123.20 Memory_Change_2.unchanged_memory_read_list_TCC1

Terse proof for unchanged_memory_read_list_TCC1.
unchanged_memory_read_list_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress,

size: nat, s: State, q: [State → SuperResult[State]]): unchanged_memory_invariant?(pm, states,

((memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))) ∪ singleton(q)), addresses)

∧

transformers_ok?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧

side_effect_content_unchanged(address_block(raddr, size), states,

memory_read_side_effect(pm))

∧ (address_block(raddr, size) ⊆ addresses) ∧ states(s) ∧ OK?(q(s)) ⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s))

Repeatedly Skolemizing and flattening,

This completes the proof of unchanged_memory_read_list_TCC1.

Q.E.D.

C.123.21 Memory_Change_2.unchanged_memory_read_list_TCC2

Terse proof for unchanged_memory_read_list_TCC2.
unchanged_memory_read_list_TCC2:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress,

size: nat, s: State, q: [State → SuperResult[State]]): unchanged_memory_invariant?(pm, states,

((memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))) ∪ singleton(q)), addresses)

∧

transformers_ok?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧

side_effect_content_unchanged(address_block(raddr, size), states,

memory_read_side_effect(pm))

∧ (address_block(raddr, size) ⊆ addresses) ∧ states(s) ∧ OK?(q(s)) ⊃ OK?[State, list[Byte]]

(memory_read_list[State](pm)(raddr, size)(state[State](q(s))))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: union singleton member union_subset1 has_next_state Using lemma unchanged_memory_invariant_next_ok, Simplifying, rewriting, and recording with decision procedures, Using lemma memory_read_list_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-4 1) and hiding *, Forward chaining on unchanged_memory_invariant_invariant, Hiding formulas: -2, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_TCC2.

Q.E.D.

C.123.22 Memory_Change_2.unchanged_memory_read_list_TCC3

Terse proof for unchanged_memory_read_list_TCC3.

unchanged_memory_read_list_TCC3:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress,

size: nat, s: State, q: [State → SuperResult[State]]): unchanged_memory_invariant?(pm, states,

((memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))) ∪ singleton(q)), addresses)

∧

transformers_ok?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧

side_effect_content_unchanged(address_block(raddr, size), states,

memory_read_side_effect(pm))

∧ (address_block(raddr, size) ⊆ addresses) ∧ states(s) ∧ OK?(q(s)) ⊃ OK?[State, list[Byte]](memory_read_list[State](pm)(raddr, size)(s))

Repeatedly Skolemizing and flattening, Using lemma memory_read_list_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-4 1) and hiding *, Forward chaining on unchanged_memory_invariant_invariant, Hiding formulas: -2, Using lemma transformer_invariant_mono_transformers, Installing automatic rewrites from: union_subset1 Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_TCC3.

Q.E.D.

C.123.23 Memory_Change_2.unchanged_memory_read_list

Terse proof for unchanged_memory_read_list.
unchanged_memory_read_list:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], raddr: Ad-

dress,

size: nat, s: State, q: [State → SuperResult[State]]): unchanged_memory_invariant?(pm, states,

((memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))) ∪ singleton(q)), addresses)

∧

transformers_ok?(states,

(memory_read_transformers (pm, address_block(raddr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(raddr, size))))

∧

side_effect_content_unchanged(address_block(raddr, size), states,

memory_read_side_effect(pm))

∧ (address_block(raddr, size) ⊆ addresses) ∧ states(s) ∧ OK?(q(s)) ⊃ data(memory_read_list(pm)(raddr, size)(state(q(s)))) = data(memory_read_list(pm)(raddr, size)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: subset_equal union_subset1 union_subset3 has_next_state Using lemma unchanged_memory_read_list_TCC2, Using lemma unchanged_memory_read_list_TCC3, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of memory_read_list, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_read_list_nse_next_length, Using lemma memory_read_list_nse_next_length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

unchanged_memory_read_list.1:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr′, size′)))
{-2} states′(s′)
{-3} states′(state(memory_read_list_nse(pm′)(raddr′, size′)(s′)))
{-4} length(data(memory_read_list_nse(pm′)(raddr′, size′)(s′))) = size′
{-5} states′(state(memory_read_list_nse(pm′)(raddr′, size′)(state(q′(s′)))))
{-6} length(data(memory_read_list_nse(pm′)(raddr′, size′)(state(q′(s′))))) = size′

{-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-8} OK?(memory_read_list_nse(pm′)(raddr′, size′)(s′))

{-9} OK?[State, list[Byte]]

(memory_read_side_effect(pm′) (raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

{-10} OK?(memory_read_list_nse(pm′)(raddr′, size′)(state[State](q′(s′))))

{-11} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(raddr′,

data(memory_read_list_nse(pm′)(raddr′, size′)

(state[State](q′(s′)))),

false) (state(memory_read_list_nse(pm′)(raddr′, size′)

(state[State](q′(s′))))))

{-12} size′ ≥ 0

{-13} unchanged_memory_invariant?(pm′, states′, ((memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))) ∪ singleton(q′)), addresses′)

{-14} side_effect_content_unchanged(address_block(raddr′, size′), states′,

memory_read_side_effect(pm′))

{-15} (address_block(raddr′, size′) ⊆ addresses′)
{-16} OK?(q′(s′))

{1} data(memory_read_side_effect(pm′) (raddr′,

data(memory_read_list_nse(pm′)(raddr′, size′)(state(q′(s′)))), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(state(q′(s′))))))

=

data(memory_read_side_effect(pm′) (raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

C Proof scripts

Using lemma side_effect_content_unchanged_content[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -4, Hiding formulas: -4, Using lemma side_effect_content_unchanged_content[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -4, Hiding formulas: -4, Using lemma unchanged_memory_read_list_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-16 1) and hiding *, Rewriting using union_commutative, matching in -1, Rewriting using union_associative, matching in *, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list.1.

unchanged_memory_read_list.2:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr′, size′)))
{-2} states′(s′)
{-3} states′(state(memory_read_list_nse(pm′)(raddr′, size′)(s′)))
{-4} length(data(memory_read_list_nse(pm′)(raddr′, size′)(s′))) = size′

{-5} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-6} OK?(memory_read_list_nse(pm′)(raddr′, size′)(s′))

{-7} OK?[State, list[Byte]]

(memory_read_side_effect(pm′) (raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

{-8} OK?(memory_read_list_nse(pm′)(raddr′, size′)(state[State](q′(s′))))

{-9} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(raddr′,

data(memory_read_list_nse(pm′)(raddr′, size′)

(state[State](q′(s′)))),

false) (state(memory_read_list_nse(pm′)(raddr′, size′)

(state[State](q′(s′))))))

{-10} size′ ≥ 0

{-11} unchanged_memory_invariant?(pm′, states′, ((memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))) ∪ singleton(q′)), addresses′)

{-12} side_effect_content_unchanged(address_block(raddr′, size′), states′,

memory_read_side_effect(pm′))

{-13} (address_block(raddr′, size′) ⊆ addresses′)
{-14} OK?(q′(s′))
{1} states′(state(q′(s′)))

{2} data(memory_read_side_effect(pm′)

(raddr′,

data(memory_read_list_nse(pm′)(raddr′, size′)(state(q′(s′)))), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(state(q′(s′))))))

=

data(memory_read_side_effect(pm′) (raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

Keeping (-11 1) and hiding *,

Installing automatic rewrites from: union member singleton

Using lemma unchanged_memory_invariant_next_ok[State],

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list.2.

unchanged_memory_read_list.3:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(raddr′, size′)))
{-2} states′(s′)

{-3} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))))

{-4} OK?(memory_read_list_nse(pm′)(raddr′, size′)(s′))

{-5} OK?[State, list[Byte]]

(memory_read_side_effect(pm′) (raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

{-6} OK?(memory_read_list_nse(pm′)(raddr′, size′)(state[State](q′(s′))))

{-7} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(raddr′,

data(memory_read_list_nse(pm′)(raddr′, size′)

(state[State](q′(s′)))),

false) (state(memory_read_list_nse(pm′)(raddr′, size′)

(state[State](q′(s′))))))

{-8} size′ ≥ 0

{-9} unchanged_memory_invariant?(pm′, states′, ((memory_read_transformers (pm′, address_block(raddr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(raddr′, size′))) ∪ singleton(q′)), addresses′)

{-10} side_effect_content_unchanged(address_block(raddr′, size′), states′,

memory_read_side_effect(pm′))

{-11} (address_block(raddr′, size′) ⊆ addresses′)
{-12} OK?(q′(s′))

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(raddr′, size′))) {2} data(memory_read_side_effect(pm′) (raddr′,

data(memory_read_list_nse(pm′)(raddr′, size′)(state(q′(s′)))), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(state(q′(s′))))))

=

data(memory_read_side_effect(pm′) (raddr′, data(memory_read_list_nse(pm′)(raddr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(raddr′, size′)(s′))))

Keeping (-9 1) and hiding *,

Forward chaining on unchanged_memory_invariant_invariant,

Hiding formulas: -2,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: -1,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list.3.

Q.E.D.

C.123.24 Memory_Change_2.unchanged_memory_invariant_unchanged_read_list_nse_TCC1

Terse proof for unchanged_memory_invariant_unchanged_read_list_nse_TCC1.
unchanged_memory_invariant_unchanged_read_list_nse_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], s: State,

addr_1, addr_2: Address, size: nat): unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm, ad-

dress_block(addr_2, size)),

addresses)

∧

transformers_ok?(states, memory_read_transformers(pm, addresses)) ∧ (address_block(addr_2, size) ⊆ addresses) ∧ addresses(addr_1) ∧ states(s) ⊃ OK?[State, list[Byte]](memory_read_list_nse[State](pm)(addr_2, size)(s)) ∨ Exception?[State, list[Byte]](memory_read_list_nse[State](pm)(addr_2, size)(s))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: memory_read_transformers_mono

Using lemma memory_read_list_nse_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_invariant_unchanged_read_list_nse_TCC1.1:

{-1} states′(s′)
{-2} size′ ≥ 0

{-3} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, size′)),

addresses′)

{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} (address_block(addr′′, size′) ⊆ addresses′)
{-6} addresses′(addr′)
{1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′′, size′)))
{2} OK?[State, list[Byte]](memory_read_list_nse[State](pm′)(addr′′, size′)(s′))
{3} Exception?[State, list[Byte]](memory_read_list_nse[State](pm′)(addr′′, size′)(s′))

Keeping (-3 -4 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse_TCC1.1.

unchanged_memory_invariant_unchanged_read_list_nse_TCC1.2:

{-1} states′(s′)
{-2} size′ ≥ 0

{-3} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, size′)),

addresses′)

{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} (address_block(addr′′, size′) ⊆ addresses′)
{-6} addresses′(addr′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, size′)))

{2} OK?[State, list[Byte]](memory_read_list_nse[State](pm′)(addr′′, size′)(s′))
{3} Exception?[State, list[Byte]](memory_read_list_nse[State](pm′)(addr′′, size′)(s′))

Forward chaining on unchanged_memory_invariant_invariant,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse_TCC1.2.

Q.E.D.

C.123.25 Memory_Change_2.unchanged_memory_invariant_unchanged_read_list_nse_TCC2

Terse proof for unchanged_memory_invariant_unchanged_read_list_nse_TCC2.
unchanged_memory_invariant_unchanged_read_list_nse_TCC2:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], s: State,

addr_1, addr_2: Address, size: nat): unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm, ad-

dress_block(addr_2, size)),

addresses)

∧

transformers_ok?(states, memory_read_transformers(pm, addresses)) ∧ (address_block(addr_2, size) ⊆ addresses) ∧ addresses(addr_1) ∧ states(s) ⊃ OK?[State, Byte]

(memory_read(pm) (addr_1) (state[State, list[Byte]]

(memory_read_list_nse[State](pm)(addr_2, size)(s))))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: memory_read_transformers_memory_read Using lemma expr_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Using lemma memory_read_list_nse_next_length, Forward chaining on unchanged_memory_invariant_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Installing automatic rewrites from: memory_read_transformers_mono Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse_TCC2.

Q.E.D.

C.123.26 Memory_Change_2.unchanged_memory_invariant_unchanged_read_list_nse_TCC3

Terse proof for unchanged_memory_invariant_unchanged_read_list_nse_TCC3.
unchanged_memory_invariant_unchanged_read_list_nse_TCC3:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], s: State,

addr_1, addr_2: Address, size: nat): unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm, ad-

dress_block(addr_2, size)),

addresses)

∧

transformers_ok?(states, memory_read_transformers(pm, addresses)) ∧ (address_block(addr_2, size) ⊆ addresses) ∧ addresses(addr_1) ∧ states(s) ⊃ OK?[State, Byte](memory_read(pm)(addr_1)(s))

Repeatedly Skolemizing and flattening, Using lemma expr_transformers_ok_ok[State, Byte], Installing automatic rewrites from: memory_read_transformers_memory_read Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse_TCC3.

Q.E.D.

C.123.27 Memory_Change_2.unchanged_memory_invariant_unchanged_read_list_nse

Terse proof for unchanged_memory_invariant_unchanged_read_list_nse.
unchanged_memory_invariant_unchanged_read_list_nse:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], s: State,

addr_1, addr_2: Address, size: nat): unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm, ad-

dress_block(addr_2, size)),

addresses)

∧

transformers_ok?(states, memory_read_transformers(pm, addresses)) ∧ (address_block(addr_2, size) ⊆ addresses) ∧ addresses(addr_1) ∧ states(s) ⊃ data(memory_read(pm)(addr_1)(state(memory_read_list_nse(pm)(addr_2, size)(s)))) = data(memory_read(pm)(addr_1)(s))

For the top quantifier in 1, we introduce Skolem constants: (addresses′ pm′ states′ addr′ ), Inducting on size on formula 1, we get 5 subgoals:

unchanged_memory_invariant_unchanged_read_list_nse.1:

{1} ∀ (s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, 0)),

addresses′)

∧

transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, 0) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′)

(addr′)(state(memory_read_list_nse(pm′)(addr_2, 0)(s))))

= data(memory_read(pm′)(addr′)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.1.
unchanged_memory_invariant_unchanged_read_list_nse.2:

{1} ∀ j: (∀ (s: State, addr_2: Address): unchanged_memory_invariant?(pm′, states′, memory_read_transformers(pm′, ad- dress_block(addr_2, j)), addresses′) ∧ transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, j) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′) (addr′)(state(memory_read_list_nse(pm′)(addr_2, j)(s)))) = data(memory_read(pm′)(addr′)(s))) ⊃ (∀ (s: State, addr_2: Address): unchanged_memory_invariant?(pm′, states′, memory_read_transformers(pm′, address_block (addr_2, j + 1)), addresses′) ∧ transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, j + 1) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′) (addr′) (state(memory_read_list_nse(pm′)(addr_2, j + 1)(s)))) = data(memory_read(pm′)(addr′)(s)))

Repeatedly Skolemizing and flattening, Forward chaining on unchanged_memory_invariant_invariant, Installing automatic rewrites from: memory_read_transformers_mono ok_result address_block_subset_1 address_block_subset_2 address_block has_next_state memory_read_transformers_memory_read subset_equal

Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_read_list_nse_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_read_list_nse, Expanding the definition of memory_read_list_nse, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: -6, Using lemma expr_transformer_invariant_next_ok[State, Byte], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unchanged_memory_invariant_unchanged_read_list_nse.2.1:

{-1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, 1 + j′)))

{-2} states′(s′)
{-3} states′(state(memory_read(pm′)(addr′′)(s′)))

{-4} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(addr′′, 1 + j′)))

{-5} OK?(memory_read(pm′)(addr′′)(s′))

{-6} OK?(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))

{-7} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-8} j′ ≥ 0

{-9} data(memory_read(pm′)

(addr′)

(state(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))))

= data(memory_read(pm′)(addr′)(state(memory_read(pm′)(addr′′)(s′))))

{-10} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′, 1 + j′)),

addresses′)

{-11} (address_block(addr′′, 1 + j′) ⊆ addresses′)
{-12} addresses′(addr′)

{1} data(memory_read(pm′) (addr′) (state(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))))

= data(memory_read(pm′)(addr′)(s′))

Replacing using formula -9, Hiding formulas: -9, Using lemma expr_unchanged_memory_invariant_unchanged[State, Byte], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unchanged_memory_invariant_unchanged_read_list_nse.2.1.1:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′, 1 + j′)),

addresses′)

{-2} states′(s′)
{-3} addresses′(addr′)
{-4} OK?(memory_read(pm′)(addr′′)(s′))

{-5} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, 1 + j′)))

{-6} states′(state(memory_read(pm′)(addr′′)(s′)))

{-7} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(addr′′, 1 + j′)))

{-8} OK?(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))

{-9} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-10} j′ ≥ 0
{-11} (address_block(addr′′, 1 + j′) ⊆ addresses′)
{1} OK?(memory_read(pm′)(addr′)(state(memory_read(pm′)(addr′′)(s′))))

{2} data(memory_read(pm′)(addr′)(state(memory_read(pm′)(addr′′)(s′)))) = data(memory_read(pm′)(addr′)(s′))

Keeping (-3 -6 -9 1) and hiding *, Using lemma expr_transformers_ok_ok[State, Byte], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.2.1.1.
unchanged_memory_invariant_unchanged_read_list_nse.2.1.2:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′, 1 + j′)),

addresses′)

{-2} states′(s′)
{-3} addresses′(addr′)
{-4} OK?(memory_read(pm′)(addr′′)(s′))

{-5} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, 1 + j′)))

{-6} states′(state(memory_read(pm′)(addr′′)(s′)))

{-7} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(addr′′, 1 + j′)))

{-8} OK?(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))

{-9} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-10} j′ ≥ 0
{-11} (address_block(addr′′, 1 + j′) ⊆ addresses′)
{1} OK?(memory_read(pm′)(addr′)(s′))

{2} data(memory_read(pm′)(addr′)(state(memory_read(pm′)(addr′′)(s′)))) = data(memory_read(pm′)(addr′)(s′))

Keeping (-3 -9 1) and hiding *, Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.2.1.2.

unchanged_memory_invariant_unchanged_read_list_nse.2.2:

{-1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′′, 1 + j′)))

{-2} states′(s′)
{-3} states′(state(memory_read(pm′)(addr′′)(s′)))

{-4} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(addr′′, 1 + j′)))

{-5} OK?(memory_read(pm′)(addr′′)(s′))

{-6} OK?(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))

{-7} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-8} j′ ≥ 0

{-9} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′, 1 + j′)),

addresses′)

{-10} (address_block(addr′′, 1 + j′) ⊆ addresses′)
{-11} addresses′(addr′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(addr′′ + 1, j′)),

addresses′)

{2} data(memory_read(pm′)

(addr′)

(state(memory_read_list_nse(pm′)(addr′′ + 1, j′)

(state(memory_read(pm′)(addr′′)(s′))))))

= data(memory_read(pm′)(addr′)(s′))

Keeping (-9 1) and hiding *,

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.2.2.

unchanged_memory_invariant_unchanged_read_list_nse.3:

{1} ∀ (size: nat, s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size)),

addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ OK?[State, Byte](memory_read(pm′)(addr′)(s))

{2} ∀ (s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size′)),

addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size′) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′)

(addr′)(state(memory_read_list_nse(pm′)(addr_2, size′)(s))))

= data(memory_read(pm′)(addr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_read_list_nse_TCC3,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.3.

unchanged_memory_invariant_unchanged_read_list_nse.4:

{1} ∀ (size: nat, s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size)),

addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ OK?[State, Byte]

(memory_read(pm′) (addr′) (state[State, list[Byte]]

(memory_read_list_nse[State](pm′)(addr_2, size)(s))))

{2} ∀ (s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size′)),

addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size′) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′)

(addr′)(state(memory_read_list_nse(pm′)(addr_2, size′)(s))))

= data(memory_read(pm′)(addr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_read_list_nse_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.4.

unchanged_memory_invariant_unchanged_read_list_nse.5:

{1} ∀ (size: nat, s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size)),

addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ OK?[State, list[Byte]](memory_read_list_nse[State](pm′)(addr_2, size)(s)) ∨ Exception?[State, list[Byte]](memory_read_list_nse[State](pm′)(addr_2, size)(s))

{2} ∀ (s: State, addr_2: Address):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr_2, size′)),

addresses′)

∧ transformers_ok?(states′, memory_read_transformers(pm′, addresses′)) ∧ (address_block(addr_2, size′) ⊆ addresses′) ∧ addresses′(addr′) ∧ states′(s) ⊃ data(memory_read(pm′)

(addr′)(state(memory_read_list_nse(pm′)(addr_2, size′)(s))))

= data(memory_read(pm′)(addr′)(s))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_invariant_unchanged_read_list_nse_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_read_list_nse.5.

Q.E.D.

C.123.28 Memory_Change_2.memory_write_list_ok_nse

Terse proof for memory_write_list_ok_nse.
memory_write_list_ok_nse:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Address, s: State,

bl: list[Byte]): transformer_invariant?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ states(s) ⊃ OK?(memory_write_list_nse(pm)(waddr, bl)(s))

For the top quantifier in 1, we introduce Skolem constants: (pm′ states′ ), Inducting on bl on formula 1, we get 2 subgoals:

memory_write_list_ok_nse.1:

{1} ∀ (waddr: Address, s: State):

transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(null)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(null)))) ∧ states′(s) ⊃ OK?(memory_write_list_nse(pm′)(waddr, null)(s))

Expanding the definition of memory_write_list_nse,

Expanding the definition of ok_result,

which is trivially true.

This completes the proof of memory_write_list_ok_nse.1.

memory_write_list_ok_nse.2:

{1} ∀ (cons1_var: Byte, cons2_var: list[Byte]): (∀ (waddr: Address, s: State):

transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var)))) ∧ states′(s) ⊃ OK?(memory_write_list_nse(pm′)(waddr, cons2_var)(s)))

⊃

(∀ (waddr: Address, s: State):

transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧ states′(s)

⊃ OK?(memory_write_list_nse(pm′)(waddr, cons(cons1_var, cons2_var))(s)))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: memory_write_transformers_memory_write address_block length comp_expr_forget_expr has_next_state address_block_subset_1 memory_write_transformers_mono

Expanding the definition of memory_write_list_nse,

Using lemma expr_transformers_ok_ok,

Simplifying, rewriting, and recording with decision procedures,

Simplifying, rewriting, and recording with decision procedures,

Instantiating quantified variables,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

memory_write_list_ok_nse.2.1:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-3} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} states′(s′)
{1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′) (state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

Using lemma expr_transformer_invariant_next_ok[State, Unit],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_write_list_ok_nse.2.1.
memory_write_list_ok_nse.2.2:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-3} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′) (state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

Keeping (-3 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_write_list_ok_nse.2.2.

memory_write_list_ok_nse.2.3:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-3} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′) (state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

Keeping (-2 1) and hiding *, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_write_list_ok_nse.2.3.

Q.E.D.

C.123.29 Memory_Change_2.memory_write_list_ok

Terse proof for memory_write_list_ok.
memory_write_list_ok:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Address, s: State,

bl: list[Byte]): transformer_invariant?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?(memory_write_list(pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Installing automatic rewrites from: union member has_next_state union_subset1 mem-

ory_write_side_effect_super_transformers_memory_write_side_effect subset_equal Expanding the definition of memory_write_list, Using lemma expr_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ##, Using lemma side_effect_content_unchanged_content[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_write_list_ok_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

memory_write_list_ok.1:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-6} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{2} OK?(memory_write_list_nse(pm′)

(waddr′,

data(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′)))

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′))))

Keeping (-6 1) and hiding *, Using lemma expr_transformer_invariant_next_ok[State, list[Byte]], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of memory_write_list_ok.1.

memory_write_list_ok.2:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-6} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′, length (data

(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{2} OK?(memory_write_list_nse(pm′)

(waddr′,

data(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′)))

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′))))

Replacing using formula -4, Keeping (-5 1) and hiding *, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_write_list_ok.2.

memory_write_list_ok.3:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-6} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′, length (data

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))

{2} OK?(memory_write_list_nse(pm′)

(waddr′,

data(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′)))

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′))))

Replacing using formula -4,

Keeping (-6 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of memory_write_list_ok.3.

Q.E.D.

C.123.30 Memory_Change_2.unchanged_memory_invariant_unchanged_write_list_nse_TCC1

Terse proof for unchanged_memory_invariant_unchanged_write_list_nse_TCC1.

C.123 Proofs for Memory_Change_2 (memory.pvs)

unchanged_memory_invariant_unchanged_write_list_nse_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad- dress, bl: list[Byte]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl))), singleton(raddr)) ∧ transformers_ok?(states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl)))) ∧ transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ states(s) ⊃ OK?[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening, Using lemma memory_write_list_ok_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Forward chaining on unchanged_memory_invariant_invariant,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse_TCC1.

Q.E.D.

C.123.31 Memory_Change_2.unchanged_memory_invariant_unchanged_write_list_nse_TCC2

Terse proof for unchanged_memory_invariant_unchanged_write_list_nse_TCC2.

unchanged_memory_invariant_unchanged_write_list_nse_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad- dress, bl: list[Byte]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl))), singleton(raddr)) ∧ transformers_ok?(states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl)))) ∧ transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ states(s) ⊃ OK?[State, Byte] (memory_read(pm) (raddr) (state[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s))))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: singleton Using lemma expr_transformers_ok_ok[State, Byte], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Forward chaining on unchanged_memory_invariant_invariant, Using lemma memory_write_list_ok_nse, Simplifying, rewriting, and recording with decision procedures, Using lemma transformer_invariant_write_list_nse, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of result_pred, Installing automatic rewrites from: has_next_state_expr_2_super has_next_state state_expr_2_super Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse_TCC2.

Q.E.D.

C.123.32 Memory_Change_2.unchanged_memory_invariant_unchanged_write_list_nse_TCC3

Terse proof for unchanged_memory_invariant_unchanged_write_list_nse_TCC3.

unchanged_memory_invariant_unchanged_write_list_nse_TCC3:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad- dress, bl: list[Byte]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl))), singleton(raddr)) ∧ transformers_ok?(states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl)))) ∧ transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ states(s) ⊃ OK?[State, Byte](memory_read(pm)(raddr)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: singleton Using lemma expr_transformers_ok_ok[State, Byte], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse_TCC3.

Q.E.D.

C.123.33 Memory_Change_2.unchanged_memory_invariant_unchanged_write_list_nse

Terse proof for unchanged_memory_invariant_unchanged_write_list_nse.
unchanged_memory_invariant_unchanged_write_list_nse:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad- dress, bl: list[Byte]): unchanged_memory_invariant?(pm, states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl))), singleton(raddr)) ∧ transformers_ok?(states, memory_write_transformers(pm, ad- dress_block(waddr, length(bl)))) ∧ transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ states(s) ⊃ data(memory_read(pm)(raddr)(state(memory_write_list_nse(pm)(waddr, bl)(s)))) = data(memory_read(pm)(raddr)(s))

C Proof scripts

For the top quantifier in 1, we introduce Skolem constants: (pm′ states′ raddr′ ), Inducting on bl on formula 1, we get 5 subgoals:

unchanged_memory_invariant_unchanged_write_list_nse.1:

{1} ∀ (s: State, waddr: Address): unchanged_memory_invariant?(pm′, states′, memory_write_transformers(pm′, ad- dress_block(waddr, length(null))), singleton(raddr′)) ∧ transformers_ok?(states′, memory_write_transformers(pm′, ad- dress_block(waddr, length(null)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s) ⊃ data(memory_read(pm′) (raddr′)(state(memory_write_list_nse(pm′)(waddr, null)(s)))) = data(memory_read(pm′)(raddr′)(s))

Expanding the definition of memory_write_list_nse, Expanding the definition of ok_result, which is trivially true.

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.1.

unchanged_memory_invariant_unchanged_write_list_nse.2:

{1} ∀ (cons1_var: Byte, cons2_var: list[Byte]):

(∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′, address_block (waddr, length(cons2_var))),

singleton(raddr′))

∧ transformers_ok?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃ data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, cons2_var)(s))))

= data(memory_read(pm′)(raddr′)(s))) ⊃ (∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′, address_block (waddr, length (cons

(cons1_var, cons2_var)))),

singleton(raddr′))

∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃ data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr, cons(cons1_var, cons2_var)) (s))))

= data(memory_read(pm′)(raddr′)(s)))

Repeatedly Skolemizing and flattening, Forward chaining on unchanged_memory_invariant_invariant, Using lemma memory_write_list_ok_nse,

C Proof scripts

Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: memory_write_transformers_memory_write singleton ad-

dress_block_subset_1 memory_write_transformers_mono length ## address_block has_next_state subset_equal

Using lemma expr_transformers_ok_ok, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_transformers_ok_ok, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_transformer_invariant_next_ok, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_transformers_ok_ok, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of memory_write_list_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using -7, matching in *, we get 3 subgoals:

unchanged_memory_invariant_unchanged_write_list_nse.2.1:

{-1} OK?(memory_read(pm′)

(raddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-2} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))
{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))
{-4} OK?(memory_read(pm′)(raddr′)(s′))
{-5} OK?(memory_write_list_nse(pm′)(waddr′, cons(cons1_var′, cons2_var′))(s′))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr,

length(cons2_var′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length(cons2_var′))))

∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, cons2_var′)(s))))

= data(memory_read(pm′)(raddr′)(s))

{-8} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

singleton(raddr′))

{-9} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-11} states′(s′)

{1} data(memory_read(pm′)

(raddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

= data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -7,

Using lemma expr_unchanged_memory_invariant_unchanged,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.2.1.

unchanged_memory_invariant_unchanged_write_list_nse.2.2:

{-1} OK?(memory_read(pm′)

(raddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-2} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))
{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))
{-4} OK?(memory_read(pm′)(raddr′)(s′))
{-5} OK?(memory_write_list_nse(pm′)(waddr′, cons(cons1_var′, cons2_var′))(s′))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr,

length(cons2_var′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length(cons2_var′))))

∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, cons2_var′)(s))))

= data(memory_read(pm′)(raddr′)(s))

{-8} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

singleton(raddr′))

{-9} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-11} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′ + 1,

length(cons2_var′))),

singleton(raddr′))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Keeping (-8 1) and hiding *, Using lemma unchanged_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.2.2.
unchanged_memory_invariant_unchanged_write_list_nse.2.3:

{-1} OK?(memory_read(pm′)

(raddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-2} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))
{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))
{-4} OK?(memory_read(pm′)(raddr′)(s′))
{-5} OK?(memory_write_list_nse(pm′)(waddr′, cons(cons1_var′, cons2_var′))(s′))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr,

length(cons2_var′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length(cons2_var′))))

∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, cons2_var′)(s))))

= data(memory_read(pm′)(raddr′)(s))

{-8} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

singleton(raddr′))

{-9} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-11} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read(pm′) (raddr′) (state(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Keeping (-9 1) and hiding *, Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.2.3.
unchanged_memory_invariant_unchanged_write_list_nse.3:

{1} ∀ (bl: list[Byte], s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃ OK?[State, Byte](memory_read(pm′)(raddr′)(s))

{2} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

singleton(raddr′))

∧

transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃

data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= data(memory_read(pm′)(raddr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_write_list_nse_TCC3,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.3.

unchanged_memory_invariant_unchanged_write_list_nse.4:

{1} ∀ (bl: list[Byte], s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

singleton(raddr′))

∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃ OK?[State, Byte]

(memory_read(pm′) (raddr′) (state[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s))))

{2} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

singleton(raddr′))

∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃ data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= data(memory_read(pm′)(raddr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_write_list_nse_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.4.

unchanged_memory_invariant_unchanged_write_list_nse.5:

{1} ∀ (bl: list[Byte], s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

singleton(raddr′))

∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃ OK?[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s))

{2} ∀ (s: State, waddr: Address):

unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

singleton(raddr′))

∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′)))) ∧ states′(s)

⊃ data(memory_read(pm′)

(raddr′)(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= data(memory_read(pm′)(raddr′)(s))

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_unchanged_write_list_nse_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_nse.5.

Q.E.D.

C.123.34 Memory_Change_2.unchanged_memory_invariant_unchanged_write_list_TCC1

Terse proof for unchanged_memory_invariant_unchanged_write_list_TCC1.

unchanged_memory_invariant_unchanged_write_list_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad-

dress,

bl: list[Byte]): unchanged_memory_invariant?(pm, states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))), singleton(raddr))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, Unit](memory_write_list[State](pm)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening,

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_write_list_ok,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC1.

Q.E.D.

C.123.35 Memory_Change_2.unchanged_memory_invariant_unchanged_write_list_TCC2

Terse proof for unchanged_memory_invariant_unchanged_write_list_TCC2.

unchanged_memory_invariant_unchanged_write_list_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad-

dress,

bl: list[Byte]): unchanged_memory_invariant?(pm, states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))), singleton(raddr))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, Byte]

(memory_read(pm) (raddr) (state[State, Unit](memory_write_list[State](pm)(waddr, bl)(s))))

Repeatedly Skolemizing and flattening,

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_write_list_ok,

Simplifying, rewriting, and recording with decision procedures,

Using lemma expr_transformers_ok_ok,

Installing automatic rewrites from: singleton union_right has_next_state add_as_union memory_write_side_effect_super_transformers_memory_write_side_effect union_subset1 subset_equal subset_singleton union_right

Simplifying, rewriting, and recording with decision procedures,

Using lemma transformer_invariant_write_list,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_invariant_unchanged_write_list_TCC2.1:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} result_pred(states′)(expr_2_super(memory_write_list(pm′)(waddr′, bl′))(s′))
{-4} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))

{-5} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{1} states′(state(memory_write_list[State](pm′)(waddr′, bl′)(s′)))

{2} OK?[State, Byte]

(memory_read(pm′) (raddr′) (state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′))))

Rewriting using expr_result_pred_next_state, matching in *,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC2.1.
unchanged_memory_invariant_unchanged_write_list_TCC2.2:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))

{-4} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-5} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-6} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-7} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))

{1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false)))))

{2} states′(state(memory_write_list[State](pm′)(waddr′, bl′)(s′)))

{3} OK?[State, Byte]

(memory_read(pm′) (raddr′) (state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′))))

Keeping (-4 1) and hiding *,

Rewriting using transformer_invariant_union_transformers, matching in *,

we get 2 subgoals:

unchanged_memory_invariant_unchanged_write_list_TCC2.2.1:

{-1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {2} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false)))))

Hiding formulas: 2, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC2.2.1.
unchanged_memory_invariant_unchanged_write_list_TCC2.2.2:

{-1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformer_invariant?(states′,

singleton(expr_2_super(memory_write_side_effect(pm′)

(waddr′, bl′, false))))

{2} transformer_invariant?(states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false)))))

Hiding formulas: 2, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC2.2.2.

Q.E.D.

C.123.36 Memory_Change_2.unchanged_memory_invariant_unchanged_write_list_TCC3

Terse proof for unchanged_memory_invariant_unchanged_write_list_TCC3.
unchanged_memory_invariant_unchanged_write_list_TCC3:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad-

dress,

bl: list[Byte]): unchanged_memory_invariant?(pm, states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))), singleton(raddr))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, Byte](memory_read(pm)(raddr)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: singleton Using lemma expr_transformers_ok_ok[State, Byte], Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_invariant_unchanged_write_list_TCC3.

Q.E.D.

C.123.37 Memory_Change_2.unchanged_memory_invariant_unchanged_write_list

Terse proof for unchanged_memory_invariant_unchanged_write_list.
unchanged_memory_invariant_unchanged_write_list:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], s: State, raddr, waddr: Ad-

dress,

bl: list[Byte]): unchanged_memory_invariant?(pm, states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))), singleton(raddr))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states, singleton(expr_2_super(memory_read(pm)(raddr)))) ∧ side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ data(memory_read(pm)(raddr)(state(memory_write_list(pm)(waddr, bl)(s)))) = data(memory_read(pm)(raddr)(s))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of memory_write_list, Using lemma expr_transformers_ok_ok, Installing automatic rewrites from: union_right memory_write_side_effect_super_transformers_memory_write_side_effect

subset_equal singleton has_next_state union_subset1 Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ##, Using lemma side_effect_content_unchanged_content[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -4, Hiding formulas: -4, Using lemma expr_unchanged_memory_invariant_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma unchanged_memory_invariant_unchanged_write_list_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

unchanged_memory_invariant_unchanged_write_list.1:

{-1} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-2} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-3} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

=

data(memory_read(pm′)

(raddr′)(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))))

{-4} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-5} states′(s′)

{-6} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-7} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-8} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} data(memory_read(pm′) (raddr′) (state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -2,

Using lemma expr_unchanged_memory_invariant_unchanged,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_invariant_unchanged_write_list.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))

{-5} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

=

data(memory_read(pm′)

(raddr′)(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))))

{-6} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} OK?(memory_read(pm′)

(raddr′)(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))))

{2} data(memory_read(pm′) (raddr′) (state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -1, -5, 2,

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list.1.1.

unchanged_memory_invariant_unchanged_write_list.1.2:

{-1} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-2} states′(s′)
{-3} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))
{-4} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))

{-5} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

=

data(memory_read(pm′)

(raddr′)(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))))

{-6} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} OK?(memory_read(pm′)(raddr′)(s′))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Hiding formulas: -1, -5, 2, Using lemma expr_transformers_ok_ok[State, Byte], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list.1.2.
unchanged_memory_invariant_unchanged_write_list.2:

{-1} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-2} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-3} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-4} states′(s′)

{-5} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Keeping (-7 1) and hiding *, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list.2.
unchanged_memory_invariant_unchanged_write_list.3:

{-1} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(raddr′))))
{-2} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-3} unchanged_memory_invariant?(pm′, states′, (memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))), singleton(raddr′))

{-4} states′(s′)

{-5} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{1} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′))),

singleton(raddr′))

{2} data(memory_read(pm′)

(raddr′)

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))))

= data(memory_read(pm′)(raddr′)(s′))

Keeping (-3 1) and hiding *, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_unchanged_write_list.3.

Q.E.D.

C.123.38 Memory_Change_2.unchanged_memory_invariant_read_list

Terse proof for unchanged_memory_invariant_read_list.
unchanged_memory_invariant_read_list:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], addr: Ad-

dress,

size: nat): unchanged_memory_invariant?(pm, states,

(memory_read_transformers (pm, address_block(addr, size)) ∪ memory_read_side_effect_super_transformers (pm, address_block(addr, size))), addresses)

∧

transformers_ok?(states,

(memory_read_transformers (pm, addresses) ∪ memory_read_side_effect_super_transformers (pm, addresses)))

∧ (address_block(addr, size) ⊆ addresses) ⊃ unchanged_memory_invariant?(pm, states,

singleton(expr_2_super(memory_read_list(pm)(addr, size))), addresses)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: result_pred state_expr_2_super ok_expr_2_super has_next_state

memory_read_transformers_mono subset_bigger_union_left memory_read_side_effect_super_transformers_mono subset_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right union_left union_right transformers_ok_union_transformers memory_read_transformers_memory_read memory_read_side_effect_super_transformers_memory_read_side_effect

Using lemma transformers_ok_mono_transformers, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of unchanged_memory_invariant?, Applying propositional simplification, we get 2 subgoals:

unchanged_memory_invariant_read_list.1:

{-1} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-2} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-3} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-4} size′ ≥ 0

{-5} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-6} (address_block(addr′, size′) ⊆ addresses′)

{1} transformer_invariant?(states′,

singleton(expr_2_super(memory_read_list(pm′)(addr′, size′))))

Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -2, Hiding formulas: -2, Forward chaining on unchanged_memory_invariant_invariant, Using lemma memory_read_list_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_read_list_next_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_read_list.1.

unchanged_memory_invariant_read_list.2:

{-1} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-2} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-3} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-4} size′ ≥ 0

{-5} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-6} (address_block(addr′, size′) ⊆ addresses′)

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(memory_read_list(pm′)(addr′, size′)))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

Using lemma unchanged_memory_invariant_mono,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Expanding the definition of singleton,

Replacing using formula -4,

Hiding formulas: -4,

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of memory_read_list,

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Using lemma memory_read_list_nse_next_length,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_invariant_read_list.2.1:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-2} states′(s′)
{-3} states′(state(memory_read_list_nse(pm′)(addr′, size′)(s′)))
{-4} length(data(memory_read_list_nse(pm′)(addr′, size′)(s′))) = size′

{-5} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-6} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′)),

addresses′)

{-7} addresses′(a′)
{-8} OK?(memory_read_list_nse(pm′)(addr′, size′)(s′))

{-9} OK?(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-10} OK?(memory_read(pm′)(a′)(s′))

{-11} OK?(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

{-12} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-13} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-14} size′ ≥ 0
{-15} (address_block(addr′, size′) ⊆ addresses′)

{1} data(memory_read(pm′) (a′) (state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

= data(memory_read(pm′)(a′)(s′))

Using lemma expr_unchanged_memory_invariant_unchanged[State, list[Byte]],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_invariant_read_list.2.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-2} states′(state(memory_read_list_nse(pm′)(addr′, size′)(s′)))
{-3} addresses′(a′)

{-4} OK?(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-5} OK?(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

{-6} data(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

=

data(memory_read(pm′)

(a′)(state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-7} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-8} states′(s′)
{-9} length(data(memory_read_list_nse(pm′)(addr′, size′)(s′))) = size′

{-10} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′)),

addresses′)

{-11} OK?(memory_read_list_nse(pm′)(addr′, size′)(s′))
{-12} OK?(memory_read(pm′)(a′)(s′))

{-13} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-14} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-15} size′ ≥ 0
{-16} (address_block(addr′, size′) ⊆ addresses′)

{1} data(memory_read(pm′) (a′) (state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

= data(memory_read(pm′)(a′)(s′))

Replacing using formula -6, Hiding formulas: -6, Using lemma unchanged_memory_invariant_unchanged_read_list_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-13 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_read_list.2.1.1.
unchanged_memory_invariant_read_list.2.1.2:

{-1} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-2} states′(state(memory_read_list_nse(pm′)(addr′, size′)(s′)))
{-3} addresses′(a′)

{-4} OK?(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-5} OK?(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

{-6} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-7} states′(s′)
{-8} length(data(memory_read_list_nse(pm′)(addr′, size′)(s′))) = size′

{-9} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′)),

addresses′)

{-10} OK?(memory_read_list_nse(pm′)(addr′, size′)(s′))
{-11} OK?(memory_read(pm′)(a′)(s′))

{-12} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-13} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-14} size′ ≥ 0
{-15} (address_block(addr′, size′) ⊆ addresses′)
{1} OK?(memory_read(pm′)(a′)(state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{2} data(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

= data(memory_read(pm′)(a′)(s′))

Keeping (-2 -3 -10 -12 1) and hiding *,

Using lemma expr_transformers_ok_ok[State, Byte],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_invariant_read_list.2.1.2.

unchanged_memory_invariant_read_list.2.2:

{-1} transformers_ok?(states′, memory_read_transformers(pm′, address_block(addr′, size′)))
{-2} states′(s′)

{-3} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(addr′, size′)) ∪ memory_read_side_effect_super_transformers (pm′, address_block(addr′, size′))), addresses′)

{-4} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′)),

addresses′)

{-5} addresses′(a′)
{-6} OK?(memory_read_list_nse(pm′)(addr′, size′)(s′))

{-7} OK?(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)), false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))

{-8} OK?(memory_read(pm′)(a′)(s′))

{-9} OK?(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

{-10} transformers_ok?(states′,

(memory_read_transformers (pm′, addresses′) ∪ memory_read_side_effect_super_transformers (pm′, addresses′)))

{-11} transformers_ok?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block(addr′, size′)))

{-12} size′ ≥ 0
{-13} (address_block(addr′, size′) ⊆ addresses′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′, ad-

dress_block(addr′, size′))) {2} data(memory_read(pm′)

(a′)

(state(memory_read_side_effect(pm′)

(addr′, data(memory_read_list_nse(pm′)(addr′, size′)(s′)),

false) (state(memory_read_list_nse(pm′)(addr′, size′)(s′))))))

= data(memory_read(pm′)(a′)(s′))

Keeping (-4 1) and hiding *, Forward chaining on unchanged_memory_invariant_invariant,

This completes the proof of unchanged_memory_invariant_read_list.2.2.

Q.E.D.

C.123.39 Memory_Change_2.unchanged_memory_read_list_write_list_nse_TCC1

Terse proof for unchanged_memory_read_list_write_list_nse_TCC1.

unchanged_memory_read_list_write_list_nse_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

memory_read_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl))))

∧ states(s) ⊃ OK?[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening,

Using lemma memory_write_list_ok_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using unchanged_memory_write_invariant_transformer_invariant, matching in *,

This completes the proof of unchanged_memory_read_list_write_list_nse_TCC1.

Q.E.D.

C.123.40 Memory_Change_2.unchanged_memory_read_list_write_list_nse_TCC2

Terse proof for unchanged_memory_read_list_write_list_nse_TCC2.

unchanged_memory_read_list_write_list_nse_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

memory_read_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl))))

∧ states(s) ⊃ OK?[State, list[Byte]]

(memory_read_list_nse[State] (pm)(waddr, length[Byte](bl)) (state[State, Unit](memory_write_list_nse[State](pm)(waddr, bl)(s))))

Repeatedly Skolemizing and flattening, Using lemma memory_read_list_nse_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unchanged_memory_read_list_write_list_nse_TCC2.1:

{-1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(waddr′, length(bl′))))

{-2} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′, length(bl′))),

address_block(waddr′, length(bl′)))

{-3} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-4} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-5} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{-6} states′(s′)
{1} states′(state[State, Unit](memory_write_list_nse[State](pm′)(waddr′, bl′)(s′)))

{2} OK?[State, list[Byte]]

(memory_read_list_nse[State] (pm′)(waddr′, length[Byte](bl′)) (state[State, Unit]

(memory_write_list_nse[State](pm′)(waddr′, bl′)(s′))))

Hiding formulas: 2, Using lemma unchanged_memory_write_invariant_transformer_invariant, Simplifying, rewriting, and recording with decision procedures, Using lemma transformer_invariant_write_list_nse, Simplifying, rewriting, and recording with decision procedures, Using lemma memory_write_list_ok_nse, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: has_next_state Rewriting using expr_result_pred_next_state, matching in *,

This completes the proof of unchanged_memory_read_list_write_list_nse_TCC2.1.
unchanged_memory_read_list_write_list_nse_TCC2.2:

{-1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(waddr′, length(bl′))))

{-2} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′, length(bl′))),

address_block(waddr′, length(bl′)))

{-3} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-4} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-5} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{-6} states′(s′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

length[Byte](bl′))))

{2} OK?[State, list[Byte]]

(memory_read_list_nse[State] (pm′)(waddr′, length[Byte](bl′)) (state[State, Unit]

(memory_write_list_nse[State](pm′)(waddr′, bl′)(s′))))

Forward chaining on unchanged_memory_invariant_invariant,

This completes the proof of unchanged_memory_read_list_write_list_nse_TCC2.2.

Q.E.D.

C.123.41 Memory_Change_2.unchanged_memory_read_list_write_list_nse

Terse proof for unchanged_memory_read_list_write_list_nse.

unchanged_memory_read_list_write_list_nse:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte],

s: State): unchanged_memory_invariant?(pm, states,

memory_read_transformers(pm,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧ unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

memory_read_transformers(pm, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states,

memory_write_transformers(pm, ad-

dress_block(waddr, length(bl))))

∧ states(s) ⊃ data(memory_read_list_nse(pm)(waddr, length(bl))

(state(memory_write_list_nse(pm)(waddr, bl)(s))))

= bl

For the top quantifier in 1, we introduce Skolem constants: (pm′ states′ ), Inducting on bl on formula 1, we get 4 subgoals:

unchanged_memory_read_list_write_list_nse.1:

{1} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(null))),

address_block(waddr, length(null)))

∧ unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(null))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(null))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(null)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(null))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(null))

(state(memory_write_list_nse(pm′)(waddr, null)(s))))

= null

C Proof scripts

Repeatedly Skolemizing and flattening, Keeping 1 and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_nse.1.

unchanged_memory_read_list_write_list_nse.2:

{1} ∀ (cons1_var: Byte, cons2_var: list[Byte]):

(∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, address_block (waddr, length(cons2_var))),

address_block(waddr, length(cons2_var)))

∧ unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var)))

∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var))

(state(memory_write_list_nse(pm′) (waddr, cons2_var) (s))))

= cons2_var) ⊃ (∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′, address_block (waddr, length (cons

(cons1_var, cons2_var)))),

address_block(waddr,

length(cons(cons1_var, cons2_var))))

∧ unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr,

length(cons

(cons1_var, cons2_var))))

∧ changed_memory_invariant?(pm′, states′,

address_block(waddr,

length(cons(cons1_var, cons2_var))))

∧

transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧

transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr, length (cons

(cons1_var,

cons2_var)))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons(cons1_var, cons2_var)))

(state(memory_write_list_nse(pm′)

(waddr,

cons(cons1_var, cons2_var)) (s))))

= cons(cons1_var, cons2_var))

2505 C Proof scripts

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: address_block address_block_subset_1 ##! length sub-

set_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right memory_read_transformers_memory_read memory_read_transformers_mono memory_write_transformers_memory_write memory_write_transformers_mono transformer_invariant_mono_transformers expr_transformer_invariant_next_ok ok_result has_next_state state_expr_2_super ok_expr_2_super

Using lemma unchanged_memory_write_invariant_transformer_invariant, Simplifying, rewriting, and recording with decision procedures, Using lemma memory_write_list_ok_nse, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_read_list_write_list_nse_TCC2, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of memory_write_list_nse, Expanding the definition of memory_read_list_nse, Expanding the definition of memory_write_list_nse, Expanding the definition of memory_write_list_nse, Expanding the definition of memory_read_list_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Applying extensionality, we get 2 subgoals:

unchanged_memory_read_list_write_list_nse.2.1:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?[State, list[Byte]]

(OK(state(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write (pm′) (waddr′,

cons1_var′)

(s′)))))))),

cons(data(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′)))))),

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse (pm′) (waddr′ + 1, cons2_var′) (state

(memory_write(pm′) (waddr′, cons1_var′) (s′)))))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} data(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

2507

Hiding formulas: -2, -3, -4, -7, Using lemma expr_transformer_invariant_next_ok, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_transformers_ok_ok, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_unchanged_write_list_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

unchanged_memory_read_list_write_list_nse.2.1.1:

{-1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{-2} data(memory_read(pm′)

(waddr′)

(state(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

=

data(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} OK?(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-4} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-8} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} states′(s′)

{1} data(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′ Replacing using formula -2,

Keeping (-9 1) and hiding *,

Expanding the definition of changed_memory_invariant?,

Applying disjunctive simplification to flatten sequent,

Rewriting using -2, matching in *,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.1.1.
unchanged_memory_read_list_write_list_nse.2.1.2:

{-1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{-2} OK?(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-7} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-8} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} states′(s′)
{1} transformers_ok?(states′, singleton(expr_2_super(memory_read(pm′)(waddr′))))

{2} data(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

Keeping (-9 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.1.2.

unchanged_memory_read_list_write_list_nse.2.1.3:

{-1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{-2} OK?(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-7} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-8} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

Keeping (-10 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.1.3.

unchanged_memory_read_list_write_list_nse.2.1.4:

{-1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{-2} OK?(memory_read(pm′)

(waddr′)(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-7} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-8} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′ + 1,

length(cons2_var′))),

singleton(waddr′))

{2} data(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

= cons1_var′

Hiding formulas: 2,

Using lemma unchanged_memory_write_invariant_unchanged_memory_invariant,

Simplifying, rewriting, and recording with decision procedures,

Keeping 1 and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.1.4.

unchanged_memory_read_list_write_list_nse.2.2:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?[State, list[Byte]]

(OK(state(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write (pm′) (waddr′,

cons1_var′)

(s′)))))))),

cons(data(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′)))))),

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse (pm′) (waddr′ + 1, cons2_var′) (state

(memory_write(pm′) (waddr′, cons1_var′) (s′)))))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2512

C.123 Proofs for Memory_Change_2 (memory.pvs)

Hiding formulas: -4, Using lemma unchanged_memory_read_list_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

unchanged_memory_read_list_write_list_nse.2.2.1:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2514

C.123 Proofs for Memory_Change_2 (memory.pvs)

Replacing using formula -1, Rewriting using -7, matching in *, we get 6 subgoals:

unchanged_memory_read_list_write_list_nse.2.2.1.1:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′ + 1,

length(cons2_var′))),

address_block(waddr′ + 1, length(cons2_var′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2516

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-8 1) and hiding *, Using lemma unchanged_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.1.

unchanged_memory_read_list_write_list_nse.2.2.1.2:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′ + 1, length(cons2_var′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2518

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-9 1) and hiding *, Using lemma unchanged_memory_write_invariant_mono_addresses, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.2.

unchanged_memory_read_list_write_list_nse.2.2.1.3:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} changed_memory_invariant?(pm′, states′,

address_block(waddr′ + 1, length(cons2_var′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2520

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-10 1) and hiding *, Using lemma changed_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.3.

unchanged_memory_read_list_write_list_nse.2.2.1.4:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2522

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-11 1) and hiding *, Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.4.

unchanged_memory_read_list_write_list_nse.2.2.1.5:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2524

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-12 1) and hiding *, Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.5.

unchanged_memory_read_list_write_list_nse.2.2.1.6:

{-1} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

=

data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-4} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-5} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-7} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-8} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-9} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-11} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-13} states′(s′)
{1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′) (s′))))))

= cons2_var′

2526

C.123 Proofs for Memory_Change_2 (memory.pvs)

Using lemma expr_transformer_invariant_next_ok, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.1.6.

unchanged_memory_read_list_write_list_nse.2.2.2:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-7} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-8} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} states′(s′)

{1} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′)))))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2528

Hiding formulas: -2, -3, -6, 2,

Using lemma transformer_invariant_write_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

unchanged_memory_read_list_write_list_nse.2.2.2.1:

{-1} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′))

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-2} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-3} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-4} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-5} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-6} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-7} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-8} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-9} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-10} states′(s′)

{1} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′)(s′)))))

Rewriting using expr_result_pred_next_state, matching in *,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.2.1.

unchanged_memory_read_list_write_list_nse.2.2.2.2:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-5} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-6} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-7} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-8} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-9} states′(s′)
{1} states′(state(memory_write(pm′)(waddr′, cons1_var′)(s′)))

{2} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′)(s′)))))

Keeping (-3 1) and hiding *,

Using lemma expr_transformer_invariant_next_ok[State, Unit],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.2.2.

unchanged_memory_read_list_write_list_nse.2.2.2.3:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-3} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-4} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-5} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-6} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-7} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-8} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-9} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′) (waddr′, cons1_var′)(s′)))))

Keeping (-3 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.2.3.

unchanged_memory_read_list_write_list_nse.2.2.3:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-7} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-8} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′ + 1,

length(cons2_var′))))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2532

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-10 1) and hiding *, Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.3.

unchanged_memory_read_list_write_list_nse.2.2.4:

{-1} OK?(memory_write(pm′)(waddr′, cons1_var′)(s′))

{-2} OK?(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)

(waddr′, cons1_var′)(s′))))))

{-3} OK?(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′) (waddr′) (state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

{-4} OK?(memory_write_list_nse(pm′)(waddr′ + 1, cons2_var′)

(state(memory_write(pm′)(waddr′, cons1_var′)(s′))))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-6} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr,

length(cons2_var′))),

address_block(waddr, length(cons2_var′)))

∧

unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr, length(cons2_var′)))

∧

changed_memory_invariant?(pm′, states′, address_block(waddr, length(cons2_var′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(cons2_var′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr,

length(cons2_var′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(cons2_var′))

(state(memory_write_list_nse(pm′)(waddr, cons2_var′)

(s))))

= cons2_var′

{-7} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{-8} unchanged_memory_write_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-9} changed_memory_invariant?(pm′, states′,

address_block(waddr′, 1 + length(cons2_var′)))

{-10} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-11} transformers_ok?(states′,

memory_write_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))))

{-12} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′ + 1, length(cons2_var′))) ∪ singleton(expr_2_super (memory_read(pm′)(waddr′)))), address_block(waddr′, 1 + length(cons2_var′)))

{2} data(memory_read_list_nse(pm′)(waddr′ + 1, length(cons2_var′))

(state(memory_read(pm′)

(waddr′)

(state[State, Unit]

(memory_write_list_nse(pm′)

(waddr′ + 1, cons2_var′)

(state

(memory_write(pm′) (waddr′, cons1_var′) (s′))))))))

= cons2_var′

2534

Keeping (-7 1) and hiding *,

Rewriting using unchanged_memory_invariant_union_transformers, matching in *,

we get 2 subgoals:

unchanged_memory_read_list_write_list_nse.2.2.4.1:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′ + 1,

length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{2} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′ + 1, length(cons2_var′))) ∪ singleton(expr_2_super (memory_read(pm′)(waddr′)))), address_block(waddr′, 1 + length(cons2_var′)))

Hiding formulas: 2,

Using lemma unchanged_memory_invariant_mono,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.4.1.
unchanged_memory_read_list_write_list_nse.2.2.4.2:

{-1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

address_block(waddr′,

1 + length(cons2_var′))),

address_block(waddr′, 1 + length(cons2_var′)))

{1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(memory_read(pm′)(waddr′))), address_block(waddr′, 1 + length(cons2_var′)))

{2} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′ + 1, length(cons2_var′))) ∪ singleton(expr_2_super (memory_read(pm′)(waddr′)))), address_block(waddr′, 1 + length(cons2_var′)))

Hiding formulas: 2,

Using lemma unchanged_memory_invariant_mono,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list_nse.2.2.4.2.

unchanged_memory_read_list_write_list_nse.3:

{1} ∀ (bl: list[Byte], waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧ unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(bl))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl))))

∧ states′(s) ⊃ OK?[State, list[Byte]]

(memory_read_list_nse[State] (pm′)(waddr, length[Byte](bl)) (state[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s))))

{2} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

address_block(waddr, length(bl′)))

∧ unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(bl′))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(bl′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(bl′))

(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= bl′

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_read_list_write_list_nse_TCC2,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_nse.3.

unchanged_memory_read_list_write_list_nse.4:

{1} ∀ (bl: list[Byte], waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(bl))),

address_block(waddr, length(bl)))

∧ unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(bl))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(bl)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl))))

∧ states′(s) ⊃ OK?[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list_nse[State](pm′)(waddr, bl)(s))

{2} ∀ (waddr: Address, s: State):

unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr, length(bl′))),

address_block(waddr, length(bl′)))

∧ unchanged_memory_write_invariant?(pm′, states′, address_block(waddr, length(bl′))) ∧ changed_memory_invariant?(pm′, states′, address_block(waddr, length(bl′))) ∧ transformers_ok?(states′,

memory_read_transformers(pm′, ad-

dress_block(waddr, length(bl′)))) ∧ transformers_ok?(states′,

memory_write_transformers(pm′, ad-

dress_block(waddr, length(bl′))))

∧ states′(s) ⊃ data(memory_read_list_nse(pm′)(waddr, length(bl′))

(state(memory_write_list_nse(pm′)(waddr, bl′)(s))))

= bl′

Hiding formulas: 2,

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_read_list_write_list_nse_TCC1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_nse.4.

Q.E.D.

C.123.42 Memory_Change_2.unchanged_memory_read_list_write_list_TCC1

Terse proof for unchanged_memory_read_list_write_list_TCC1.
unchanged_memory_read_list_write_list_TCC1:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states, (memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ (memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl))))), address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

(memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_read_side_effect(pm))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, Unit](memory_write_list[State](pm)(waddr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm)(waddr, bl)(s))

Repeatedly Skolemizing and flattening, Using lemma memory_write_list_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Installing automatic rewrites from: subset_equal union_subset1 union_subset3 union_left union_right

subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right transformer_invariant_union_transformers unchanged_memory_write_invariant_transformer_invariant

Rewriting using transformer_invariant_union_transformers, matching in *, Hiding formulas: -1, 2, Forward chaining on unchanged_memory_invariant_invariant, Hiding formulas: -2, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_TCC1.

Q.E.D.

C.123.43 Memory_Change_2.unchanged_memory_read_list_write_list_TCC2

Terse proof for unchanged_memory_read_list_write_list_TCC2.

unchanged_memory_read_list_write_list_TCC2:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states, (memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ (memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl))))), address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

(memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_read_side_effect(pm))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ OK?[State, list[Byte]]

(memory_read_list[State] (pm)(waddr, length[Byte](bl)) (state[State, Unit](memory_write_list[State](pm)(waddr, bl)(s))))

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: subset_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right transformer_invariant_union_transformers has_next_state memory_write_side_effect_super_transformers_memory_write_side_effect

Forward chaining on unchanged_memory_invariant_invariant,

Using lemma memory_read_list_ok,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_read_list_write_list_TCC2.1:

{-1} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-2} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-3} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-4} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-5} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-6} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-7} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-8} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-9} states′(s′)
{1} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

{2} OK?[State, list[Byte]]

(memory_read_list[State] (pm′)(waddr′, length[Byte](bl′)) (state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′))))

Hiding formulas: 2, Using lemma unchanged_memory_write_invariant_transformer_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_write_list_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

unchanged_memory_read_list_write_list_TCC2.1.1:

{-1} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-2} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-3} states′(s′)
{-4} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))
{-5} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-11} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{1} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

Using lemma transformer_invariant_write_list,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_read_list_write_list_TCC2.1.1.1:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)
{-3} result_pred(states′)(expr_2_super(memory_write_list(pm′)(waddr′, bl′))(s′))

{-4} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-5} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))
{-6} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-7} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-10} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-11} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-12} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{1} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

Rewriting using expr_result_pred_next_state, matching in *,

This completes the proof of unchanged_memory_read_list_write_list_TCC2.1.1.1.

unchanged_memory_read_list_write_list_TCC2.1.1.2:

{-1} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-2} states′(s′)

{-3} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-4} OK?(memory_write_list(pm′)(waddr′, bl′)(s′))
{-5} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-6} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-11} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ {expr_2_super (memory_write_side_effect (pm′)(waddr′, bl′, false))}))

{2} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

Rewriting using add_as_union, matching in *,

Rewriting using transformer_invariant_union_transformers, matching in *,

Keeping (-8 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_TCC2.1.1.2.

unchanged_memory_read_list_write_list_TCC2.1.2:

{-1} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-2} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-3} states′(s′)
{-4} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-5} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {-6} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-7} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-8} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-9} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-10} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{1} transformer_invariant?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{2} states′(state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′)))

Keeping (-5 -7 1) and hiding *,

Rewriting using transformer_invariant_union_transformers, matching in *,

Hiding formulas: -1, 2,

Using lemma transformer_invariant_mono_transformers,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_TCC2.1.2.

unchanged_memory_read_list_write_list_TCC2.2:

{-1} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-2} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-3} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-4} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-5} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-6} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-7} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-8} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-9} states′(s′)

{1} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length [Byte](bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length [Byte](bl′)))))

{2} OK?[State, list[Byte]]

(memory_read_list[State] (pm′)(waddr′, length[Byte](bl′)) (state[State, Unit](memory_write_list[State](pm′)(waddr′, bl′)(s′))))

Keeping (-2 1) and hiding *, Rewriting using transformer_invariant_union_transformers, matching in *, we get 2 subgoals:

unchanged_memory_read_list_write_list_TCC2.2.1:

{-1} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{1} transformer_invariant?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

length[Byte](bl′))))

{2} transformer_invariant?(states′, (memory_read_transformers (pm′, address_block(waddr′, length [Byte](bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length [Byte](bl′)))))

Hiding formulas: 2, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_TCC2.2.1.
unchanged_memory_read_list_write_list_TCC2.2.2:

{-1} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{1} transformer_invariant?(states′,

memory_read_side_effect_super_transformers(pm′,

ad-

dress_block

(waddr′,

length[Byte](bl′))))

{2} transformer_invariant?(states′, (memory_read_transformers (pm′, address_block(waddr′, length [Byte](bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length [Byte](bl′)))))

Hiding formulas: 2, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of unchanged_memory_read_list_write_list_TCC2.2.2.

Q.E.D.

C.123.44 Memory_Change_2.unchanged_memory_read_list_write_list

Terse proof for unchanged_memory_read_list_write_list.
unchanged_memory_read_list_write_list:

{1} ∀ (pm: Memory_struct[State], states: PRED[State], waddr: Ad-

dress, bl: list[Byte], s: State):

unchanged_memory_invariant?(pm, states, (memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ (memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl))))), address_block(waddr, length(bl)))

∧

unchanged_memory_write_invariant?(pm, states, address_block(waddr, length(bl))) ∧ changed_memory_invariant?(pm, states, address_block(waddr, length(bl))) ∧ transformers_ok?(states,

(memory_read_transformers (pm, address_block(waddr, length(bl))) ∪ memory_read_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

transformers_ok?(states,

(memory_write_transformers (pm, address_block(waddr, length(bl))) ∪ memory_write_side_effect_super_transformers (pm, address_block(waddr, length(bl)))))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_read_side_effect(pm))

∧

side_effect_content_unchanged(address_block(waddr, length(bl)), states,

memory_write_side_effect(pm))

∧ states(s) ⊃ data(memory_read_list(pm)(waddr, length(bl))

(state(memory_write_list(pm)(waddr, bl)(s))))

= bl

Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_read_list_write_list_TCC2, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: address_block address_block_subset_1 ##! length sub-

set_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right memory_read_transformers_memory_read memory_read_transformers_mono memory_write_transformers_memory_write memory_write_transformers_mono transformer_invariant_mono_transformers expr_transformer_invariant_next_ok ok_result has_next_state state_expr_2_super ok_expr_2_super memory_write_side_effect_super_transformers_memory_write_side_effect memory_read_side_effect_super_transformers_memory_read_side_effect

Using lemma expr_transformers_ok_ok, Simplifying, rewriting, and recording with decision procedures, Forward chaining on unchanged_memory_invariant_invariant, Using lemma expr_transformer_invariant_next_ok, Simplifying, rewriting, and recording with decision procedures,

C Proof scripts

Expanding the definition of memory_read_list, Expanding the definition of memory_write_list, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma side_effect_content_unchanged_content, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Using lemma unchanged_memory_read_list_write_list_nse, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

unchanged_memory_read_list_write_list.1:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-4} data(memory_read_list_nse(pm′)(waddr′, length(bl′))

(state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

= bl′
{-5} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-6} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-7} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-8} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-9} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

{-10} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-11} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-12} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-13} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-14} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-15} states′(s′)

{1} data(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

= bl′

2547

Replacing using formula -4,

Using lemma side_effect_content_unchanged_content,

Simplifying, rewriting, and recording with decision procedures,

Hiding formulas: -4, -5, -9, -13, -14, 2,

Using lemma memory_read_list_nse_next_length,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

unchanged_memory_read_list_write_list.1.1:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} states′(s′)

{1} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′)))))

{2} states′(state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))))

Hiding formulas: 2,

Using lemma transformer_invariant_write_list_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_read_list_write_list.1.1.1:

{-1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-2} result_pred(states′)

(expr_2_super(memory_write_list_nse(pm′)(waddr′, bl′))

(state(memory_write_side_effect(pm′)

(waddr′, bl′, false)(s′))))

{-3} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-4} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-8} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-9} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-11} states′(s′)

{1} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′)))))

Using lemma expr_result_pred_next_state[State, Unit],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Hiding formulas: -1, -7, 2,

Using lemma memory_write_list_ok_nse,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

unchanged_memory_read_list_write_list.1.1.1.1:

{-1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-2} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{2} has_next_state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′))))

Keeping (-8 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list.1.1.1.1.
unchanged_memory_read_list_write_list.1.1.1.2:

{-1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-2} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-7} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-8} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {2} has_next_state(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′))))

Forward chaining on unchanged_memory_write_invariant_transformer_invariant,

This completes the proof of unchanged_memory_read_list_write_list.1.1.1.2.

unchanged_memory_read_list_write_list.1.1.2:

{-1} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-2} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} states′(s′)

{1} transformer_invariant?(states′,

memory_write_transformers(pm′,

ad-

dress_block(waddr′, length(bl′)))) {2} states′(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false)(s′)))))

Forward chaining on unchanged_memory_write_invariant_transformer_invariant,

This completes the proof of unchanged_memory_read_list_write_list.1.1.2.

unchanged_memory_read_list_write_list.1.2:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′,

address_block(waddr′, length[Byte](bl′))))

{2} states′(state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))))

Keeping (-8 1) and hiding *,

Using lemma transformers_ok_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list.1.2.

unchanged_memory_read_list_write_list.1.3:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))

{-4} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-5} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-6} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-7} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-8} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-9} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-10} states′(s′)

{1} transformer_invariant?(states′,

memory_read_transformers(pm′,

address_block(waddr′,

length[Byte](bl′))))

{2} states′(state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))))

Keeping (-4 1) and hiding *,

Using lemma transformer_invariant_mono_transformers,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list.1.3.

unchanged_memory_read_list_write_list.2:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-8} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-11} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-12} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-13} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-14} states′(s′)

{1} transformers_ok?(states′,

memory_write_transformers(pm′, address_block(waddr′, length(bl′))))

{2} data(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

= bl′

2554

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-11 1) and hiding *, Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list.2.

unchanged_memory_read_list_write_list.3:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-8} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-11} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-12} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-13} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-14} states′(s′)

{1} transformers_ok?(states′,

memory_read_transformers(pm′, address_block(waddr′, length(bl′))))

{2} data(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

= bl′

2556

C.123 Proofs for Memory_Change_2 (memory.pvs)

Keeping (-10 1) and hiding *, Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list.3.

unchanged_memory_read_list_write_list.4:

{-1} unchanged_memory_write_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-2} changed_memory_invariant?(pm′, states′, address_block(waddr′, length(bl′)))
{-3} states′(state(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)))
{-4} data(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′)) = bl′

{-5} transformer_invariant?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))))

{-6} OK?(memory_write_side_effect(pm′)(waddr′, bl′, false)(s′))

{-7} OK?(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′)(waddr′, bl′)

(state(memory_write_side_effect(pm′) (waddr′, bl′, false) (s′))))))

{-8} OK?[State, list[Byte]]

(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

{-9} unchanged_memory_invariant?(pm′, states′, (memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ (memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′))))), address_block(waddr′, length(bl′)))

{-10} transformers_ok?(states′,

(memory_read_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_read_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-11} transformers_ok?(states′,

(memory_write_transformers (pm′, address_block(waddr′, length(bl′))) ∪ memory_write_side_effect_super_transformers (pm′, address_block(waddr′, length(bl′)))))

{-12} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_read_side_effect(pm′))

{-13} side_effect_content_unchanged(address_block(waddr′, length(bl′)), states′,

memory_write_side_effect(pm′))

{-14} states′(s′)

{1} unchanged_memory_invariant?(pm′, states′,

memory_read_transformers(pm′,

ad-

dress_block(waddr′, length(bl′))),

address_block(waddr′, length(bl′)))

{2} data(memory_read_side_effect(pm′)

(waddr′,

data(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′)))))),

false) (state(memory_read_list_nse(pm′)(waddr′, length[Byte](bl′))

(state[State, Unit]

(memory_write_list_nse(pm′) (waddr′, bl′) (state

(memory_write_side_effect (pm′) (waddr′, bl′, false) (s′))))))))

= bl′

2558

Keeping (-9 1) and hiding *, Using lemma unchanged_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of unchanged_memory_read_list_write_list.4.

Q.E.D.

C.124 Proofs for Memory_Change_3 (memory.pvs)

C.124.1 Memory_Change_3.expr_unchanged_memory_invariant_unchanged_TCC1

Terse proof for expr_unchanged_memory_invariant_unchanged_TCC1.
expr_unchanged_memory_invariant_unchanged_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → ExprResult[State, Data]], a: Address): OK?(memory_read(pm)(a)(s)) ∧ OK?(q(s)) ∧ addresses(a) ∧ transformers(expr_2_super(q)) ∧ states(s) ∧ unchanged_memory_invariant?(pm, states, transformers, addresses) ⊃ OK?[State, Data](q(s)) ∨ Exception?[State, Data](q(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_unchanged_memory_invariant_unchanged_TCC1.

Q.E.D.

C.124.2 Memory_Change_3.expr_unchanged_memory_invariant_unchanged

Terse proof for expr_unchanged_memory_invariant_unchanged.
expr_unchanged_memory_invariant_unchanged:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → ExprResult[State, Data]], a: Address):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(expr_2_super(q)) ∧ addresses(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm)(a)(s)) ∧ OK?(memory_read(pm)(a)(state(q(s))))

⊃ data(memory_read(pm)(a)(state(q(s)))) = data(memory_read(pm)(a)(s))

Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_invariant_unchanged, Installing automatic rewrites from: state_expr_2_super ok_expr_2_super has_next_state Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of expr_unchanged_memory_invariant_unchanged.

Q.E.D.

C.124.3 Memory_Change_3.expr_unchanged_memory_invariant_next_ok_TCC1

Terse proof for expr_unchanged_memory_invariant_next_ok_TCC1.
expr_unchanged_memory_invariant_next_ok_TCC1:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → ExprResult[State, Data]]):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(expr_2_super(q)) ∧ has_next_state(q(s)) ⊃ OK?[State, Data](q(s)) ∨ Exception?[State, Data](q(s))

Repeatedly Skolemizing and flattening, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of expr_unchanged_memory_invariant_next_ok_TCC1.

Q.E.D.

C.124.4 Memory_Change_3.expr_unchanged_memory_invariant_next_ok

Terse proof for expr_unchanged_memory_invariant_next_ok.
expr_unchanged_memory_invariant_next_ok:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers: PRED[[State → SuperResult[State]]], s: State, q: [State → ExprResult[State, Data]]):

unchanged_memory_invariant?(pm, states, transformers, addresses) ∧ states(s) ∧ transformers(expr_2_super(q)) ∧ has_next_state(q(s)) ⊃ states(state(q(s)))

Repeatedly Skolemizing and flattening, Using lemma unchanged_memory_invariant_next_ok[State], Installing automatic rewrites from: has_next_state_expr_2_super state_expr_2_super Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of expr_unchanged_memory_invariant_next_ok.

Q.E.D.

C.125 Proofs for Memory_Change_4 (memory.pvs)

C.125.1 Memory_Change_4.expr_unchanged_memory_invariant_composition

Terse proof for expr_unchanged_memory_invariant_composition.

expr_unchanged_memory_invariant_composition:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers_1, transformers_2: PRED[[State → SuperResult[State]]], q_{1}: [State → ExprResult[State, Data1]], q_{2}: [State → ExprRe-

sult[State, Data2]]): transformers_1(expr_2_super(q_{1})) ∧ transformers_2(expr_2_super(q_{2})) ∧ transformers_ok?(states, memory_read_transformers(pm, addresses)) ∧ unchanged_memory_invariant?(pm, states, transformers_1, addresses) ∧ unchanged_memory_invariant?(pm, states, transformers_2, addresses)

⊃ unchanged_memory_invariant?(pm, states, singleton(expr_2_super(q_{1} ## q_{2})), addresses)

Expanding the definition of unchanged_memory_invariant?,

Repeatedly Skolemizing and flattening,

Case splitting on transformer_invariant?(states!1, singleton(expr_2_super(q1!1 ## q2!1))),

we get 2 subgoals:

expr_unchanged_memory_invariant_composition.1:

{-1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)

{-6} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-7} transformer_invariant?(states′, transformers′′)

{-8} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2}))) ∧ (∀ (s: State, q: [State → SuperResult[State]], a: Address):

states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Expanding the definition of singleton,

Replacing using formula -10,

Instantiating the top quantifier in -6 with the terms: (s!1 expr_2_super(q1!1) a!1),

Installing automatic rewrites from: ok_expr_2_super state_expr_2_super has_next_state has_next_state_expr_2_super ##

Instantiating the top quantifier in -8 with the terms: (state(expr_2_super(q1!1)(s!1)) expr_2_super(q2!1) a!1),

we get 2 subgoals:

expr_unchanged_memory_invariant_composition.1.1:

{-1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)

{-6} states′(s′) ∧ transformers′(expr_2_super(q′_{1})) ∧ addresses′(a′) ∧ OK?(expr_2_super(q′_{1})(s′)) ∧ OK?(memory_read(pm′)(a′)(s′)) ∧ OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′))))

⊃

data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′)))) = data(memory_read(pm′)(a′)(s′))

{-7} transformer_invariant?(states′, transformers′′)

{-8} states′(state(expr_2_super(q′_{1})(s′))) ∧ transformers′′(expr_2_super(q′_{2})) ∧ addresses′(a′) ∧ OK?(expr_2_super(q′_{2})(state(expr_2_super(q′_{1})(s′)))) ∧ OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′)))) ∧ OK?(memory_read(pm′)

(a′)(state(expr_2_super(q′_{2})(state(expr_2_super(q′_{1})(s′))))))

⊃

data(memory_read(pm′)

(a′)(state(expr_2_super(q′_{2})(state(expr_2_super(q′_{1})(s′))))))

= data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′))))

{-9} states′(s′)
{-10} q′ = expr_2_super(q′_{1} ## q′_{2})
{-11} addresses′(a′)
{-12} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-13} OK?(memory_read(pm′)(a′)(s′))
{-14} OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′))))

{1} data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′)))) = data(memory_read(pm′)(a′)(s′))

Expanding the definition of ##,

Expanding the definition of ##,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

expr_unchanged_memory_invariant_composition.1.1.1:

{-1} transformer_invariant?(states′,

singleton(expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Excep-

tion(ex_type, state):

Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)))

{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′)
{-7} addresses′(a′)
{-8} OK?(memory_read(pm′)(a′)(s′))

{-9} data(memory_read(pm′)(a′)(state(q′_{1}(s′)))) =

data(memory_read(pm′)(a′)(s′))

{-10} transformer_invariant?(states′, transformers′′)

{-11} q′ =

expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

{-12} OK?(q′_{1}(s′))
{-13} OK?(q′_{2}(state(q′_{1}(s′))))
{-14} OK?(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′))))))
{1} states′(state(q′_{1}(s′)))

{2} data(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′)))))) = data(memory_read(pm′)(a′)(s′))

Rewriting using expr_transformer_invariant_next_ok, matching in * where s gets s!1, q gets q1!1, states gets states!1, transformers gets transformers!1,

This completes the proof of expr_unchanged_memory_invariant_composition.1.1.1.

expr_unchanged_memory_invariant_composition.1.1.2:

{-1} transformer_invariant?(states′,

singleton(expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Excep-

tion(ex_type, state):

Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)))

{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′)
{-7} addresses′(a′)
{-8} OK?(memory_read(pm′)(a′)(s′))
{-9} transformer_invariant?(states′, transformers′′)

{-10} q′ =

expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

{-11} OK?(q′_{1}(s′))
{-12} OK?(q′_{2}(state(q′_{1}(s′))))
{-13} OK?(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′))))))
{1} OK?(memory_read(pm′)(a′)(state(q′_{1}(s′))))

{2} data(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′)))))) = data(memory_read(pm′)(a′)(s′))

Rewriting using expr_transformers_ok_ok, matching in * where s gets state(q1!1(s!1)), q gets memory_read(pm!1)(a!1), states gets states!1, transformers gets memory_read_transformers(pm!1, addresses!1),

we get 2 subgoals:

expr_unchanged_memory_invariant_composition.1.1.2.1:

{-1} transformer_invariant?(states′,

singleton(expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Excep-

tion(ex_type, state):

Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)))

{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′)
{-7} addresses′(a′)
{-8} OK?(memory_read(pm′)(a′)(s′))
{-9} transformer_invariant?(states′, transformers′′)

{-10} q′ =

expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

{-11} OK?(q′_{1}(s′))
{-12} OK?(q′_{2}(state(q′_{1}(s′))))
{-13} OK?(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′))))))
{1} states′(state(q′_{1}(s′)))
{2} OK?(memory_read(pm′)(a′)(state(q′_{1}(s′))))

{3} data(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′)))))) = data(memory_read(pm′)(a′)(s′))

Rewriting using expr_transformer_invariant_next_ok, matching in * where s gets s!1, q gets q1!1, states gets states!1, transformers gets transformers!1,

This completes the proof of expr_unchanged_memory_invariant_composition.1.1.2.1.

expr_unchanged_memory_invariant_composition.1.1.2.2:

{-1} transformer_invariant?(states′,

singleton(expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Excep-

tion(ex_type, state):

Excep-

tion(ex_type, state), Fatal: Fatal, Hang: Hang endcases)))

{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)
{-6} states′(s′)
{-7} addresses′(a′)
{-8} OK?(memory_read(pm′)(a′)(s′))
{-9} transformer_invariant?(states′, transformers′′)

{-10} q′ =

expr_2_super(λ (s: State):

cases q′_{1}(s) of OK(state, data): q′_{2}(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

{-11} OK?(q′_{1}(s′))
{-12} OK?(q′_{2}(state(q′_{1}(s′))))
{-13} OK?(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′))))))
{1} memory_read_transformers(pm′, addresses′)(expr_2_super(memory_read(pm′)(a′)))
{2} OK?(memory_read(pm′)(a′)(state(q′_{1}(s′))))

{3} data(memory_read(pm′)(a′)(state(q′_{2}(state(q′_{1}(s′)))))) = data(memory_read(pm′)(a′)(s′))

Rewriting using memory_read_transformers_memory_read, matching in *,

This completes the proof of expr_unchanged_memory_invariant_composition.1.1.2.2.

expr_unchanged_memory_invariant_composition.1.2:

{-1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{-2} transformers′(expr_2_super(q′_{1}))
{-3} transformers′′(expr_2_super(q′_{2}))
{-4} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-5} transformer_invariant?(states′, transformers′)

{-6} states′(s′) ∧ transformers′(expr_2_super(q′_{1})) ∧ addresses′(a′) ∧ OK?(expr_2_super(q′_{1})(s′)) ∧ OK?(memory_read(pm′)(a′)(s′)) ∧ OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′))))

⊃

data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1})(s′)))) = data(memory_read(pm′)(a′)(s′))

{-7} transformer_invariant?(states′, transformers′′)
{-8} states′(s′)
{-9} q′ = expr_2_super(q′_{1} ## q′_{2})
{-10} addresses′(a′)
{-11} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-12} OK?(memory_read(pm′)(a′)(s′))
{-13} OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′))))
{1} OK?(q′_{1}(s′)) ∨ abnormal?[State](expr_2_super[State, Data1](q′_{1})(s′))

{2} data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′)))) = data(memory_read(pm′)(a′)(s′))

Keeping (-11 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_unchanged_memory_invariant_composition.1.2.

expr_unchanged_memory_invariant_composition.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers′′(expr_2_super(q′_{2}))
{-3} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, transformers′)

{-5} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-6} transformer_invariant?(states′, transformers′′)

{-7} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2}))) ∧

(∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s)))

Rewriting using expr_composition_transformer_invariant, matching in *,

we get 2 subgoals:

expr_unchanged_memory_invariant_composition.2.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers′′(expr_2_super(q′_{2}))
{-3} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, transformers′)

{-5} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-6} transformer_invariant?(states′, transformers′′)

{-7} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1})))
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

{3} false ∧

(∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s)))

Keeping (-1 -3 1) and hiding *,

Rewriting using transformer_invariant_mono_transformers, matching in * where transformers_1 gets singleton(expr_2_super(q1!1)), transformers_2 gets transformers!1,

Hiding formulas: (-2 2),

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_unchanged_memory_invariant_composition.2.1.

expr_unchanged_memory_invariant_composition.2.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers′′(expr_2_super(q′_{2}))
{-3} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-4} transformer_invariant?(states′, transformers′)

{-5} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{-6} transformer_invariant?(states′, transformers′′)

{-7} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ transformers′′(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{2})))
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))
{3} false ∧

(∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s)))

Keeping (-2 -5 1) and hiding *, Rewriting using transformer_invariant_mono_transformers, matching in * where transformers_1 gets

singleton(expr_2_super(q2!1)), transformers_2 gets transformers!2, Hiding formulas: (-2 2), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_unchanged_memory_invariant_composition.2.2.

Q.E.D.

C.125.2 Memory_Change_4.fexpr_unchanged_memory_invariant_composition

Terse proof for fexpr_unchanged_memory_invariant_composition.

fexpr_unchanged_memory_invariant_composition:

{1} ∀ (addresses: PRED[Address], pm: Memory_struct[State], states: PRED[State], transformers_1: PRED[[State → SuperResult[State]]], q_{1}: [State → ExprResult[State, Data1]], q_{2}: [Data1 → [State → ExprResult[State, Data2]]], P: PRED[Data1]):

(transformers_1(expr_2_super(q_{1})) ∧ transformers_ok?(states, memory_read_transformers(pm, addresses)) ∧ unchanged_memory_invariant?(pm, states, transformers_1, addresses) ∧ (∀ (s: (states)): OK?(q_{1}(s)) ⊃ P (data(q_{1}(s)))) ∧ (∀ (d: (P)):

unchanged_memory_invariant?(pm, states, singleton(expr_2_super(q_{2}(d))), addresses)))

⊃ unchanged_memory_invariant?(pm, states, singleton(expr_2_super(q_{1} ## q_{2})), addresses)

Expanding the definition of unchanged_memory_invariant?,

Repeatedly Skolemizing and flattening,

Applying propositional simplification,

we get 2 subgoals:

fexpr_unchanged_memory_invariant_composition.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Rewriting using fexpr_composition_transformer_invariant[State, Data1, Data2], matching in * where states gets states!1, P gets P!1,

we get 2 subgoals:

fexpr_unchanged_memory_invariant_composition.1.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} transformer_invariant?(states′, singleton(expr_2_super(q′_{1})))
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Rewriting using transformer_invariant_mono_transformers[State], matching in * where transformers_1 gets singleton(expr_2_super(q1!1)), transformers_2 gets transformers!1,

we get 2 subgoals:

fexpr_unchanged_memory_invariant_composition.1.1.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} (singleton(expr_2_super (q′_{1})) ⊆ transformers′)
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1})))
{3} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Keeping (-1 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of fexpr_unchanged_memory_invariant_composition.1.1.1.
fexpr_unchanged_memory_invariant_composition.1.1.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} transformer_invariant?(states′, transformers′)
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1})))
{3} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Expanding the definition of unchanged_memory_invariant?, which is trivially true.

This completes the proof of fexpr_unchanged_memory_invariant_composition.1.1.2.
fexpr_unchanged_memory_invariant_composition.1.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} ∀ (d: (P′)): transformer_invariant?(states′, singleton(expr_2_super(q′_{2}(d))))
{2} transformer_invariant?(states′, singleton(expr_2_super(q′_{1} ## q′_{2})))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of unchanged_memory_invariant?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of fexpr_unchanged_memory_invariant_composition.1.2.

fexpr_unchanged_memory_invariant_composition.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-4} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-5} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address): states′(s) ∧ singleton(expr_2_super(q′_{1} ## q′_{2}))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′)(a)(s)) ∧ OK?(memory_read(pm′)(a)(state(q(s))))

⊃

data(memory_read(pm′)(a)(state(q(s)))) = data(memory_read(pm′)(a)(s))

Repeatedly Skolemizing and flattening,

Expanding the definition of singleton,

Replacing using formula -2,

Rewriting using state_expr_2_super, matching in *,

we get 2 subgoals:

fexpr_unchanged_memory_invariant_composition.2.1:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2})(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{-11} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2})(s′)))) = data(memory_read(pm′)(a′)(s′))

Rewriting using comp_eval_if_ok_fexpr, matching in *,

we get 2 subgoals:

C.125 Proofs for Memory_Change_4 (memory.pvs)

fexpr_unchanged_memory_invariant_composition.2.1.1:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{-11} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Instantiating the top quantifier in -11 with the terms: (data(q1!1(s!1))), we get 2 subgoals:

fexpr_unchanged_memory_invariant_composition.2.1.1.1:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{-11} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{1} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Using lemma expr_unchanged_memory_invariant_composition, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

fexpr_unchanged_memory_invariant_composition.2.1.1.1.1:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)

{-4} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{-5} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{1} ## q′_{2}(data(q′_{1}(s′))))), addresses′)

{-6} states′(s′)
{-7} q′ = expr_2_super(q′_{1} ## q′_{2})
{-8} addresses′(a′)
{-9} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-10} OK?(memory_read(pm′)(a′)(s′))
{-11} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-12} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{1} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) = data(memory_read(pm′)(a′)(s′))

Using lemma expr_unchanged_memory_invariant_unchanged,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

fexpr_unchanged_memory_invariant_composition.2.1.1.1.1.1:

{-1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{1} ## q′_{2}(data(q′_{1}(s′))))), addresses′)

{-2} states′(s′)
{-3} addresses′(a′)
{-4} OK?(memory_read(pm′)(a′)(s′))
{-5} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-6} transformers′(expr_2_super(q′_{1}))
{-7} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-8} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)

{-9} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{-10} q′ = expr_2_super(q′_{1} ## q′_{2})
{-11} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-12} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{1} OK?((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))

{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) = data(memory_read(pm′)(a′)(s′))

Keeping (-11 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.1.1.1.1.

C.125 Proofs for Memory_Change_4 (memory.pvs)

fexpr_unchanged_memory_invariant_composition.2.1.1.1.1.2:

{-1} unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{1} ## q′_{2}(data(q′_{1}(s′))))), addresses′)

{-2} states′(s′)
{-3} addresses′(a′)
{-4} OK?(memory_read(pm′)(a′)(s′))
{-5} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-6} transformers′(expr_2_super(q′_{1}))
{-7} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-8} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)

{-9} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{-10} q′ = expr_2_super(q′_{1} ## q′_{2})
{-11} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-12} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{1} singleton(expr_2_super(q′_{1} ## q′_{2}(data(q′_{1}(s′)))))

(expr_2_super((q′_{1} ## q′_{2}(data(q′_{1}(s′))))))

{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Expanding the definition of singleton, which is trivially true.

This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.1.1.1.2.
fexpr_unchanged_memory_invariant_composition.2.1.1.1.2:

{-1} transformers′(expr_2_super(q′_{1}))
{-2} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-3} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)

{-4} unchanged_memory_invariant?(pm′, states′,

singleton(expr_2_super(q′_{2}(data(q′_{1}(s′))))), addresses′)

{-5} states′(s′)
{-6} q′ = expr_2_super(q′_{1} ## q′_{2})
{-7} addresses′(a′)
{-8} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-9} OK?(memory_read(pm′)(a′)(s′))
{-10} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-11} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{1} singleton(expr_2_super(q′_{2}(data(q′_{1}(s′)))))

(expr_2_super(q′_{2}(data(q′_{1}(s′)))))

{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Expanding the definition of singleton, which is trivially true.

This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.1.1.2.

C Proof scripts

fexpr_unchanged_memory_invariant_composition.2.1.1.2:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))
{1} P′(data[State, Data1](q′_{1}(s′)))

{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2}(data(q′_{1}(s′))))(s′)))) =

data(memory_read(pm′)(a′)(s′))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-4 3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.1.2.
fexpr_unchanged_memory_invariant_composition.2.1.2:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2})(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{-11} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} OK?(q′_{1}(s′))

{2} data(memory_read(pm′)(a′)(state((q′_{1} ## q′_{2})(s′)))) =

data(memory_read(pm′)(a′)(s′))

Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of fexpr_unchanged_memory_invariant_composition.2.1.2.

C.126 Proofs for Memory_Physical_Memory (physical_memory.pvs)

fexpr_unchanged_memory_invariant_composition.2.2:

{-1} states′(s′)
{-2} q′ = expr_2_super(q′_{1} ## q′_{2})
{-3} addresses′(a′)
{-4} OK?(expr_2_super(q′_{1} ## q′_{2})(s′))
{-5} OK?(memory_read(pm′)(a′)(s′))
{-6} OK?(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′))))
{-7} transformers′(expr_2_super(q′_{1}))
{-8} transformers_ok?(states′, memory_read_transformers(pm′, addresses′))
{-9} unchanged_memory_invariant?(pm′, states′, transformers′, addresses′)
{-10} ∀ (s: (states′)): OK?(q′_{1}(s)) ⊃ P′(data(q′_{1}(s)))

{-11} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′, states′, singleton(expr_2_super(q′_{2}(d))), addresses′)

{1} has_next_state((q′_{1} ## q′_{2})(s′))

{2} data(memory_read(pm′)(a′)(state(expr_2_super(q′_{1} ## q′_{2})(s′)))) =

data(memory_read(pm′)(a′)(s′))

Rewriting using ok_expr_2_super, matching in *, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of fexpr_unchanged_memory_invariant_composition.2.2.

Q.E.D.

C.126 Proofs for Memory_Physical_Memory (physical_memory.pvs)

This theory contains no provable formal statements.

C.127 Proofs for Memory_access (result.pvs)

This theory contains no provable formal statements.

C.128 Proofs for Memory_access_adt (Memory_access_adt.pvs)

This theory contains no provable formal statements.

C.129 Proofs for Memory_access_adt_reduce (Memory_access_adt.pvs)

This theory contains no provable formal statements.

C.130 Proofs for Memory_access_util (result.pvs)

This theory contains no provable formal statements.

C.131 Proofs for Memory_privilege (result.pvs)

This theory contains no provable formal statements.

C.132 Proofs for Memory_privilege_adt (Memory_privilege_adt.pvs)

This theory contains no provable formal statements.

C.133 Proofs for Memory_privilege_adt_reduce (Memory_privilege_adt.pvs)

This theory contains no provable formal statements.

C.134 Proofs for Memory_privilege_util (result.pvs)

C.134.1 Memory_privilege_util.bool_to_memory_privilege_iso

Terse proof for bool_to_memory_privilege_iso.
bool_to_memory_privilege_iso:

{1} ∀ (ar: Memory_privilege): bool_to_memory_privilege(memory_privilege_to_bool(ar)) = ar

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of bool_to_memory_privilege_iso.

Q.E.D.

C.135 Proofs for Min_Max_Extension (vfiasco-prelude.pvs)

C.135.1 Min_Max_Extension.max_stable_under_extension_TCC1

Terse proof for max_stable_under_extension_TCC1.
max_stable_under_extension_TCC1:

{1} ∀ (P: non_empty_finite_set[S]): ¬ empty?[T ](extend[T, S, bool, false](P))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of max_stable_under_extension_TCC1.

Q.E.D.

C.135.2 Min_Max_Extension.max_stable_under_extension

Terse proof for max_stable_under_extension.

C.135 Proofs for Min_Max_Extension (vfiasco-prelude.pvs)

max_stable_under_extension:

{1} ∀ (P: non_empty_finite_set[S]): max[T, ≤](extend[T, S, bool, false](P)) = max[S, restrict[[T, T ], [S, S], boolean](≤)](P)

Repeatedly Skolemizing and flattening, Rewriting using max_lem, matching in *, Applying propositional simplification, we get 2 subgoals:

max_stable_under_extension.1:

{-1} is_finite[S](P′)

{1} extend[T, S, bool, false]

(P′)(max[S, restrict[[T, T ], [S, S], boolean](≤)](P′))

{2} empty?[S](P′)

Expanding the definition of extend, which is trivially true.

This completes the proof of max_stable_under_extension.1.
max_stable_under_extension.2:

{-1} is_finite[S](P′)
{1} ∀ (x: (extend[T, S, bool, false](P′))):
x ≤ max[S, restrict[[T, T ], [S, S], boolean](≤)](P′)
{2} empty?[S](P′)

Repeatedly Skolemizing and flattening, Expanding the definition of extend, Adding type constraints for max[S, restrict[[T, T], [S, S], boolean](<=)](P!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: (x!1), Expanding the definition of restrict, which is trivially true.

This completes the proof of max_stable_under_extension.2.

Q.E.D.

C.135.3 Min_Max_Extension.min_stable_under_extension

Terse proof for min_stable_under_extension.
min_stable_under_extension:

{1} ∀ (P: non_empty_finite_set[S]): min[T, ≤](extend[T, S, bool, false](P)) = min[S, restrict[[T, T ], [S, S], boolean](≤)](P)

Repeatedly Skolemizing and flattening, Rewriting using min_lem, matching in *, Expanding the definition of extend, Repeatedly Skolemizing and flattening, Adding type constraints for min[S, restrict[[T, T], [S, S], boolean](<=)](P!1), Expanding the definition of extend, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: (x!1), Expanding the definition of restrict, which is trivially true.

This completes the proof of min_stable_under_extension.

Q.E.D.

C.136 Proofs for More_Divides (vfiasco-prelude.pvs)

C.136.1 More_Divides.expt_divides

Terse proof for expt_divides.

expt_divides:

{1} ∀ (m, n: nat, a: posnat): a > 1 ∧ n ≤ m ⊃ divides(expt(a, n), expt(a, m))

Repeatedly Skolemizing and flattening, Expanding the definition of divides, Instantiating the top quantifier in 1 with the terms: expt(a′, m′ − n′), we get 2 subgoals:

expt_divides.1:

{-1} m′ ≥ 0
{-2} n′ ≥ 0
{-3} a′ > 0
{-4} a′ > 1
{-5} n′ ≤ m′
{1} expt(a′, m′) = expt(a′, n′) × expt(a′, m′ − n′)

Rewriting using expt_plus_aux, matching in *, This completes the proof of expt_divides.1.

expt_divides.2:

\begin{matrix}\{-1\} & m′ ≥ 0 \\ \{-2\} & n′ ≥ 0 \\ \{-3\} & a′ > 0 \\ \{-4\} & a′ > 1 \\ \{-5\} & n′ ≤ m′ \\ \{1\} & m′ − n′ ≥ 0 \end{matrix}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of expt_divides.2. Q.E.D.

C.136.2 More_Divides.divides_expt_gt

Terse proof for divides_expt_gt.
divides_expt_gt:

{1} ∀ (n, i, j: nat): j ≤ i ∧ divides(expt(2, i), n) ⊃ divides(expt(2, j), n)

Repeatedly Skolemizing and flattening, Applying divides_transitive Instantiating the top quantifier in -1 with the terms: n′, expt(2, i′), expt(2, j′),

C.137 Proofs for More_Function (vfiasco-prelude.pvs)

Simplifying, rewriting, and recording with decision procedures, Rewriting using expt_divides, matching in *, This completes the proof of divides_expt_gt. Q.E.D.

C.137 Proofs for More_Function (vfiasco-prelude.pvs)

C.137.1 More_Function.restrict_to_image_TCC1

Terse proof for restrict_to_image_TCC1.
restrict_to_image_TCC1:

{1} ∀ (f: [Domain → Range]):

∀ (x_{1}: Domain): image[Domain, Range](f, fullset[Domain])(f(x_{1}))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of restrict_to_image_TCC1. Q.E.D.

C.137.2 More_Function.surjective_restrict_to_image

Terse proof for surjective_restrict_to_image.
surjective_restrict_to_image:

{1} ∀ (f: [Domain → Range]): surjective?(restrict_to_image(f))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of surjective_restrict_to_image.

Q.E.D.

C.137.3 More_Function.bijective_restrict_to_image

Terse proof for bijective_restrict_to_image.
bijective_restrict_to_image:

{1} ∀ (f: [Domain → Range]): injective?(f) ⊃ bijective?(restrict_to_image(f))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of bijective_restrict_to_image.

Q.E.D.

C.138 Proofs for More_List_Props (vfiasco-prelude.pvs)

C.138.1 More_List_Props.length_is_cons

Terse proof for length_is_cons.
length_is_cons:

{1} ∀ (l: list[T ]): length(l) > 0 ⊃ cons?(l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of length_is_cons. Q.E.D.

C.138.2 More_List_Props.cons_length

Terse proof for cons_length.

cons_length:

{1} ∀ (l: (cons?[T ])): length(l) > 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cons_length. Q.E.D.

C.138.3 More_List_Props.length_cdr_TCC1

Terse proof for length_cdr_TCC1.
length_cdr_TCC1:

{1} ∀ (l: list[T ]): length(l) > 0 ⊃ cons?[T ](l)

Repeatedly Skolemizing and flattening, Rewriting using length_is_cons, matching in *, This completes the proof of length_cdr_TCC1. Q.E.D.

C.138.4 More_List_Props.length_cdr

Terse proof for length_cdr.

length_cdr:

{1} ∀ (l: list[T ]): length(l) > 0 ⊃ length(cdr(l)) = length(l) − 1

Repeatedly Skolemizing and flattening, Expanding the definition of length, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of length_cdr. Q.E.D.

C.138.5 More_List_Props.conslist_induction

Terse proof for conslist_induction.
conslist_induction:

{1} ∀ (p: [(cons?[T ]) → boolean]):

(∀ (t: T): p(cons(t, null))) ∧ (∀ (t: T, tail: (cons?[T ])): p(tail) ⊃ p(cons(t, tail))) ⊃ (∀ (l: (cons?[T ])): p(l))

C.138 Proofs for More_List_Props (vfiasco-prelude.pvs)

Skolemizing and flattening, Inducting on l on formula 1, we get 3 subgoals:

conslist_induction.1:

{-1} ∀ (t: T): p′(cons(t, null))
{-2} ∀ (t: T, tail: (cons?[T ])): p′(tail) ⊃ p′(cons(t, tail))
{1} cons?[T ](l′)
{2} p′(l′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of conslist_induction.1.

conslist_induction.2:

{-1} ∀ (t: T): p′(cons(t, null))
{-2} ∀ (t: T, tail: (cons?[T ])): p′(tail) ⊃ p′(cons(t, tail))
{1} false ⊃ p′(null)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of conslist_induction.2.

conslist_induction.3:

{-1} ∀ (t: T): p′(cons(t, null))
{-2} ∀ (t: T, tail: (cons?[T ])): p′(tail) ⊃ p′(cons(t, tail))

{1} ∀ (cons1_var: T, cons2_var: list[T ]): (cons?[T ](cons2_var) ⊃ p′(cons2_var)) ⊃ true ⊃ p′(cons(cons1_var, cons2_var))

Repeatedly Skolemizing and flattening, Case splitting on cons2_var!1 = null, we get 2 subgoals:

conslist_induction.3.1:

{-1} cons2_var′ = null
{-2} cons?[T ](cons2_var′) ⊃ p′(cons2_var′)
{-3} ∀ (t: T): p′(cons(t, null))
{-4} ∀ (t: T, tail: (cons?[T ])): p′(tail) ⊃ p′(cons(t, tail))
{1} p′(cons(cons1_var′, cons2_var′))

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of conslist_induction.3.1.

conslist_induction.3.2:

{-1} cons?[T ](cons2_var′) ⊃ p′(cons2_var′)
{-2} ∀ (t: T): p′(cons(t, null))
{-3} ∀ (t: T, tail: (cons?[T ])): p′(tail) ⊃ p′(cons(t, tail))
{1} cons2_var′ = null
{2} p′(cons(cons1_var′, cons2_var′))

Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of conslist_induction.3.2. Q.E.D.

C.138.6 More_List_Props.head_TCC1

Terse proof for head_TCC1.

head_TCC1:

{1} ∀ (l: list[T ], n: upto(length[T ](l))): ¬ n = 0 ⊃ cons?[T ](l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of head_TCC1. Q.E.D.

C.138.7 More_List_Props.head_TCC2

Terse proof for head_TCC2.

head_TCC2:

{1} ∀ (l: list[T ], n: upto(length[T ](l))):

¬ n = 0 ⊃ n − 1 ≥ 0 ∧ n − 1 ≤ length[T ](cdr[T ](l))

Repeatedly Skolemizing and flattening, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of head_TCC2. Q.E.D.

C.138.8 More_List_Props.head_TCC3

Terse proof for head_TCC3.

head_TCC3:

{1} ∀ (l: list[T ], n: upto(length[T ](l))): ¬ n = 0 ⊃ n − 1 < n

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of head_TCC3. Q.E.D.

C.138.9 More_List_Props.head_tail

Terse proof for head_tail.

head_tail:

{1} ∀ (l: list[T ], n: nat): n ≤ length(l) ⊃ append(head(l, n), tail(l, n)) = l

Inducting on l on formula 1, we get 2 subgoals:

head_tail.1:

{1} ∀ (n: nat): n ≤ length(null) ⊃ append(head(null, n), tail(null, n)) = null

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of head_tail.1.

head_tail.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (n: nat): n ≤ length(cons2_var) ⊃ append(head(cons2_var, n), tail(cons2_var, n)) = cons2_var)

⊃

(∀ (n: nat):

n ≤ length(cons(cons1_var, cons2_var)) ⊃

append(head(cons(cons1_var, cons2_var), n),

tail(cons(cons1_var, cons2_var), n)) = cons(cons1_var, cons2_var))

Repeatedly Skolemizing and flattening, Expanding the definition of length, Expanding the definition of head, Expanding the definition of tail, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

head_tail.2.1:

{-1} n′ ≥ 0
{-2} ∀ (n: nat):

n ≤ length(cons2_var′) ⊃ append(head(cons2_var′, n), tail(cons2_var′, n)) = cons2_var′

{-3} n′ ≤ 1 + length(cons2_var′)
{-4} n′ = 0
{1} append(null, cons(cons1_var′, cons2_var′)) = cons(cons1_var′, cons2_var′)

Expanding the definition of append, which is trivially true. This completes the proof of head_tail.2.1.

head_tail.2.2:

{-1} n′ ≥ 0
{-2} ∀ (n: nat):

n ≤ length(cons2_var′) ⊃ append(head(cons2_var′, n), tail(cons2_var′, n)) = cons2_var′

{-3} n′ ≤ 1 + length(cons2_var′)
{1} n′ = 0

{2} append(cons(cons1_var′, head(cons2_var′, n′ − 1)), tail(cons2_var′, n′ − 1))

= cons(cons1_var′, cons2_var′)

Expanding the definition of append, Rewriting using -2, matching in *, This completes the proof of head_tail.2.2. Q.E.D.

C.138.10 More_List_Props.length_head

Terse proof for length_head.

length_head:

{1} ∀ (l: list[T ], n: nat): n ≤ length(l) ⊃ length(head(l, n)) = n

Inducting on l on formula 1, we get 2 subgoals:

length_head.1:

{1} ∀ (n: nat): n ≤ length(null) ⊃ length(head(null, n)) = n

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of length_head.1.

length_head.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (n: nat): n ≤ length(cons2_var) ⊃ length(head(cons2_var, n)) = n) ⊃ (∀ (n: nat):

n ≤ length(cons(cons1_var, cons2_var)) ⊃ length(head(cons(cons1_var, cons2_var), n)) = n)

Repeatedly Skolemizing and flattening, Expanding the definition of head, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -2 with the terms: (n!1 - 1), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of length_head.2. Q.E.D.

C.138.11 More_List_Props.length_tail

Terse proof for length_tail.

length_tail:

{1} ∀ (l: list[T ], n: nat):

n ≤ length(l) ⊃ length(tail(l, n)) = length(l) − n

Inducting on l on formula 1, we get 2 subgoals:

length_tail.1:

{1} ∀ (n: nat): n ≤ length(null) ⊃ length(tail(null, n)) = length(null) − n

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of length_tail.1.

length_tail.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (n: nat):

n ≤ length(cons2_var) ⊃ length(tail(cons2_var, n)) = length(cons2_var) − n)

⊃

(∀ (n: nat):

n ≤ length(cons(cons1_var, cons2_var)) ⊃

length(tail(cons(cons1_var, cons2_var), n)) = length(cons(cons1_var, cons2_var)) − n)

Repeatedly Skolemizing and flattening, Expanding the definition of tail, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

length_tail.2.1:

{-1} n′ ≥ 0
{-2} ∀ (n: nat):

n ≤ length(cons2_var′) ⊃ length(tail(cons2_var′, n)) = length(cons2_var′) − n

{-3} n′ ≤ length(cons(cons1_var′, cons2_var′))
{-4} null?(tail(cons2_var′, n′ − 1))
{1} n′ = 0
{2} 0 = 1 + length(cons2_var′) − n′

Instantiating the top quantifier in -2 with the terms: (n!1 - 1), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of length_tail.2.1.

length_tail.2.2:

{-1} n′ ≥ 0
{-2} ∀ (n: nat):

n ≤ length(cons2_var′) ⊃ length(tail(cons2_var′, n)) = length(cons2_var′) − n

{-3} n′ ≤ length(cons(cons1_var′, cons2_var′))
{1} n′ = 0
{2} null?(tail(cons2_var′, n′ − 1))
{3} length(cdr(tail(cons2_var′, n′ − 1))) = length(cons2_var′) − n′

Instantiating the top quantifier in -2 with the terms: (n!1 - 1), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of length_tail.2.2. Q.E.D.

C.138.12 More_List_Props.nth_head_TCC1

Terse proof for nth_head_TCC1.

nth_head_TCC1:

{1} ∀ (l: list[T ], n, i: nat):
n ≤ length(l) ∧ i < n ⊃ i < length[T ](head(l, n))

Repeatedly Skolemizing and flattening, Rewriting using length_head, matching in *, This completes the proof of nth_head_TCC1. Q.E.D.

C.138.13 More_List_Props.nth_head_TCC2

Terse proof for nth_head_TCC2.

nth_head_TCC2:

{1} ∀ (l: list[T ], n, i: nat): n ≤ length(l) ∧ i < n ⊃ i < length[T ](l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_head_TCC2. Q.E.D.

C.138.14 More_List_Props.nth_head

Terse proof for nth_head.

nth_head:

{1} ∀ (l: list[T ], n, i: nat):
n ≤ length(l) ∧ i < n ⊃ nth(head(l, n), i) = nth(l, i)

Inducting on n on formula 1, we get 4 subgoals:

nth_head.1:

{1} ∀ (l: list[T ], i: nat):
0 ≤ length(l) ∧ i < 0 ⊃ nth(head(l, 0), i) = nth(l, i)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_head.1.

nth_head.2:

{1} ∀ j:
(∀ (l: list[T ], i: nat):

j ≤ length(l) ∧ i < j ⊃ nth(head(l, j), i) = nth(l, i))

⊃
(∀ (l: list[T ], i: nat):

j + 1 ≤ length(l) ∧ i < j + 1 ⊃ nth(head(l, j + 1), i) = nth(l, i))

Repeatedly Skolemizing and flattening, Expanding the definition of head, Expanding the definition of nth, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using -3, matching in *, Rewriting using length_cdr, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of nth_head.2.

nth_head.3:

{1} ∀ (n: nat, l: list[T ], i: nat): n ≤ length(l) ∧ i < n ⊃ i < length[T ](l)
{2} ∀ (l: list[T ], i: nat):

n′ ≤ length(l) ∧ i < n′ ⊃ nth(head(l, n′), i) = nth(l, i)

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_head.3.

nth_head.4:

{1} ∀ (n: nat, l: list[T ], i: nat):

n ≤ length(l) ∧ i < n ⊃ i < length[T ](head(l, n))

{2} ∀ (l: list[T ], i: nat):

n′ ≤ length(l) ∧ i < n′ ⊃ nth(head(l, n′), i) = nth(l, i)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using length_head, matching in *, This completes the proof of nth_head.4. Q.E.D.

C.138.15 More_List_Props.nth_tail_TCC1

Terse proof for nth_tail_TCC1.

nth_tail_TCC1:

{1} ∀ (l: list[T ], n, i: nat):

n ≤ length(l) ∧ i + n < length(l) ⊃ i < length[T ](tail(l, n))

Repeatedly Skolemizing and flattening, Rewriting using length_tail, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_tail_TCC1. Q.E.D.

C.138.16 More_List_Props.nth_tail_TCC2

Terse proof for nth_tail_TCC2.

nth_tail_TCC2:

{1} ∀ (l: list[T ], n, i: nat):

n ≤ length(l) ∧ i + n < length(l) ⊃ n + i < length[T ](l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_tail_TCC2. Q.E.D.

C.138.17 More_List_Props.nth_tail

Terse proof for nth_tail.

nth_tail:

{1} ∀ (l: list[T ], n, i: nat):
n ≤ length(l) ∧ i + n < length(l) ⊃
nth(tail(l, n), i) = nth(l, n + i)

Inducting on n on formula 1, we get 4 subgoals:

nth_tail.1:

{1} ∀ (l: list[T ], i: nat):

0 ≤ length(l) ∧ i + 0 < length(l) ⊃ nth(tail(l, 0), i) = nth(l, 0 + i)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_tail.1.

nth_tail.2:

{1} ∀ j:
(∀ (l: list[T ], i: nat):
j ≤ length(l) ∧ i + j < length(l) ⊃
nth(tail(l, j), i) = nth(l, j + i))
⊃
(∀ (l: list[T ], i: nat):
j + 1 ≤ length(l) ∧ i + j + 1 < length(l) ⊃
nth(tail(l, j + 1), i) = nth(l, j + 1 + i))

Repeatedly Skolemizing and flattening, Expanding the definition of tail, Expanding the definition of nth, Installing automatic rewrites from: -3 length_cdr Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of nth_tail.2.

nth_tail.3:

{1} ∀ (n: nat, l: list[T ], i: nat):

n ≤ length(l) ∧ i + n < length(l) ⊃ i + n < length[T ](l)

{2} ∀ (l: list[T ], i: nat):
n′ ≤ length(l) ∧ i + n′ < length(l) ⊃
nth(tail(l, n′), i) = nth(l, n′ + i)

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_tail.3.

nth_tail.4:

{1} ∀ (n: nat, l: list[T ], i: nat):
n ≤ length(l) ∧ i + n < length(l) ⊃ i < length[T ](tail(l, n))
{2} ∀ (l: list[T ], i: nat):
n′ ≤ length(l) ∧ i + n′ < length(l) ⊃
nth(tail(l, n′), i) = nth(l, n′ + i)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using length_tail, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_tail.4. Q.E.D.

C.138.18 More_List_Props.car_head_TCC1

Terse proof for car_head_TCC1.

car_head_TCC1:

{1} ∀ (l: list[T ], n: upto(length[T ](l))): n > 0 ⊃ cons?[T ](head(l, n))

Repeatedly Skolemizing and flattening, Expanding the definition of head, Simplifying, rewriting, and recording with decision procedures, This completes the proof of car_head_TCC1. Q.E.D.

C.138.19 More_List_Props.car_head_TCC2

Terse proof for car_head_TCC2.

car_head_TCC2:

{1} ∀ (l: list[T ], n: upto(length[T ](l))): n > 0 ⊃ cons?[T ](l)

Repeatedly Skolemizing and flattening, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of car_head_TCC2. Q.E.D.

C.138.20 More_List_Props.car_head

Terse proof for car_head.

car_head:

{1} ∀ (l: list[T ], n: upto(length(l))): n > 0 ⊃ car(head(l, n)) = car(l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of car_head. Q.E.D.

C.138.21 More_List_Props.cons_tail

Terse proof for cons_tail.

cons_tail:

{1} ∀ (l: list[T ], n: upto(length(l))): n < length(l) ⊃ cons?(tail(l, n))

Repeatedly Skolemizing and flattening, Using lemma length_tail, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of cons_tail. Q.E.D.

C.138.22 More_List_Props.car_tail_TCC1

Terse proof for car_tail_TCC1.

car_tail_TCC1:

{1} ∀ (l: list[T ], n: upto(length[T ](l))):
n < length(l) ⊃ cons?[T ](tail(l, n))

Repeatedly Skolemizing and flattening, Using lemma length_tail, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of car_tail_TCC1. Q.E.D.

C.138.23 More_List_Props.car_tail

Terse proof for car_tail.

car_tail:

{1} ∀ (l: list[T ], n: upto(length(l))):

n < length(l) ⊃ car(tail(l, n)) = nth(l, n)

Inducting on l on formula 1, we get 3 subgoals:

car_tail.1:

{1} ∀ (n: upto(length(null))):

n < length(null) ⊃ car(tail(null, n)) = nth(null, n)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of car_tail.1.

car_tail.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]): (∀ (n: upto(length(cons2_var))):

n < length(cons2_var) ⊃ car(tail(cons2_var, n)) = nth(cons2_var, n)) ⊃ (∀ (n: upto(length(cons(cons1_var, cons2_var)))): n < length(cons(cons1_var, cons2_var)) ⊃ car(tail(cons(cons1_var, cons2_var), n)) = nth(cons(cons1_var, cons2_var), n))

Repeatedly Skolemizing and flattening, Expanding the definition of tail, Expanding the definition of nth, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using -2, matching in *, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of car_tail.2.

car_tail.3:

{1} ∀ (l: list[T ], n: upto(length[T ](l))):
n < length(l) ⊃ cons?[T ](tail(l, n))
{2} ∀ (n: upto(length(l′))): n < length(l′) ⊃ car(tail(l′, n)) = nth(l′, n)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Using lemma length_tail, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of car_tail.3. Q.E.D.

C.138.24 More_List_Props.cdr_tail_TCC1

Terse proof for cdr_tail_TCC1.

cdr_tail_TCC1:

{1} ∀ (l: list[T ], n: upto(length[T ](l))):
n < length(l) ⊃ n + 1 ≤ length[T ](l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cdr_tail_TCC1. Q.E.D.

C.138.25 More_List_Props.cdr_tail

Terse proof for cdr_tail.

cdr_tail:

{1} ∀ (l: list[T ], n: upto(length(l))):

n < length(l) ⊃ cdr(tail(l, n)) = tail(l, n + 1)

Inducting on l on formula 1, we get 4 subgoals:

cdr_tail.1:

{1} ∀ (n: upto(length(null))):

n < length(null) ⊃ cdr(tail(null, n)) = tail(null, n + 1)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of cdr_tail.1.

cdr_tail.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]): (∀ (n: upto(length(cons2_var))): n < length(cons2_var) ⊃ cdr(tail(cons2_var, n)) = tail(cons2_var, n + 1))

⊃

(∀ (n: upto(length(cons(cons1_var, cons2_var)))): n < length(cons(cons1_var, cons2_var)) ⊃ cdr(tail(cons(cons1_var, cons2_var), n)) = tail(cons(cons1_var, cons2_var), n + 1))

Repeatedly Skolemizing and flattening, Expanding the definition of tail, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

cdr_tail.2.1:

{-1} n′ ≤ length(cons(cons1_var′, cons2_var′))

{-2} ∀ (n: upto(length(cons2_var′))): n < length(cons2_var′) ⊃ cdr(tail(cons2_var′, n)) = tail(cons2_var′, 1 + n)

{-3} n′ < length(cons(cons1_var′, cons2_var′))
{-4} n′ = 0
{1} cons2_var′ = tail(cons2_var′, n′)

Expanding the definition of tail, which is trivially true. This completes the proof of cdr_tail.2.1.

cdr_tail.2.2:

{-1} n′ ≤ length(cons(cons1_var′, cons2_var′))

{-2} ∀ (n: upto(length(cons2_var′))): n < length(cons2_var′) ⊃ cdr(tail(cons2_var′, n)) = tail(cons2_var′, 1 + n)

{-3} n′ < length(cons(cons1_var′, cons2_var′))
{1} n′ = 0
{2} cdr(tail(cons2_var′, n′ − 1)) = tail(cons2_var′, n′)

Rewriting using -2, matching in *, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, This completes the proof of cdr_tail.2.2.

cdr_tail.3:

{1} ∀ (l: list[T ], n: upto(length[T ](l))):
n < length(l) ⊃ 1 + n ≤ length[T ](l)
{2} ∀ (n: upto(length(l′))):

n < length(l′) ⊃ cdr(tail(l′, n)) = tail(l′, n + 1)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, This completes the proof of cdr_tail.3.

cdr_tail.4:

{1} ∀ (l: list[T ], n: upto(length[T ](l))):
n < length(l) ⊃ cons?[T ](tail(l, n))
{2} ∀ (n: upto(length(l′))):

n < length(l′) ⊃ cdr(tail(l′, n)) = tail(l′, n + 1)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Rewriting using cons_tail, matching in *, This completes the proof of cdr_tail.4. Q.E.D.

C.138.26 More_List_Props.every_implied

Terse proof for every_implied.

every_implied:

{1} ∀ (l: list[T ], P, Q: PRED[T ]):

(∀ (t: T): P (t) ⊃ Q(t)) ∧ every(P)(l) ⊃ every(Q)(l)

Inducting on l on formula 1, we get 2 subgoals:

every_implied.1:

{1} ∀ (P, Q: PRED[T ]):

(∀ (t: T): P (t) ⊃ Q(t)) ∧ every(P)(null) ⊃ every(Q)(null)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of every_implied.1.

every_implied.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (P, Q: PRED[T ]):

(∀ (t: T): P (t) ⊃ Q(t)) ∧ every(P)(cons2_var) ⊃ every(Q)(cons2_var))

⊃

(∀ (P, Q: PRED[T ]):

(∀ (t: T): P (t) ⊃ Q(t)) ∧ every(P)(cons(cons1_var, cons2_var)) ⊃ every(Q)(cons(cons1_var, cons2_var)))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Instantiating the top quantifier in -1 with the terms: (P!1 Q!1), Replacing using formula -2, Instantiating quantified variables, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of every_implied.2. Q.E.D.

C.138.27 More_List_Props.every_conjunct_left

Terse proof for every_conjunct_left.
every_conjunct_left:

{1} ∀ (l: list[T ], P, Q: PRED[T ]):

every(P)(l) ∧ every(Q)(l) ⊃ every(λ (t: T): P (t) ∧ Q(t))(l)

Inducting on l on formula 1, we get 2 subgoals:

every_conjunct_left.1:

{1} ∀ (P, Q: PRED[T ]):

every(P)(null) ∧ every(Q)(null) ⊃ every(λ (t: T): P (t) ∧ Q(t))(null)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of every_conjunct_left.1.

every_conjunct_left.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]): (∀ (P, Q: PRED[T ]): every(P)(cons2_var) ∧ every(Q)(cons2_var) ⊃ every(λ (t: T): P (t) ∧ Q(t))(cons2_var)) ⊃ (∀ (P, Q: PRED[T ]): every(P)(cons(cons1_var, cons2_var)) ∧ every(Q)(cons(cons1_var, cons2_var)) ⊃ every(λ (t: T): P (t) ∧ Q(t))(cons(cons1_var, cons2_var)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of every_conjunct_left.2. Q.E.D.

C.138.28 More_List_Props.every_iff_forall

Terse proof for every_iff_forall.
every_iff_forall:

{1} ∀ (l: list[T ], P: PRED[T ]):

every(P)(l) ≡ (∀ (t: T): member(t, l) ⊃ P (t))

Inducting on l on formula 1, we get 2 subgoals:

every_iff_forall.1:

{1} ∀ (P: PRED[T ]): every(P)(null) ≡ (∀ (t: T): member(t, null) ⊃ P (t))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of every_iff_forall.1.

every_iff_forall.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (P: PRED[T ]):

every(P)(cons2_var) ≡ (∀ (t: T): member(t, cons2_var) ⊃ P (t))) ⊃ (∀ (P: PRED[T ]):

every(P)(cons(cons1_var, cons2_var)) ≡ (∀ (t: T): member(t, cons(cons1_var, cons2_var)) ⊃ P (t)))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of every, Expanding the definition of member, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

every_iff_forall.2.1:

{-1} every(P′)(cons2_var′)
{-2} ∀ (t: T): member(t, cons2_var′) ⊃ P′(t)
{-3} P′(cons1_var′)
{1} ∀ (t: T): t = cons1_var′ ∨ member(t, cons2_var′) ⊃ P′(t)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of every_iff_forall.2.1.

every_iff_forall.2.2:

{-1} every(P′)(cons2_var′)
{-2} ∀ (t: T): member(t, cons2_var′) ⊃ P′(t)
{-3} ∀ (t: T): t = cons1_var′ ∨ member(t, cons2_var′) ⊃ P′(t)
{1} P′(cons1_var′)

Instantiating quantified variables, This completes the proof of every_iff_forall.2.2.

every_iff_forall.2.3:

{-1} ∀ (t: T): t = cons1_var′ ∨ member(t, cons2_var′) ⊃ P′(t)
{1} every(P′)(cons2_var′)
{2} ∀ (t: T): member(t, cons2_var′) ⊃ P′(t)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of every_iff_forall.2.3. Q.E.D.

C.138.29 More_List_Props.some_iff_exists

Terse proof for some_iff_exists.

some_iff_exists:

{1} ∀ (l: list[T ], P: PRED[T ]):
some(P)(l) ≡ (∃ (t: T): member(t, l) ∧ P (t))

Inducting on l on formula 1, we get 2 subgoals:

some_iff_exists.1:

{1} ∀ (P: PRED[T ]): some(P)(null) ≡ (∃ (t: T): member(t, null) ∧ P (t))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of some_iff_exists.1.

some_iff_exists.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (P: PRED[T ]):

some(P)(cons2_var) ≡ (∃ (t: T): member(t, cons2_var) ∧ P (t))) ⊃ (∀ (P: PRED[T ]):

some(P)(cons(cons1_var, cons2_var)) ≡ (∃ (t: T): member(t, cons(cons1_var, cons2_var)) ∧ P (t)))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Expanding the definition of some, Expanding the definition of member, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

some_iff_exists.2.1:

{-1} some(P′)(cons2_var′)
{-2} ∃ (t: T): member(t, cons2_var′) ∧ P′(t)
{1} ∃ (t: T): (t = cons1_var′ ∨ member(t, cons2_var′)) ∧ P′(t)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (t!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of some_iff_exists.2.1.

some_iff_exists.2.2:

{-1} P′(cons1_var′)
{1} some(P′)(cons2_var′)
{2} ∃ (t: T): member(t, cons2_var′) ∧ P′(t)
{3} ∃ (t: T): (t = cons1_var′ ∨ member(t, cons2_var′)) ∧ P′(t)

Instantiating the top quantifier in 3 with the terms: (cons1_var!1), which is trivially true. This completes the proof of some_iff_exists.2.2.

some_iff_exists.2.3:

{-1} ∃ (t: T): (t = cons1_var′ ∨ member(t, cons2_var′)) ∧ P′(t)
{1} some(P′)(cons2_var′)
{2} ∃ (t: T): member(t, cons2_var′) ∧ P′(t)
{3} P′(cons1_var′)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of some_iff_exists.2.3. Q.E.D.

C.138.30 More_List_Props.list_extensionality_TCC1

Terse proof for list_extensionality_TCC1.
list_extensionality_TCC1:

{1} ∀ (l_{1}, l_{2}: list[T ]):
length(l_{1}) = length(l_{2}) ⊃
(∀ (i: below(length[T ](l_{1}))): i < length[T ](l_{2}))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of list_extensionality_TCC1.

Q.E.D.

C.138.31 More_List_Props.list_extensionality

Terse proof for list_extensionality.
list_extensionality:

{1} ∀ (l_{1}, l_{2}: list[T ]):
l_{1} = l_{2} ≡
(length(l_{1}) = length(l_{2}) ∧
(∀ (i: below(length(l_{1}))): nth(l_{1}, i) = nth(l_{2}, i)))

Inducting on l_{1} on formula 1, we get 3 subgoals:

list_extensionality.1:

{1} ∀ (l_{2}: list[T ]):

null = l_{2} ≡

(length(null) = length(l_{2}) ∧ (∀ (i: below(length(null))): nth(null, i) = nth(l_{2}, i)))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of list_extensionality.1.

list_extensionality.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (l_{2}: list[T ]): cons2_var = l_{2} ≡ (length(cons2_var) = length(l_{2}) ∧

(∀ (i: below(length(cons2_var))): nth(cons2_var, i) = nth(l_{2}, i)))) ⊃

(∀ (l_{2}: list[T ]):

cons(cons1_var, cons2_var) = l_{2} ≡ (length(cons(cons1_var, cons2_var)) = length(l_{2}) ∧

(∀ (i: below(length(cons(cons1_var, cons2_var)))): nth(cons(cons1_var, cons2_var), i) = nth(l_{2}, i))))

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of length, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -1 with the terms: cdr(l′_{2}), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

list_extensionality.2.1:

{-1} cons2_var′ = cdr(l′_{2})
{-2} length(cons2_var′) = length(cdr(l′_{2}))
{-3} ∀ (i: below(length(cons2_var′))): nth(cons2_var′, i) = nth(cdr(l′_{2}), i)

{-4} ∀ (i: below(length(cons(cons1_var′, cons2_var′)))):

nth(cons(cons1_var′, cons2_var′), i) = nth(l′_{2}, i)

{1} cons(cons1_var′, cons2_var′) = l′_{2}
{2} null?(l′_{2})

Applying extensionality, Instantiating the top quantifier in -4 with the terms: 0, we get 2 subgoals:

list_extensionality.2.1.1:

{-1} cons2_var′ = cdr(l′_{2})
{-2} length(cons2_var′) = length(cdr(l′_{2}))
{-3} ∀ (i: below(length(cons2_var′))): nth(cons2_var′, i) = nth(cdr(l′_{2}), i)
{-4} nth(cons(cons1_var′, cons2_var′), 0) = nth(l′_{2}, 0)
{1} cons1_var′ = car(l′_{2})
{2} null?(l′_{2})

Expanding the definition of nth, which is trivially true.

This completes the proof of list_extensionality.2.1.1.
list_extensionality.2.1.2:

{-1} cons2_var′ = cdr(l′_{2})
{-2} length(cons2_var′) = length(cdr(l′_{2}))
{-3} ∀ (i: below(length(cons2_var′))): nth(cons2_var′, i) = nth(cdr(l′_{2}), i)
{1} 0 < length[T ](cons[T ](cons1_var′, cons2_var′))
{2} cons1_var′ = car(l′_{2})
{3} null?(l′_{2})

Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of list_extensionality.2.1.2.
list_extensionality.2.2:

{-1} length(cons2_var′) = length(cdr(l′_{2}))

{-2} ∀ (i: below(length(cons(cons1_var′, cons2_var′)))):

nth(cons(cons1_var′, cons2_var′), i) = nth(l′_{2}, i)

{1} cons2_var′ = cdr(l′_{2})
{2} ∀ (i: below(length(cons2_var′))): nth(cons2_var′, i) = nth(cdr(l′_{2}), i)
{3} cons(cons1_var′, cons2_var′) = l′_{2}
{4} null?(l′_{2})

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -3 with the terms: i′ + 1, we get 2 subgoals:

list_extensionality.2.2.1:

{-1} i′ < length(cons2_var′)
{-2} length(cons2_var′) = length(cdr(l′_{2}))
{-3} nth(cons(cons1_var′, cons2_var′), i′ + 1) = nth(l′_{2}, i′ + 1)
{1} cons2_var′ = cdr(l′_{2})
{2} nth(cons2_var′, i′) = nth(cdr(l′_{2}), i′)
{3} cons(cons1_var′, cons2_var′) = l′_{2}
{4} null?(l′_{2})

Expanding the definition of nth, which is trivially true.

This completes the proof of list_extensionality.2.2.1.
list_extensionality.2.2.2:

{-1} i′ < length(cons2_var′)
{-2} length(cons2_var′) = length(cdr(l′_{2}))
{1} 1 + i′ < length[T ](cons[T ](cons1_var′, cons2_var′))
{2} cons2_var′ = cdr(l′_{2})
{3} nth(cons2_var′, i′) = nth(cdr(l′_{2}), i′)
{4} cons(cons1_var′, cons2_var′) = l′_{2}
{5} null?(l′_{2})

Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of list_extensionality.2.2.2.
list_extensionality.3:

{1} ∀ (l_{1}, l_{2}: list[T ]):
length(l_{1}) = length(l_{2}) ⊃

(∀ (i: below(length[T ](l_{1}))): i < length[T ](l_{2}))

{2} ∀ (l_{2}: list[T ]):
l′_{1} = l_{2} ≡
(length(l′_{1}) = length(l_{2}) ∧

(∀ (i: below(length(l′_{1}))): nth(l′_{1}, i) = nth(l_{2}, i)))

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, This completes the proof of list_extensionality.3. Q.E.D.

C.138.32 More_List_Props.list_remove_TCC1

Terse proof for list_remove_TCC1.
list_remove_TCC1:

{1} ∀ (x: T, l: list[T ], car: T, cdr: list[T ]):

x = car ∧ l = cons(car, cdr) ⊃ length[T ](cdr) < length[T ](l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of list_remove_TCC1. Q.E.D.

C.138.33 More_List_Props.list_remove_TCC2

Terse proof for list_remove_TCC2.
list_remove_TCC2:

{1} ∀ (x: T, l: list[T ], car: T, cdr: list[T ]):

¬ x = car ∧ l = cons(car, cdr) ⊃ length[T ](cdr) < length[T ](l)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of list_remove_TCC2. Q.E.D.

C.138.34 More_List_Props.list_remove_commutative

Terse proof for list_remove_commutative.
list_remove_commutative:

{1} ∀ (x, y: T, l: list[T ]):

list_remove(x, list_remove(y, l)) = list_remove(y, list_remove(x, l))

By induction on l, and by repeatedly rewriting and simplifying, This completes the proof of list_remove_commutative. Q.E.D.

C.138.35 More_List_Props.member_list_remove

Terse proof for member_list_remove.
member_list_remove:

{1} ∀ (x, y: T, l: list[T ]): member(x, list_remove(y, l)) = if x = y then false else member(x, l) endif

By induction on l, and by repeatedly rewriting and simplifying, This completes the proof of member_list_remove. Q.E.D.

C.138.36 More_List_Props.nth_member

Terse proof for nth_member.

nth_member:

{1} ∀ (x: T, l: list[T ]):

member(x, l) ≡ (∃ (i: below(length(l))): nth(l, i) = x)

Inducting on l on formula 1, we get 2 subgoals:

nth_member.1:

{1} ∀ (x: T): member(x, null) ≡ (∃ (i: below(length(null))): nth(null, i) = x)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_member.1.

nth_member.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (x: T):

member(x, cons2_var) ≡ (∃ (i: below(length(cons2_var))): nth(cons2_var, i) = x))

⊃

(∀ (x: T):

member(x, cons(cons1_var, cons2_var)) ≡

(∃ (i: below(length(cons(cons1_var, cons2_var)))): nth(cons(cons1_var, cons2_var), i) = x))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: member nth length Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

nth_member.2.1:

{-1} ∀ (x: T):

member(x, cons2_var′) ≡

(∃ (i: below(length(cons2_var′))): nth(cons2_var′, i) = x)

{-2} x′ = cons1_var′

{1} ∃ (i: below(length(cons(cons1_var′, cons2_var′)))): nth(cons(cons1_var′, cons2_var′), i) = x′

Instantiating the top quantifier in 1 with the terms: 0, we get 2 subgoals:

nth_member.2.1.1:

{-1} ∀ (x: T):

member(x, cons2_var′) ≡

(∃ (i: below(length(cons2_var′))): nth(cons2_var′, i) = x)

{-2} x′ = cons1_var′
{1} nth(cons(cons1_var′, cons2_var′), 0) = x′

Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_member.2.1.1.

nth_member.2.1.2:

{-1} ∀ (x: T):

member(x, cons2_var′) ≡

(∃ (i: below(length(cons2_var′))): nth(cons2_var′, i) = x)

{-2} x′ = cons1_var′
{1} 0 < 1 + length(cons2_var′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_member.2.1.2.

nth_member.2.2:

{-1} ∀ (x: T):

member(x, cons2_var′) ≡

(∃ (i: below(length(cons2_var′))): nth(cons2_var′, i) = x)

{-2} member(x′, cons2_var′)

{1} ∃ (i: below(length(cons(cons1_var′, cons2_var′)))): nth(cons(cons1_var′, cons2_var′), i) = x′

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: i′ + 1, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_member.2.2.

nth_member.2.3:

{-1} ∀ (x: T):

member(x, cons2_var′) ≡

(∃ (i: below(length(cons2_var′))): nth(cons2_var′, i) = x)

{-2} ∃ (i: below(length(cons(cons1_var′, cons2_var′)))): nth(cons(cons1_var′, cons2_var′), i) = x′

{1} x′ = cons1_var′
{2} member(x′, cons2_var′)

Repeatedly Skolemizing and flattening, Case splitting on i!1 = 0, we get 2 subgoals:

nth_member.2.3.1:

{-1} i′ = 0
{-2} i′ < length(cons(cons1_var′, cons2_var′))
{-3} ∀ (x: T):

member(x, cons2_var′) ≡

(∃ (i: below(length(cons2_var′))): nth(cons2_var′, i) = x)

{-4} nth(cons(cons1_var′, cons2_var′), i′) = x′
{1} x′ = cons1_var′
{2} member(x′, cons2_var′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_member.2.3.1.

nth_member.2.3.2:

{-1} i′ < length(cons(cons1_var′, cons2_var′))
{-2} ∀ (x: T):

member(x, cons2_var′) ≡ (∃ (i: below(length(cons2_var′))): nth(cons2_var′, i) = x)

{-3} nth(cons(cons1_var′, cons2_var′), i′) = x′
{1} i′ = 0
{2} x′ = cons1_var′
{3} member(x′, cons2_var′)

Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Instantiating the top quantifier in 2 with the terms: i′ − 1, This completes the proof of nth_member.2.3.2. Q.E.D.

C.138.37 More_List_Props.flatten_TCC1

Terse proof for flatten_TCC1.

flatten_TCC1:

{1} ∀ (ll: list[list[T ]], car: list[T ], cdr: list[list[T ]]):

ll = cons(car, cdr) ⊃ length[list[T ]](cdr) < length[list[T ]](ll)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of flatten_TCC1. Q.E.D.

C.138.38 More_List_Props.member_append

Terse proof for member_append.

member_append:

{1} ∀ (x: T, l_{1}, l_{2}: list[T ]):

member(x, append(l_{1}, l_{2})) ≡ member(x, l_{1}) ∨ member(x, l_{2})

By induction on l_{1}, and by repeatedly rewriting and simplifying, This completes the proof of member_append. Q.E.D.

C.138.39 More_List_Props.member_flatten

Terse proof for member_flatten.
member_flatten:

{1} ∀ (x: T, ll: list[list[T ]]):

member(x, flatten(ll)) ≡ (∃ (l: list[T ]): member(l, ll) ∧ member(x, l))

Inducting on ll on formula 1, we get 2 subgoals:

member_flatten.1:

{1} ∀ (x: T):

member(x, flatten(null)) ≡ (∃ (l: list[T ]): member(l, null) ∧ member(x, l))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of member_flatten.1.

member_flatten.2:

{1} ∀ (cons1_var: list[T ], cons2_var: list[list[T ]]):

(∀ (x: T):

member(x, flatten(cons2_var)) ≡ (∃ (l: list[T ]): member(l, cons2_var) ∧ member(x, l)))

⊃

(∀ (x: T):

member(x, flatten(cons(cons1_var, cons2_var))) ≡ (∃ (l: list[T ]): member(l, cons(cons1_var, cons2_var)) ∧ member(x, l)))

Repeatedly Skolemizing and flattening, Expanding the definition of flatten, Rewriting using member_append, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

member_flatten.2.1:

{-1} ∀ (x: T):

member(x, flatten(cons2_var′)) ≡ (∃ (l: list[T ]): member(l, cons2_var′) ∧ member(x, l))

{-2} member(x′, cons1_var′)
{1} ∃ (l: list[T ]): member(l, cons(cons1_var′, cons2_var′)) ∧ member(x′, l)

Instantiating the top quantifier in 1 with the terms: cons1_var′, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of member, which is trivially true. This completes the proof of member_flatten.2.1.

member_flatten.2.2:

{-1} ∀ (x: T):

member(x, flatten(cons2_var′)) ≡ (∃ (l: list[T ]): member(l, cons2_var′) ∧ member(x, l))

{-2} member(x′, flatten(cons2_var′))
{1} ∃ (l: list[T ]): member(l, cons(cons1_var′, cons2_var′)) ∧ member(x′, l)

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of member, which is trivially true. This completes the proof of member_flatten.2.2.

member_flatten.2.3:

{-1} ∀ (x: T):

member(x, flatten(cons2_var′)) ≡ (∃ (l: list[T ]): member(l, cons2_var′) ∧ member(x, l))

{-2} ∃ (l: list[T ]): member(l, cons(cons1_var′, cons2_var′)) ∧ member(x′, l)
{1} member(x′, cons1_var′)
{2} member(x′, flatten(cons2_var′))

Repeatedly Skolemizing and flattening, Expanding the definition of member, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of member_flatten.2.3. Q.E.D.

C.138.40 More_List_Props.map2_TCC1

Terse proof for map2_TCC1.

map2_TCC1:

{1} ∀ (f: [T, T → T ], l_{1}, l_{2}: list[T ], h_{1}: T, t_{1}: list[T ]):

l_{1} = cons(h_{1}, t_{1}) ⊃
(∀ (h_{2}: T, t_{2}: list[T ]):
l_{2} = cons(h_{2}, t_{2}) ⊃ length[T ](t_{1}) < length[T ](l_{1}))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of map2_TCC1. Q.E.D.

C.138.41 More_List_Props.map2_property

Terse proof for map2_property.

map2_property:

{1} ∀ (P: PRED[T ], f: [T, T → T ], l_{1}, l_{2}: list[T ]):

(∀ (t_{1}, t_{2}: T): P (f(t_{1}, t_{2}))) ⊃ every(P)(map2(f)(l_{1}, l_{2}))

Inducting on l_{1} on formula 1, we get 2 subgoals:

map2_property.1:

{1} ∀ (P: PRED[T ], f: [T, T → T ], l_{2}: list[T ]):

(∀ (t_{1}, t_{2}: T): P (f(t_{1}, t_{2}))) ⊃ every(P)(map2(f)(null, l_{2}))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of map2, which is trivially true. This completes the proof of map2_property.1.

map2_property.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (P: PRED[T ], f: [T, T → T ], l_{2}: list[T ]):

(∀ (t_{1}, t_{2}: T): P (f(t_{1}, t_{2}))) ⊃ every(P)(map2(f)(cons2_var, l_{2})))

⊃
(∀ (P: PRED[T ], f: [T, T → T ], l_{2}: list[T ]):

(∀ (t_{1}, t_{2}: T): P (f(t_{1}, t_{2}))) ⊃ every(P)(map2(f)(cons(cons1_var, cons2_var), l_{2})))

Repeatedly Skolemizing and flattening, Expanding the definition of map2, Expanding the definition of every, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

map2_property.2.1:

{-1} ∀ (P: PRED[T ], f: [T, T → T ], l_{2}: list[T ]):

(∀ (t_{1}, t_{2}: T): P (f(t_{1}, t_{2}))) ⊃ every(P)(map2(f)(cons2_var′, l_{2}))

{-2} ∀ (t_{1}, t_{2}: T): P′(f′(t_{1}, t_{2}))
{1} null?(l′_{2})
{2} every(P′)(map2(f′)(cons2_var′, cdr(l′_{2})))

Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of map2_property.2.1.

map2_property.2.2:

{-1} ∀ (P: PRED[T ], f: [T, T → T ], l_{2}: list[T ]):

(∀ (t_{1}, t_{2}: T): P (f(t_{1}, t_{2}))) ⊃ every(P)(map2(f)(cons2_var′, l_{2}))

{-2} ∀ (t_{1}, t_{2}: T): P′(f′(t_{1}, t_{2}))
{1} null?(l′_{2})
{2} P′(f′(cons1_var′, car(l′_{2})))

Instantiating quantified variables, This completes the proof of map2_property.2.2. Q.E.D.

C.139 Proofs for More_List_Props_2 (vfiasco-prelude.pvs)

C.139.1 More_List_Props_2.member_map

Terse proof for member_map.

member_map:

{1} ∀ (b: B, f: [A → B], l: list[A]):

member(b, map(f)(l)) ≡ (∃ (a: A): member(a, l) ∧ f(a) = b)

By induction on l, and by repeatedly rewriting and simplifying, This completes the proof of member_map. Q.E.D.

C.140 Proofs for More_More_List_Props (vfiasco-prelude.pvs)

C.140 Proofs for More_More_List_Props (vfiasco-prelude.pvs)

C.140.1 More_More_List_Props.list_all_length

Terse proof for list_all_length.
list_all_length:

{1} ∀ (n: nat): ∃ (l: list[T ]): length(l) = n

Inducting on n on formula 1, we get 2 subgoals:

list_all_length.1:

{1} ∃ (l: list[T ]): length(l) = 0

Instantiating the top quantifier in 1 with the terms: null, Expanding the definition of length, which is trivially true. This completes the proof of list_all_length.1.

list_all_length.2:

{1} ∀ j:
(∃ (l: list[T ]): length(l) = j) ⊃
(∃ (l: list[T ]): length(l) = j + 1)

Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: (cons(choose(LAMBDA (t: T): TRUE), l!1)), we get 2 subgoals:

list_all_length.2.1:

{-1} j′ ≥ 0
{-2} length(l′) = j′
{1} length(cons(choose(λ (t: T): true), l′)) = j′ + 1

Expanding the definition of length, which is trivially true. This completes the proof of list_all_length.2.1.

list_all_length.2.2:

{-1} j′ ≥ 0
{-2} length(l′) = j′
{1} nonempty?[T ](λ (t: T): true)

Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, which is trivially true. This completes the proof of list_all_length.2.2. Q.E.D.

C.141 Proofs for More_Relations (vfiasco-prelude.pvs)

C.141.1 More_Relations.zorn_lr

Terse proof for zorn_lr.

zorn_lr:

{1} ∀ (R: PRED[[T, T ]]):

well_founded?(R) ⊃ ¬ (∃ (f: [nat → T ]): ∀ (n: nat): R(f(n + 1), f(n)))

Expanding the definition of well_founded?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: (LAMBDA (t: T): EXISTS (n: nat): f!1(n) =

t), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

zorn_lr.1:

\{-1\} {∃ (y: (λ (t: T): ∃ (n: nat): f′(n) = t)): \atop ∀ (x: (λ (t: T): ∃ (n: nat): f′(n) = t)): (¬ R′(x, y))}
{-2} ∀ (n: nat): R′(f′(1 + n), f′(n))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables, we get 3 subgoals:

zorn_lr.1.1:

\begin{matrix}\{-1\} & n′ ≥ 0 \\ \{-2\} & f′(n′) = y′ \\ \{-3\} & R′(f′(1 + n′), f′(n′)) \\ \{1\} & R′(f′(1 + n′), y′) \end{matrix}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of zorn_lr.1.1.

zorn_lr.1.2:

\begin{matrix}\{-1\} & n′ ≥ 0 \\ \{-2\} & f′(n′) = y′ \\ \{-3\} & R′(f′(1 + n′), f′(n′)) \\ \{1\} & ∃ (n: nat): f′(n) = f′(1 + n′) \end{matrix}

Instantiating quantified variables, This completes the proof of zorn_lr.1.2.

zorn_lr.1.3:

\begin{matrix}\{-1\} & n′ ≥ 0 \\ \{-2\} & f′(n′) = y′ \\ \{-3\} & ∀ (x: (λ (t: T): ∃ (n: nat): f′(n) = t)): (¬ R′(x, y′)) \\ \{-4\} & R′(f′(1 + n′), f′(n′)) \\ \{1\} & ∃ (n: nat): f′(n) = f′(1 + n′) \end{matrix}

Instantiating quantified variables, This completes the proof of zorn_lr.1.3.

C.142 Proofs for More_Sets_Lemmas (vfiasco-prelude.pvs)

zorn_lr.2:

\begin{matrix}\{-1\} & ∀ (n: nat): R′(f′(1 + n), f′(n)) \\ \{1\} & ∃ (y: T): ∃ (n: nat): f′(n) = y \end{matrix}

Instantiating the top quantifier in 1 with the terms: (f!1(0)), Instantiating quantified variables, This completes the proof of zorn_lr.2. Q.E.D.

C.142 Proofs for More_Sets_Lemmas (vfiasco-prelude.pvs)

C.142.1 More_Sets_Lemmas.subset_equal

Terse proof for subset_equal.

subset_equal:

{1} ∀ (a, b: set[T ]): a = b ⊃ (a ⊆ b)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subset_equal. Q.E.D.

C.142.2 More_Sets_Lemmas.union_subset3

Terse proof for union_subset3.

union_subset3:

{1} ∀ (a, b: set[T ]): (a ⊆ (b ∪ a))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of union_subset3. Q.E.D.

C.142.3 More_Sets_Lemmas.subset_bigger_union_left

Terse proof for subset_bigger_union_left.
subset_bigger_union_left:

{1} ∀ (a, b, c: set[T ]): (a ⊆ b) ⊃ (a ⊆ (b ∪ c))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subset_bigger_union_left.

Q.E.D.

C.142.4 More_Sets_Lemmas.subset_bigger_union_right

Terse proof for subset_bigger_union_right.

subset_bigger_union_right:

{1} ∀ (a, b, c: set[T ]): (a ⊆ c) ⊃ (a ⊆ (b ∪ c))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of subset_bigger_union_right.

Q.E.D.

C.142.5 More_Sets_Lemmas.union_empty_left

Terse proof for union_empty_left.
union_empty_left:

{1} ∀ (a: set[T ]): (emptyset ∪ a) = a

Repeatedly Skolemizing and flattening, Rewriting using union_commutative, matching in *, Rewriting using union_empty, matching in *, This completes the proof of union_empty_left. Q.E.D.

C.142.6 More_Sets_Lemmas.union_left

Terse proof for union_left.

union_left:

{1} ∀ (a, b: set[T ], e: T): a(e) ⊃ union(a, b)(e)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of union_left. Q.E.D.

C.142.7 More_Sets_Lemmas.union_right

Terse proof for union_right.

union_right:

{1} ∀ (a, b: set[T ], e: T): b(e) ⊃ union(a, b)(e)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of union_right. Q.E.D.

C.142.8 More_Sets_Lemmas.subset_of_differences

Terse proof for subset_of_differences.
subset_of_differences:

{1} ∀ (a, b, c: set[T ]): (a ⊆ b) ⊃ ((c \ b) ⊆ (c \ a))

Trying repeated skolemization, instantiation, and if-lifting,

C.142 Proofs for More_Sets_Lemmas (vfiasco-prelude.pvs)

This completes the proof of subset_of_differences. Q.E.D.

C.142.9 More_Sets_Lemmas.difference_disjoint_3

Terse proof for difference_disjoint_3.
difference_disjoint_3:

{1} ∀ (a, b: set[T ]): disjoint?((b \ a), a)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of difference_disjoint_3. Q.E.D.

C.142.10 More_Sets_Lemmas.subset_singleton

Terse proof for subset_singleton.
subset_singleton:

{1} ∀ (a: set[T ], e: T): (singleton(e) ⊆ a) = a(e)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subset_singleton. Q.E.D.

C.142.11 More_Sets_Lemmas.subset_member

Terse proof for subset_member.

subset_member:

{1} ∀ (a, b: set[T ], e: T): a(e) ∧ (a ⊆ b) ⊃ b(e)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of subset_member. Q.E.D.

C.142.12 More_Sets_Lemmas.disjoint_symmetric

Terse proof for disjoint_symmetric.
disjoint_symmetric:

{1} ∀ (a, b: set[T ]): disjoint?(a, b) = disjoint?(b, a)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of disjoint_symmetric. Q.E.D.

C.142.13 More_Sets_Lemmas.disjoint_mono

Terse proof for disjoint_mono.

disjoint_mono:

{1} ∀ (a_{1}, a_{2}, b_{1}, b_{2}: set[T ]):

(a_{1} ⊆ a_{2}) ∧ (b_{1} ⊆ b_{2}) ∧ disjoint?(a_{2}, b_{2}) ⊃ disjoint?(a_{1}, b_{1})

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of disjoint_mono. Q.E.D.

C.142.14 More_Sets_Lemmas.disjoint_subset_difference

Terse proof for disjoint_subset_difference.
disjoint_subset_difference:

{1} ∀ (a, b, c: set[T ]): (a ⊆ b) ∧ disjoint?(a, c) ⊃ (a ⊆ (b \ c))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of disjoint_subset_difference.

Q.E.D.

C.143 Proofs for Number_Props (vfiasco-prelude.pvs)

C.143.1 Number_Props.number_split

Terse proof for number_split.

number_split:

{1} ∀ (x: int, a: posnat): x = a × ndiv(x, a) + rem(a)(x)

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(x!1, a!1), Simplifying, rewriting, and recording with decision procedures, This completes the proof of number_split. Q.E.D.

C.143.2 Number_Props.number_split_less

Terse proof for number_split_less.
number_split_less:

{1} ∀ (a, b, p, q: nat): a < p ⊃ (a + b × p < p × q ≡ b < q)

Repeatedly Skolemizing and flattening, Applying both_sides_times_pos_le1 Instantiating the top quantifier in -1 with the terms: p′, b′ + 1, q′, we get 2 subgoals:

C.143 Proofs for Number_Props (vfiasco-prelude.pvs)

number_split_less.1:

\begin{matrix}\{-1\} & b′ + 1 × p′ ≤ q′ × p′ ≡ b′ + 1 ≤ q′ \\ \{-2\} & a′ ≥ 0 \\ \{-3\} & b′ ≥ 0 \\ \{-4\} & p′ ≥ 0 \\ \{-5\} & q′ ≥ 0 \\ \{-6\} & a′ < p′ \\ \{1\} & (a′ + b′ × p′ < p′ × q′ ≡ b′ < q′) \end{matrix}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Applying both_sides_times_pos_lt1 Instantiating the top quantifier in -1 with the terms: p′, b′, q′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of number_split_less.1.

number_split_less.2:

\begin{matrix}\{-1\} & a′ ≥ 0 \\ \{-2\} & b′ ≥ 0 \\ \{-3\} & p′ ≥ 0 \\ \{-4\} & q′ ≥ 0 \\ \{-5\} & a′ < p′ \\ \{1\} & p′ > 0 \\ \{2\} & (a′ + b′ × p′ < p′ × q′ ≡ b′ < q′) \end{matrix}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of number_split_less.2. Q.E.D.

C.143.3 Number_Props.bit_split_less

Terse proof for bit_split_less.
bit_split_less:

{1} ∀ (q, r, j, k: nat):
r < expt(2, k) ⊃
(q × expt(2, k) + r < expt(2, k + j) ≡ q < expt(2, j))

Repeatedly Skolemizing and flattening, Applying number_split_less Instantiating the top quantifier in -1 with the terms: r′, q′, expt(2, k′), expt(2, j′), Rewriting using expt_plus_aux, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of bit_split_less. Q.E.D.

C.143.4 Number_Props.rem_def_pos

Terse proof for rem_def_pos.

rem_def_pos:

{1} ∀ (b: posnat, x: nat):
∀ (r: mod(b)): rem(b)(x) = r ≡ (∃ (q: nat): x = b × q + r)

Repeatedly Skolemizing and flattening, Using lemma rem_def, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

rem_def_pos.1:

\begin{matrix}\{-1\} & rem(b′)(x′) = r′ \\ \{-2\} & ∃ q: x′ = b′ × q + r′ \\ \{-3\} & r′ < b′ \\ \{-4\} & b′ > 0 \\ \{-5\} & x′ ≥ 0 \\ \{1\} & ∃ (q: nat): x′ = b′ × q + r′ \end{matrix}

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Using lemma both_sides_times_pos_le2, Simplifying, rewriting, and recording with decision procedures, This completes the proof of rem_def_pos.1.

rem_def_pos.2:

\begin{matrix}\{-1\} & r′ < b′ \\ \{-2\} & b′ > 0 \\ \{-3\} & x′ ≥ 0 \\ \{-4\} & ∃ (q: nat): x′ = b′ × q + r′ \\ \{1\} & rem(b′)(x′) = r′ \\ \{2\} & ∃ q: x′ = b′ × q + r′ \end{matrix}

Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of rem_def_pos.2. Q.E.D.

C.143.5 Number_Props.rem_rem

Terse proof for rem_rem.

rem_rem:

{1} ∀ (a, b: posnat, x: int): divides(a, b) ⊃ rem(a)(rem(b)(x)) = rem(a)(x)

Repeatedly Skolemizing and flattening, Applying rem_def Instantiating the top quantifier in -1 with the terms: a′, x′, rem(a′)(rem(b′)(x′)), Simplifying, rewriting, and recording with decision procedures, Hiding formulas: 2, Adding type constraints for rem(a!1)(rem(b!1)(x!1)), Adding type constraints for rem(b!1)(x!1), Expanding the definition of divides, Repeatedly Skolemizing and flattening, Replacing using formula -7, Instantiating the top quantifier in 1 with the terms: q′′ + x′′ × q′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of rem_rem. Q.E.D.

C.143.6 Number_Props.divides_times

Terse proof for divides_times.

divides_times:

{1} ∀ (i: posnat, j, k: int):

divides(i × j, k) ≡ divides(i, k) ∧ divides(j, ndiv(k, i))

Repeatedly Skolemizing and flattening, Splitting conjunctions, we get 2 subgoals:

divides_times.1:

{-1} i′ > 0
{-2} integer_pred(j′)
{-3} integer_pred(k′)
{1} divides(i′ × j′, k′) ⊃ divides(i′, k′) ∧ divides(j′, ndiv(k′, i′))

Case splitting on divides(i!1, k!1), we get 2 subgoals:

divides_times.1.1:

{-1} divides(i′, k′)
{-2} i′ > 0
{-3} integer_pred(j′)
{-4} integer_pred(k′)
{1} divides(i′ × j′, k′) ⊃ divides(i′, k′) ∧ divides(j′, ndiv(k′, i′))

Applying propositional simplification, Adding type constraints for ndiv(k!1, i!1), Case splitting on rem(i!1)(k!1) = 0, we get 2 subgoals:

divides_times.1.1.1:

{-1} rem(i′)(k′) = 0
{-2} k′ = rem(i′)(k′) + i′ × ndiv(k′, i′)
{-3} divides(i′, k′)
{-4} divides(i′ × j′, k′)
{-5} i′ > 0
{-6} integer_pred(j′)
{-7} integer_pred(k′)
{1} divides(j′, ndiv(k′, i′))

Replacing using formula -1, Hiding formulas: -1, -3, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of divides, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: x′, Applying both_sides_times1 Instantiating the top quantifier in -1 with the terms: i′, ndiv(k′, i′), j′ × x′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of divides_times.1.1.1.

divides_times.1.1.2:

{-1} k′ = rem(i′)(k′) + i′ × ndiv(k′, i′)
{-2} divides(i′, k′)
{-3} divides(i′ × j′, k′)
{-4} i′ > 0
{-5} integer_pred(j′)
{-6} integer_pred(k′)
{1} rem(i′)(k′) = 0
{2} divides(j′, ndiv(k′, i′))

Rewriting using rem_def2, matching in *, This completes the proof of divides_times.1.1.2.

divides_times.1.2:

{-1} i′ > 0
{-2} integer_pred(j′)
{-3} integer_pred(k′)
{1} divides(i′, k′)
{2} divides(i′ × j′, k′) ⊃ divides(i′, k′) ∧ divides(j′, ndiv(k′, i′))

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of divides, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: x′ × j′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of divides_times.1.2.

divides_times.2:

{-1} i′ > 0
{-2} integer_pred(j′)
{-3} integer_pred(k′)
{1} divides(i′, k′) ∧ divides(j′, ndiv(k′, i′)) ⊃ divides(i′ × j′, k′)

Applying disjunctive simplification to flatten sequent, Adding type constraints for ndiv(k!1, i!1), Case splitting on rem(i!1)(k!1) = 0, we get 2 subgoals:

divides_times.2.1:

{-1} rem(i′)(k′) = 0
{-2} k′ = rem(i′)(k′) + i′ × ndiv(k′, i′)
{-3} divides(i′, k′)
{-4} divides(j′, ndiv(k′, i′))
{-5} i′ > 0
{-6} integer_pred(j′)
{-7} integer_pred(k′)
{1} divides(i′ × j′, k′)

Replacing using formula -1, Hiding formulas: -1, -3, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of divides, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: x′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of divides_times.2.1.

divides_times.2.2:

{-1} k′ = rem(i′)(k′) + i′ × ndiv(k′, i′)
{-2} divides(i′, k′)
{-3} divides(j′, ndiv(k′, i′))
{-4} i′ > 0
{-5} integer_pred(j′)
{-6} integer_pred(k′)
{1} rem(i′)(k′) = 0
{2} divides(i′ × j′, k′)

Rewriting using rem_def2, matching in *, This completes the proof of divides_times.2.2. Q.E.D.

C.143.7 Number_Props.ndiv_floor

Terse proof for ndiv_floor.

ndiv_floor:

{1} ∀ (a: int, b: posnat): ndiv(a, b) = floor(a/b)

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(a!1, b!1), Using lemma rem_floor, Applying unique_quotient Instantiating the top quantifier in -1 with the terms: b′, ndiv(a′, b′), floor(a′/b′), rem(b′)(a′),

rem(b′)(a′), Simplifying, rewriting, and recording with decision procedures, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_floor. Q.E.D.

C.143.8 Number_Props.ndiv_self

Terse proof for ndiv_self.

ndiv_self:

{1} ∀ (a: posnat): ndiv(a, a) = 1

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(a!1, a!1), Rewriting using rem_self, matching in *, Simplifying, rewriting, and recording with decision procedures, Applying both_sides_times2 Instantiating the top quantifier in -1 with the terms: a′, 1, ndiv(a′, a′), Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_self. Q.E.D.

C.143.9 Number_Props.ndiv_plus_1

Terse proof for ndiv_plus_1.

ndiv_plus_1:

{1} ∀ (a, b: int, c: posnat):
divides(c, a) ⊃ ndiv(a + b, c) = ndiv(a, c) + ndiv(b, c)

Repeatedly Skolemizing and flattening, Applying rem_def2 Instantiating the top quantifier in -1 with the terms: c′, a′, 0, Simplifying, rewriting, and recording with decision procedures, Adding type constraints for ndiv(a!1 + b!1, c!1), Applying rem_sum1 Instantiating the top quantifier in -1 with the terms: c′, a′, b′, Replacing using formula -3, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Adding type constraints for ndiv(a!1, c!1), Adding type constraints for ndiv(b!1, c!1), Case splitting on c!1 * (ndiv(a!1, c!1) + ndiv(b!1, c!1)) = c!1 * ndiv(a!1 + b!1, c!1), we get 2 subgoals:

ndiv_plus_1.1:

{-1} c′ × (ndiv(a′, c′) + ndiv(b′, c′)) = c′ × ndiv(a′ + b′, c′)
{-2} b′ = rem(c′)(b′) + c′ × ndiv(b′, c′)
{-3} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-4} a′ + b′ = rem(c′)(b′) + c′ × ndiv(a′ + b′, c′)
{-5} rem(c′)(a′) = 0
{-6} integer_pred(a′)
{-7} integer_pred(b′)
{-8} c′ > 0
{-9} divides(c′, a′)
{1} ndiv(a′ + b′, c′) = ndiv(a′, c′) + ndiv(b′, c′)

Applying both_sides_times2 Instantiating the top quantifier in -1 with the terms: c′, (ndiv(a′, c′) + ndiv(b′, c′)), ndiv(a′ + b′, c′), Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_plus_1.1.

ndiv_plus_1.2:

{-1} b′ = rem(c′)(b′) + c′ × ndiv(b′, c′)
{-2} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-3} a′ + b′ = rem(c′)(b′) + c′ × ndiv(a′ + b′, c′)
{-4} rem(c′)(a′) = 0
{-5} integer_pred(a′)
{-6} integer_pred(b′)
{-7} c′ > 0
{-8} divides(c′, a′)
{1} c′ × (ndiv(a′, c′) + ndiv(b′, c′)) = c′ × ndiv(a′ + b′, c′)
{2} ndiv(a′ + b′, c′) = ndiv(a′, c′) + ndiv(b′, c′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_plus_1.2.

Q.E.D.

C.143.10 Number_Props.ndiv_plus_2

Terse proof for ndiv_plus_2.

ndiv_plus_2:

{1} ∀ (a, b: int, c: posnat):

divides(c, b) ⊃ ndiv(a + b, c) = ndiv(a, c) + ndiv(b, c)

Repeatedly Skolemizing and flattening, Using lemma ndiv_plus_1, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_plus_2. Q.E.D.

C.143.11 Number_Props.ndiv_plus_mod

Terse proof for ndiv_plus_mod.

ndiv_plus_mod:

{1} ∀ (a: int, c: posnat, b: mod(c)):

divides(c, a) ⊃ ndiv(a + b, c) = ndiv(a, c)

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(a!1, c!1), Case splitting on rem(c!1)(a!1) = 0, we get 2 subgoals:

ndiv_plus_mod.1:

{-1} rem(c′)(a′) = 0
{-2} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-3} integer_pred(a′)
{-4} c′ > 0
{-5} b′ < c′
{-6} divides(c′, a′)
{1} ndiv(a′ + b′, c′) = ndiv(a′, c′)

Replacing using formula -1, Hiding formulas: -1, Simplifying, rewriting, and recording with decision procedures, Adding type constraints for ndiv(a!1 + b!1, c!1), Case splitting on rem(c!1)(a!1 + b!1) = b!1, we get 2 subgoals:

ndiv_plus_mod.1.1:

{-1} rem(c′)(a′ + b′) = b′
{-2} a′ + b′ = rem(c′)(a′ + b′) + c′ × ndiv(a′ + b′, c′)
{-3} a′ = c′ × ndiv(a′, c′)
{-4} integer_pred(a′)
{-5} c′ > 0
{-6} b′ < c′
{-7} divides(c′, a′)
{1} ndiv(a′ + b′, c′) = ndiv(a′, c′)

Replacing using formula -1, Hiding formulas: -1, Simplifying, rewriting, and recording with decision procedures, Applying both_sides_times2 Instantiating the top quantifier in -1 with the terms: c′, ndiv(a′ + b′, c′), ndiv(a′, c′), Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_plus_mod.1.1.

ndiv_plus_mod.1.2:

{-1} a′ + b′ = rem(c′)(a′ + b′) + c′ × ndiv(a′ + b′, c′)
{-2} a′ = c′ × ndiv(a′, c′)
{-3} integer_pred(a′)
{-4} c′ > 0
{-5} b′ < c′
{-6} divides(c′, a′)
{1} rem(c′)(a′ + b′) = b′
{2} ndiv(a′ + b′, c′) = ndiv(a′, c′)

Hiding formulas: -1, -2, 2, Rewriting using rem_def, matching in *, Expanding the definition of divides, which is trivially true. This completes the proof of ndiv_plus_mod.1.2.

ndiv_plus_mod.2:

{-1} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-2} integer_pred(a′)
{-3} c′ > 0
{-4} b′ < c′
{-5} divides(c′, a′)
{1} rem(c′)(a′) = 0
{2} ndiv(a′ + b′, c′) = ndiv(a′, c′)

Rewriting using rem_def2, matching in *, This completes the proof of ndiv_plus_mod.2. Q.E.D.

C.143.12 Number_Props.ndiv_plus_mod_2

Terse proof for ndiv_plus_mod_2.

ndiv_plus_mod_2:

{1} ∀ (a: int, c: posnat, b_{1}, b_{2}: mod(c)):

divides(c, a) ⊃ ndiv(a + b_{1}, c) = ndiv(a + b_{2}, c)

Repeatedly Skolemizing and flattening, Applying ndiv_plus_mod Instantiating (with copying) the top quantifier in -1 with the terms: a′, c′, b′_{1}, Instantiating the top quantifier in -1 with the terms: a′, c′, b′_{2}, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_plus_mod_2. Q.E.D.

C.143.13 Number_Props.ndiv_minus_2

Terse proof for ndiv_minus_2.

ndiv_minus_2:

{1} ∀ (a, b: int, c: posnat):

divides(c, b) ⊃ ndiv(a − b, c) = ndiv(a, c) − ndiv(b, c)

Repeatedly Skolemizing and flattening, Applying ndiv_plus_2 Instantiating the top quantifier in -1 with the terms: a′, −b′, c′, Case splitting on divides(c!1, -b!1), we get 2 subgoals:

ndiv_minus_2.1:

{-1} divides(c′, −b′)
{-2} divides(c′, −b′) ⊃

ndiv(a′ + −b′, c′) = ndiv(a′, c′) + ndiv(−b′, c′)

{-3} integer_pred(a′)
{-4} integer_pred(b′)
{-5} c′ > 0
{-6} divides(c′, b′)
{1} ndiv(a′ − b′, c′) = ndiv(a′, c′) − ndiv(b′, c′)

Simplifying, rewriting, and recording with decision procedures, Case splitting on -ndiv(b!1, c!1) = ndiv(-b!1, c!1), we get 2 subgoals:

ndiv_minus_2.1.1:

{-1} −ndiv(b′, c′) = ndiv(−b′, c′)
{-2} divides(c′, −b′)
{-3} ndiv(−b′ + a′, c′) = ndiv(−b′, c′) + ndiv(a′, c′)
{-4} integer_pred(a′)
{-5} integer_pred(b′)
{-6} c′ > 0
{-7} divides(c′, b′)
{1} ndiv(a′ − b′, c′) = ndiv(a′, c′) − ndiv(b′, c′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_minus_2.1.1.

ndiv_minus_2.1.2:

{-1} divides(c′, −b′)
{-2} ndiv(−b′ + a′, c′) = ndiv(−b′, c′) + ndiv(a′, c′)
{-3} integer_pred(a′)
{-4} integer_pred(b′)
{-5} c′ > 0
{-6} divides(c′, b′)
{1} −ndiv(b′, c′) = ndiv(−b′, c′)
{2} ndiv(a′ − b′, c′) = ndiv(a′, c′) − ndiv(b′, c′)

Hiding formulas: -2, 2, Adding type constraints for ndiv(b!1, c!1), Adding type constraints for ndiv(-b!1, c!1), Case splitting on rem(c!1)(-b!1) = 0, we get 2 subgoals:

ndiv_minus_2.1.2.1:

{-1} rem(c′)(−b′) = 0
{-2} −b′ = rem(c′)(−b′) + c′ × ndiv(−b′, c′)
{-3} b′ = rem(c′)(b′) + c′ × ndiv(b′, c′)
{-4} divides(c′, −b′)
{-5} integer_pred(a′)
{-6} integer_pred(b′)
{-7} c′ > 0
{-8} divides(c′, b′)
{1} −ndiv(b′, c′) = ndiv(−b′, c′)

Case splitting on rem(c!1)(b!1) = 0, we get 2 subgoals:

ndiv_minus_2.1.2.1.1:

{-1} rem(c′)(b′) = 0
{-2} rem(c′)(−b′) = 0
{-3} −b′ = rem(c′)(−b′) + c′ × ndiv(−b′, c′)
{-4} b′ = rem(c′)(b′) + c′ × ndiv(b′, c′)
{-5} divides(c′, −b′)
{-6} integer_pred(a′)
{-7} integer_pred(b′)
{-8} c′ > 0
{-9} divides(c′, b′)
{1} −ndiv(b′, c′) = ndiv(−b′, c′)

Replacing using formula -1, Replacing using formula -2, Hiding formulas: -1, -2, Simplifying, rewriting, and recording with decision procedures, Applying both_sides_times2 Instantiating the top quantifier in -1 with the terms: c′, −ndiv(b′, c′), ndiv(−b′, c′), Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_minus_2.1.2.1.1.

ndiv_minus_2.1.2.1.2:

{-1} rem(c′)(−b′) = 0
{-2} −b′ = rem(c′)(−b′) + c′ × ndiv(−b′, c′)
{-3} b′ = rem(c′)(b′) + c′ × ndiv(b′, c′)
{-4} divides(c′, −b′)
{-5} integer_pred(a′)
{-6} integer_pred(b′)
{-7} c′ > 0
{-8} divides(c′, b′)
{1} rem(c′)(b′) = 0
{2} −ndiv(b′, c′) = ndiv(−b′, c′)

Rewriting using rem_def2, matching in *, This completes the proof of ndiv_minus_2.1.2.1.2.

ndiv_minus_2.1.2.2:

{-1} −b′ = rem(c′)(−b′) + c′ × ndiv(−b′, c′)
{-2} b′ = rem(c′)(b′) + c′ × ndiv(b′, c′)
{-3} divides(c′, −b′)
{-4} integer_pred(a′)
{-5} integer_pred(b′)
{-6} c′ > 0
{-7} divides(c′, b′)
{1} rem(c′)(−b′) = 0
{2} −ndiv(b′, c′) = ndiv(−b′, c′)

Rewriting using rem_def2, matching in *, This completes the proof of ndiv_minus_2.1.2.2.

ndiv_minus_2.2:

{-1} divides(c′, −b′) ⊃

ndiv(a′ + −b′, c′) = ndiv(a′, c′) + ndiv(−b′, c′)

{-2} integer_pred(a′)
{-3} integer_pred(b′)
{-4} c′ > 0
{-5} divides(c′, b′)
{1} divides(c′, −b′)
{2} ndiv(a′ − b′, c′) = ndiv(a′, c′) − ndiv(b′, c′)

Hiding formulas: -1, 2, Expanding the definition of divides, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in 1 with the terms: −x′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_minus_2.2. Q.E.D.

C.143.14 Number_Props.ndiv_times_divident_1

Terse proof for ndiv_times_divident_1.
ndiv_times_divident_1:

{1} ∀ (a, b: int, c: posnat):

divides(c, a) ⊃ ndiv(a × b, c) = ndiv(a, c) × b Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(a!1 * b!1, c!1), Adding type constraints for ndiv(a!1, c!1), Case splitting on rem(c!1)(a!1) = 0, we get 2 subgoals:

ndiv_times_divident_1.1:

{-1} rem(c′)(a′) = 0
{-2} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-3} a′ × b′ = rem(c′)(a′ × b′) + c′ × ndiv(a′ × b′, c′)
{-4} integer_pred(a′)
{-5} integer_pred(b′)
{-6} c′ > 0
{-7} divides(c′, a′)
{1} ndiv(a′ × b′, c′) = ndiv(a′, c′) × b′

Replacing using formula -1, Hiding formulas: -1, Case splitting on rem(c!1)(a!1 * b!1) = 0, we get 2 subgoals:

ndiv_times_divident_1.1.1:

{-1} rem(c′)(a′ × b′) = 0
{-2} a′ = 0 + c′ × ndiv(a′, c′)
{-3} a′ × b′ = rem(c′)(a′ × b′) + c′ × ndiv(a′ × b′, c′)
{-4} integer_pred(a′)
{-5} integer_pred(b′)
{-6} c′ > 0
{-7} divides(c′, a′)
{1} ndiv(a′ × b′, c′) = ndiv(a′, c′) × b′

Replacing using formula -1, Hiding formulas: -1, Simplifying, rewriting, and recording with decision procedures, Applying both_sides_times2 Instantiating the top quantifier in -1 with the terms: c′, ndiv(a′, c′) × b′, ndiv(a′ × b′, c′), Simplifying, rewriting, and recording with decision procedures,

This completes the proof of ndiv_times_divident_1.1.1.
ndiv_times_divident_1.1.2:

{-1} a′ = 0 + c′ × ndiv(a′, c′)
{-2} a′ × b′ = rem(c′)(a′ × b′) + c′ × ndiv(a′ × b′, c′)
{-3} integer_pred(a′)
{-4} integer_pred(b′)
{-5} c′ > 0
{-6} divides(c′, a′)
{1} rem(c′)(a′ × b′) = 0
{2} ndiv(a′ × b′, c′) = ndiv(a′, c′) × b′

Rewriting using rem_def2, matching in *, Rewriting using divides_prod1, matching in *,

This completes the proof of ndiv_times_divident_1.1.2.

ndiv_times_divident_1.2:

{-1} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-2} a′ × b′ = rem(c′)(a′ × b′) + c′ × ndiv(a′ × b′, c′)
{-3} integer_pred(a′)
{-4} integer_pred(b′)
{-5} c′ > 0
{-6} divides(c′, a′)
{1} rem(c′)(a′) = 0
{2} ndiv(a′ × b′, c′) = ndiv(a′, c′) × b′

Rewriting using rem_def2, matching in *, This completes the proof of ndiv_times_divident_1.2. Q.E.D.

C.143.15 Number_Props.ndiv_times_divident_2

Terse proof for ndiv_times_divident_2.
ndiv_times_divident_2:

{1} ∀ (a, b: int, c: posnat):

divides(c, b) ⊃ ndiv(a × b, c) = a × ndiv(b, c)

Repeatedly Skolemizing and flattening, Applying ndiv_times_divident_1 Instantiating the top quantifier in -1 with the terms: b′, a′, c′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_times_divident_2. Q.E.D.

C.143.16 Number_Props.rem_prod_3

Terse proof for rem_prod_3.

rem_prod_3:

{1} ∀ (b_{1}, b_{2}: posnat, x: int):

rem(b_{1} × b_{2})(x) = rem(b_{1})(x) + rem(b_{2})(ndiv(x, b_{1})) × b_{1}

Installing automatic rewrites from: ndiv_self divides_reflexive rem_def2 Repeatedly Skolemizing and flattening, Rewriting using rem_def2, matching in *, we get 2 subgoals:

rem_prod_3.1:

{-1} b′_{1} > 0
{-2} b′_{2} > 0
{-3} integer_pred(x′)
{1} divides(b′_{1} × b′_{2},
−1 × rem(b′_{1})(x′) − rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1} + x′)

Rewriting using divides_times, matching in *, Applying propositional simplification, we get 2 subgoals:

rem_prod_3.1.1:

{-1} b′_{1} > 0
{-2} b′_{2} > 0
{-3} integer_pred(x′)
{1} divides(b′_{1},
−1 × rem(b′_{1})(x′) − rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1} + x′)

Applying divides_diff Instantiating the top quantifier in -1 with the terms: rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1}, x′ − rem(b′_{1})(x′), b′_{1}, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: 2, Applying propositional simplification, we get 2 subgoals:

rem_prod_3.1.1.1:

{-1} b′_{1} > 0
{-2} b′_{2} > 0
{-3} integer_pred(x′)
{1} divides(b′_{1}, x′ − rem(b′_{1})(x′))

Using lemma rem_def2, Simplifying, rewriting, and recording with decision procedures, This completes the proof of rem_prod_3.1.1.1.

rem_prod_3.1.1.2:

{-1} b′_{1} > 0
{-2} b′_{2} > 0
{-3} integer_pred(x′)
{1} divides(b′_{1}, rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1})

Using lemma divides_prod2, Simplifying, rewriting, and recording with decision procedures, This completes the proof of rem_prod_3.1.1.2.

rem_prod_3.1.2:

{-1} b′_{1} > 0
{-2} b′_{2} > 0
{-3} integer_pred(x′)
{1} divides(b′_{2},
ndiv(−1 × rem(b′_{1})(x′) − rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1} + x′,
b′_{1}))

Applying ndiv_minus_2 Instantiating the top quantifier in -1 with the terms: x′ − rem(b′_{1})(x′), rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1}, b′_{1}, Splitting conjunctions, we get 2 subgoals:

rem_prod_3.1.2.1:

{-1} ndiv(x′ − rem(b′_{1})(x′) − rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1}, b′_{1}) =
ndiv(x′ − rem(b′_{1})(x′), b′_{1}) − ndiv(rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1}, b′_{1})
{-2} b′_{1} > 0
{-3} b′_{2} > 0
{-4} integer_pred(x′)
{1} divides(b′_{2},
ndiv(−1 × rem(b′_{1})(x′) − rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1} + x′,
b′_{1}))

Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Applying ndiv_times_divident_2 Instantiating the top quantifier in -1 with the terms: rem(b′_{2})(ndiv(x′, b′_{1})), b′_{1}, b′_{1}, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Hiding formulas: -1, Applying ndiv_plus_mod Instantiating the top quantifier in -1 with the terms: x′ − rem(b′_{1})(x′), b′_{1}, rem(b′_{1})(x′), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

rem_prod_3.1.2.1.1:

{-1} ndiv(x′, b′_{1}) = ndiv(x′ − rem(b′_{1})(x′), b′_{1})
{-2} b′_{1} > 0
{-3} b′_{2} > 0
{-4} integer_pred(x′)
{1} divides(b′_{2}, ndiv(x′ − rem(b′_{1})(x′), b′_{1}) − rem(b′_{2})(ndiv(x′, b′_{1})))

Replacing using formula -1, Hiding formulas: -1, Adding type constraints for rem(b2!1)(ndiv(x!1, b1!1)), Repeatedly Skolemizing and flattening, Expanding the definition of divides, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of rem_prod_3.1.2.1.1.

rem_prod_3.1.2.1.2:

{-1} b′_{1} > 0
{-2} b′_{2} > 0
{-3} integer_pred(x′)
{1} divides(b′_{1}, x′ − rem(b′_{1})(x′))
{2} divides(b′_{2}, ndiv(x′ − rem(b′_{1})(x′), b′_{1}) − rem(b′_{2})(ndiv(x′, b′_{1})))

Hiding formulas: 2, Adding type constraints for rem(b1!1)(x!1), Repeatedly Skolemizing and flattening, Expanding the definition of divides, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of rem_prod_3.1.2.1.2.

rem_prod_3.1.2.2:

{-1} b′_{1} > 0
{-2} b′_{2} > 0
{-3} integer_pred(x′)
{1} divides(b′_{1}, rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1})
{2} divides(b′_{2},

ndiv(−1 × rem(b′_{1})(x′) − rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1} + x′,

b′_{1}))

Hiding formulas: 2, Using lemma divides_prod2, Simplifying, rewriting, and recording with decision procedures, This completes the proof of rem_prod_3.1.2.2.

rem_prod_3.2:

{-1} b′_{1} > 0
{-2} b′_{2} > 0
{-3} integer_pred(x′)
{1} rem(b′_{1})(x′) + rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1} < b′_{1} × b′_{2}
{2} rem(b′_{1} × b′_{2})(x′) =
rem(b′_{1})(x′) + rem(b′_{2})(ndiv(x′, b′_{1})) × b′_{1}

Hiding formulas: 2, Applying number_split_less Instantiating the top quantifier in -1 with the terms: rem(b′_{1})(x′), rem(b′_{2})(ndiv(x′, b′_{1})), b′_{1}, b′_{2}, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of rem_prod_3.2. Q.E.D.

C.143.17 Number_Props.ndiv_times_2

Terse proof for ndiv_times_2.

ndiv_times_2:

{1} ∀ (a: int, b, c: posnat): ndiv(a, b × c) = ndiv(ndiv(a, b), c)

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(a!1, b!1), Adding type constraints for ndiv(a!1, b!1 * c!1), Adding type constraints for ndiv(ndiv(a!1, b!1), c!1), Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures, Rewriting using rem_prod_3, matching in *, Hiding formulas: -1, Applying both_sides_times1 Instantiating the top quantifier in -1 with the terms: b′ × c′, ndiv(a′, b′ × c′), ndiv(ndiv(a′, b′), c′), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of ndiv_times_2. Q.E.D.

C.143.18 Number_Props.both_sides_ndiv_lt1

Terse proof for both_sides_ndiv_lt1.
both_sides_ndiv_lt1:

{1} ∀ (a, b: int, c: posnat): a < b ∧ divides(c, b) ⊃ ndiv(a, c) < ndiv(b, c)

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(a!1, c!1), Adding type constraints for ndiv(b!1, c!1), Case splitting on rem(c!1)(b!1) = 0, we get 2 subgoals:

both_sides_ndiv_lt1.1:

{-1} rem(c′)(b′) = 0
{-2} b′ = rem(c′)(b′) + c′ × ndiv(b′, c′)
{-3} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-4} integer_pred(a′)
{-5} integer_pred(b′)
{-6} c′ > 0
{-7} a′ < b′
{-8} divides(c′, b′)
{1} ndiv(a′, c′) < ndiv(b′, c′)

Replacing using formula -1, Hiding formulas: -1, Simplifying, rewriting, and recording with decision procedures, Applying both_sides_times_pos_ge2 Instantiating the top quantifier in -1 with the terms: c′, ndiv(a′, c′), ndiv(b′, c′), Simplifying, rewriting, and recording with decision procedures, This completes the proof of both_sides_ndiv_lt1.1.

both_sides_ndiv_lt1.2:

{-1} b′ = rem(c′)(b′) + c′ × ndiv(b′, c′)
{-2} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-3} integer_pred(a′)
{-4} integer_pred(b′)
{-5} c′ > 0
{-6} a′ < b′
{-7} divides(c′, b′)
{1} rem(c′)(b′) = 0
{2} ndiv(a′, c′) < ndiv(b′, c′)

Rewriting using rem_def2, matching in *, This completes the proof of both_sides_ndiv_lt1.2. Q.E.D.

C.143.19 Number_Props.rem_ndiv

Terse proof for rem_ndiv.

rem_ndiv:

{1} ∀ (a: posnat, b: int, c: posnat): rem(a)(ndiv(b, c)) = ndiv(rem(c × a)(b), c)

Repeatedly Skolemizing and flattening, Rewriting using rem_prod_3, matching in *, Applying ndiv_plus_mod Instantiating the top quantifier in -1 with the terms: rem(a′)(ndiv(b′, c′)) × c′, c′, rem(c′)(b′), Rewriting using divides_prod2, matching in *, we get 2 subgoals:

rem_ndiv.1:

{-1} ndiv(rem(a′)(ndiv(b′, c′)) × c′ + rem(c′)(b′), c′) =

ndiv(rem(a′)(ndiv(b′, c′)) × c′, c′)
{-2} a′ > 0
{-3} integer_pred(b′)
{-4} c′ > 0
{1} rem(a′)(ndiv(b′, c′)) =

ndiv(rem(c′)(b′) + rem(a′)(ndiv(b′, c′)) × c′, c′)

Replacing using formula -1, Hiding formulas: -1, Rewriting using ndiv_times_divident_2, matching in *, we get 2 subgoals:

rem_ndiv.1.1:

{-1} a′ > 0
{-2} integer_pred(b′)
{-3} c′ > 0
{1} rem(a′)(ndiv(b′, c′)) = rem(a′)(ndiv(b′, c′)) × ndiv(c′, c′)

Rewriting using ndiv_self, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of rem_ndiv.1.1.

rem_ndiv.1.2:

{-1} a′ > 0
{-2} integer_pred(b′)
{-3} c′ > 0
{1} divides(c′, c′)
{2} rem(a′)(ndiv(b′, c′)) = ndiv(rem(a′)(ndiv(b′, c′)) × c′, c′)

Rewriting using divides_reflexive, matching in *, This completes the proof of rem_ndiv.1.2.

rem_ndiv.2:

{-1} divides(c′, rem(a′)(ndiv(b′, c′)) × c′) ⊃ ndiv(rem(c′)(b′) + rem(a′)(ndiv(b′, c′)) × c′, c′) =

ndiv(rem(a′)(ndiv(b′, c′)) × c′, c′)
{-2} a′ > 0
{-3} integer_pred(b′)
{-4} c′ > 0
{1} divides(c′, c′)
{2} rem(a′)(ndiv(b′, c′)) =

ndiv(rem(c′)(b′) + rem(a′)(ndiv(b′, c′)) × c′, c′)

Rewriting using divides_reflexive, matching in *, This completes the proof of rem_ndiv.2. Q.E.D.

C.143.20 Number_Props.mod_rem

Terse proof for mod_rem.

mod_rem:

{1} ∀ (i: int, b: posnat): mod(i, b) = rem(b)(i)

Repeatedly Skolemizing and flattening, Expanding the definition of mod, Using lemma rem_floor, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of mod_rem. Q.E.D.

C.143.21 Number_Props.ndiv_rem_divisible_TCC1

Terse proof for ndiv_rem_divisible_TCC1.
ndiv_rem_divisible_TCC1:

{1} ∀ (a, c: posnat): divides(c, a) ∧ c ≤ a ⊃ ndiv(a, c) > 0

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(a!1, c!1), Case splitting on rem(c!1)(a!1) = 0, we get 2 subgoals:

ndiv_rem_divisible_TCC1.1:

{-1} rem(c′)(a′) = 0
{-2} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-3} ndiv(a′, c′) ≤ a′
{-4} a′ > 0
{-5} c′ > 0
{-6} divides(c′, a′)
{-7} c′ ≤ a′
{1} ndiv(a′, c′) > 0

Replacing using formula -1, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of ndiv_rem_divisible_TCC1.1.
ndiv_rem_divisible_TCC1.2:

{-1} a′ = rem(c′)(a′) + c′ × ndiv(a′, c′)
{-2} ndiv(a′, c′) ≤ a′
{-3} a′ > 0
{-4} c′ > 0
{-5} divides(c′, a′)
{-6} c′ ≤ a′
{1} rem(c′)(a′) = 0
{2} ndiv(a′, c′) > 0

Rewriting using rem_def2, matching in *,

This completes the proof of ndiv_rem_divisible_TCC1.2.

Q.E.D.

C.143.22 Number_Props.ndiv_rem_divisible

Terse proof for ndiv_rem_divisible.

ndiv_rem_divisible:

{1} ∀ (a, c: posnat, b: int): divides(c, a) ∧ c ≤ a ⊃ ndiv(rem(a)(b), c) = rem(ndiv(a, c))(ndiv(b, c))

Repeatedly Skolemizing and flattening, Expanding the definition of divides, Repeatedly Skolemizing and flattening, Replacing using formula -5, Rewriting using rem_ndiv, matching in *, we get 2 subgoals:

ndiv_rem_divisible.1:

{-1} integer_pred(x′)
{-2} c′ × x′ > 0
{-3} c′ > 0
{-4} integer_pred(b′)
{-5} a′ = c′ × x′
{-6} c′ ≤ c′ × x′
{1} rem(x′)(ndiv(b′, c′)) = rem(ndiv(c′ × x′, c′))(ndiv(b′, c′))

Rewriting using ndiv_times_divident_1, matching in *, we get 2 subgoals:

ndiv_rem_divisible.1.1:

{-1} integer_pred(x′)
{-2} c′ × x′ > 0
{-3} c′ > 0
{-4} integer_pred(b′)
{-5} a′ = c′ × x′
{-6} c′ ≤ c′ × x′
{1} rem(x′)(ndiv(b′, c′)) = rem(ndiv(c′, c′) × x′)(ndiv(b′, c′))

Rewriting using ndiv_self, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_rem_divisible.1.1.

ndiv_rem_divisible.1.2:

{-1} integer_pred(x′)
{-2} c′ × x′ > 0
{-3} c′ > 0
{-4} integer_pred(b′)
{-5} a′ = c′ × x′
{-6} c′ ≤ c′ × x′
{1} divides(c′, c′)
{2} rem(x′)(ndiv(b′, c′)) = rem(ndiv(c′ × x′, c′))(ndiv(b′, c′))

Rewriting using divides_reflexive, matching in *, This completes the proof of ndiv_rem_divisible.1.2.

ndiv_rem_divisible.2:

{-1} integer_pred(x′)
{-2} c′ × x′ > 0
{-3} c′ > 0
{-4} integer_pred(b′)
{-5} a′ = c′ × x′
{-6} c′ ≤ c′ × x′
{1} x′ ≥ 0 ∧ x′ > 0
{2} ndiv(rem(c′ × x′)(b′), c′) =
rem(ndiv(c′ × x′, c′))(ndiv(b′, c′))

Applying both_sides_times_pos_gt2 Instantiating the top quantifier in -1 with the terms: c′, x′, 0, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_rem_divisible.2. Q.E.D.

C.143.23 Number_Props.expt_2_8

Terse proof for expt_2_8.

expt_2_8:

{1} expt(2, 8) = 256

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of expt_2_8. Q.E.D.

C.143.24 Number_Props.ndiv_0

Terse proof for ndiv_0.

ndiv_0:

{1} ∀ (b: posnat): ndiv(0, b) = 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ndiv_0. Q.E.D.

C.143.25 Number_Props.ndiv_1

Terse proof for ndiv_1.

ndiv_1:

{1} ∀ (i: int): ndiv(i, 1) = i

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(i!1, 1), Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_1. Q.E.D.

C.143.26 Number_Props.ndiv_bigger

Terse proof for ndiv_bigger.

ndiv_bigger:

{1} ∀ (n: nat, m: posnat): n < m ⊃ ndiv(n, m) = 0

Repeatedly Skolemizing and flattening, Adding type constraints for ndiv(n!1, m!1), Rewriting using rem_mod2, matching in *, Simplifying, rewriting, and recording with decision procedures, Applying both_sides_times2 Instantiating the top quantifier in -1 with the terms: m′, 0, ndiv(n′, m′), Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_bigger. Q.E.D.

C.143.27 Number_Props.ndiv_reduce

Terse proof for ndiv_reduce.

ndiv_reduce:

{1} ∀ (a: int, b: posnat, c: int, d: posnat):

a × d = b × c ⊃ ndiv(a, b) = ndiv(c, d)

Repeatedly Skolemizing and flattening, Rewriting using ndiv_floor, matching in *, Rewriting using ndiv_floor, matching in *, Case splitting on a!1 / b!1 = c!1 / d!1, we get 2 subgoals:

ndiv_reduce.1:

{-1} a′/b′ = c′/d′
{-2} integer_pred(a′)
{-3} b′ > 0
{-4} integer_pred(c′)
{-5} d′ > 0
{-6} a′ × d′ = b′ × c′
{1} floor(a′/b′) = floor(c′/d′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_reduce.1.

ndiv_reduce.2:

{-1} integer_pred(a′)
{-2} b′ > 0
{-3} integer_pred(c′)
{-4} d′ > 0
{-5} a′ × d′ = b′ × c′
{1} a′/b′ = c′/d′
{2} floor(a′/b′) = floor(c′/d′)

Case splitting on a!1 / b!1 * b!1 = c!1 / d!1 * b!1, we get 2 subgoals:

ndiv_reduce.2.1:

{-1} a′/b′ × b′ = c′/d′ × b′
{-2} integer_pred(a′)
{-3} b′ > 0
{-4} integer_pred(c′)
{-5} d′ > 0
{-6} a′ × d′ = b′ × c′
{1} a′/b′ = c′/d′
{2} floor(a′/b′) = floor(c′/d′)

Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_reduce.2.1.

ndiv_reduce.2.2:

{-1} integer_pred(a′)
{-2} b′ > 0
{-3} integer_pred(c′)
{-4} d′ > 0
{-5} a′ × d′ = b′ × c′
{1} a′/b′ × b′ = c′/d′ × b′
{2} a′/b′ = c′/d′
{3} floor(a′/b′) = floor(c′/d′)

Applying both_sides_times1 Instantiating the top quantifier in -1 with the terms: d′, a′/b′ × b′, c′/d′ × b′, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_reduce.2.2. Q.E.D.

C.143.28 Number_Props.ndiv_expt_expt_TCC1

Terse proof for ndiv_expt_expt_TCC1.
ndiv_expt_expt_TCC1:

{1} ∀ (a: posnat, n, m: nat): ¬ n < m ∧ a > 1 ⊃ n − m ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ndiv_expt_expt_TCC1. Q.E.D.

C.143.29 Number_Props.ndiv_expt_expt

Terse proof for ndiv_expt_expt.
ndiv_expt_expt:

{1} ∀ (a: posnat, n, m: nat):

a > 1 ⊃ ndiv(expt(a, n), expt(a, m)) = if n < m then 0 else expt(a, n − m) endif

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

ndiv_expt_expt.1:

{-1} a′ > 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} a′ > 1
{-5} n′ < m′
{1} ndiv(expt(a′, n′), expt(a′, m′)) = 0

Rewriting using ndiv_bigger, matching in *, Applying both_sides_expt_gt1_lt_aux Instantiating the top quantifier in -1 with the terms: a′, n′ − 1, m′ − 1, we get 2 subgoals:

ndiv_expt_expt.1.1:

{-1} expt(a′, n′ − 1 + 1) < expt(a′, m′ − 1 + 1) ≡

n′ − 1 < m′ − 1

{-2} a′ > 0
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} a′ > 1
{-6} n′ < m′
{1} expt(a′, n′) < expt(a′, m′)
{2} ndiv(expt(a′, n′), expt(a′, m′)) = 0

Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_expt_expt.1.1.

ndiv_expt_expt.1.2:

{-1} a′ > 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} a′ > 1
{-5} n′ < m′
{1} n′ − 1 ≥ 0
{2} expt(a′, n′) < expt(a′, m′)
{3} ndiv(expt(a′, n′), expt(a′, m′)) = 0

Expanding the definition of expt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Applying increasing_expt_aux Instantiating the top quantifier in -1 with the terms: a′, m′ − 2, we get 2 subgoals:

ndiv_expt_expt.1.2.1:

{-1} expt(a′, m′ − 2 + 2) > a′
{-2} a′ > 0
{-3} n′ ≥ 0
{-4} m′ ≥ 0
{-5} a′ > 1
{-6} n′ < m′
{1} n′ − 1 ≥ 0
{2} 1 < expt(a′, m′)
{3} ndiv(expt(a′, n′), expt(a′, m′)) = 0

Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_expt_expt.1.2.1.

ndiv_expt_expt.1.2.2:

{-1} a′ > 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} a′ > 1
{-5} n′ < m′
{1} m′ − 2 ≥ 0
{2} n′ − 1 ≥ 0
{3} 1 < expt(a′, m′)
{4} ndiv(expt(a′, n′), expt(a′, m′)) = 0

Expanding the definition of expt, Expanding the definition of expt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of ndiv_expt_expt.1.2.2.

ndiv_expt_expt.2:

{-1} a′ > 0
{-2} n′ ≥ 0
{-3} m′ ≥ 0
{-4} a′ > 1
{1} n′ < m′
{2} ndiv(expt(a′, n′), expt(a′, m′)) = expt(a′, n′ − m′)

Applying ndiv_reduce Instantiating the top quantifier in -1 with the terms: expt(a′, n′), expt(a′, m′), expt(a′, n′ − m′), 1, Rewriting using expt_plus_aux, matching in *, Rewriting using ndiv_1, matching in *, Simplifying, rewriting, and recording with decision procedures, This completes the proof of ndiv_expt_expt.2. Q.E.D.

C.143.30 Number_Props.min_plus1_TCC1

Terse proof for min_plus1_TCC1.
min_plus1_TCC1:

{1} ∀ (P: (nonempty?[nat])):
¬ P (0) ⊃ nonempty?[nat](λ (n: nat): P (n + 1))

Repeatedly Skolemizing and flattening, Expanding the definition of nonempty?, Expanding the definition of empty?, Repeatedly Skolemizing and flattening, Expanding the definition of member, Case splitting on x!1 = 0, we get 2 subgoals:

min_plus1_TCC1.1:

\begin{matrix}\{-1\} & x′ = 0 \\ \{-2\} & x′ ≥ 0 \\ \{-3\} & P′(x′) \\ \{-4\} & ∀ (x: nat): ¬ P′(1 + x) \\ \{1\} & P′(0) \end{matrix}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of min_plus1_TCC1.1.

min_plus1_TCC1.2:

\begin{matrix}\{-1\} & x′ ≥ 0 \\ \{-2\} & P′(x′) \\ \{-3\} & ∀ (x: nat): ¬ P′(1 + x) \\ \{1\} & x′ = 0 \\ \{2\} & P′(0) \end{matrix}

Instantiating the top quantifier in -3 with the terms: x′ − 1, we get 2 subgoals:

min_plus1_TCC1.2.1:

\begin{matrix}\{-1\} & x′ ≥ 0 \\ \{-2\} & P′(x′) \\ \{1\} & x′ = 0 \\ \{2\} & P′(0) \\ \{3\} & P′(1 + x′ − 1) \end{matrix}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of min_plus1_TCC1.2.1.

min_plus1_TCC1.2.2:

\begin{matrix}\{-1\} & x′ ≥ 0 \\ \{-2\} & P′(x′) \\ \{1\} & x′ − 1 ≥ 0 \\ \{2\} & x′ = 0 \\ \{3\} & P′(0) \end{matrix}

Simplifying, rewriting, and recording with decision procedures, This completes the proof of min_plus1_TCC1.2.2. Q.E.D.

C.143.31 Number_Props.min_plus1

Terse proof for min_plus1.

min_plus1:

{1} ∀ (P: (nonempty?[nat])):

¬ P (0) ⊃ min(P) = min(λ (n : nat) : P (n + 1)) + 1

Repeatedly Skolemizing and flattening, Using lemma min_def, we get 3 subgoals:

min_plus1.1:

{-1} min(λ (n: nat): P′(n + 1)) = min(P′) − 1 ≡

minimum?(min(P′) − 1, λ (n: nat): P′(n + 1))

{-2} nonempty?[nat](P′)
{1} P′(0)
{2} min(P′) = min(λ (n : nat) : P′(n + 1)) + 1

Simplifying, rewriting, and recording with decision procedures, Using lemma min_def, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of minimum?, Hiding formulas: 3, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of min_plus1.1.

min_plus1.2:

{-1} nonempty?[nat](P′)
{1} nonempty?[nat](λ (n: nat): P′(1 + n))
{2} P′(0)
{3} min(P′) = min(λ (n : nat) : P′(n + 1)) + 1

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of min_plus1.2.

min_plus1.3:

{-1} nonempty?[nat](P′)
{1} min[nat](P′) − 1 ≥ 0
{2} P′(0)
{3} min(P′) = min(λ (n : nat) : P′(n + 1)) + 1

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of min_plus1.3. Q.E.D.

C.143.32 Number_Props.min_member

Terse proof for min_member.

min_member:

{1} ∀ (P: (nonempty?[nat]), n: nat): min(P) = n ⊃ P (n)

Repeatedly Skolemizing and flattening, Rewriting using min_def, matching in *, Expanding the definition of minimum?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of min_member. Q.E.D.

C.144 Proofs for Ok_Result_Rewrite (state-transformer.pvs)

C.144.1 Ok_Result_Rewrite.ok_result_q_ok

Terse proof for ok_result_q_ok.
ok_result_q_ok:

{1} ∀ (data: Data1, q: [State → ExprResult[State, Data2]], s: State): OK?[State, Data1]((q ## ok_result(data))(s)) = OK?(q(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_q_ok. Q.E.D.

C.144.2 Ok_Result_Rewrite.ok_result_q_state_TCC1

Terse proof for ok_result_q_state_TCC1.
ok_result_q_state_TCC1:

{1} ∀ (data: Data1, q: [State → ExprResult[State, Data2]], s: State): OK?(q(s)) ⊃ OK?[State, Data1]

((##[State, Data2, Data1](q, ok_result[State, Data1](data)))(s)) ∨ Exception?[State, Data1]

((##[State, Data2, Data1](q, ok_result[State, Data1](data)))(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_q_state_TCC1. Q.E.D.

C.144.3 Ok_Result_Rewrite.ok_result_q_state_TCC2

Terse proof for ok_result_q_state_TCC2.
ok_result_q_state_TCC2:

{1} ∀ (q: [State → ExprResult[State, Data2]], s: State):

OK?(q(s)) ⊃ OK?[State, Data2](q(s)) ∨ Exception?[State, Data2](q(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_q_state_TCC2. Q.E.D.

C.144.4 Ok_Result_Rewrite.ok_result_q_state

Terse proof for ok_result_q_state.

C.144 Proofs for Ok_Result_Rewrite (state-transformer.pvs)

ok_result_q_state:

{1} ∀ (data: Data1, q: [State → ExprResult[State, Data2]], s: State): OK?(q(s)) ⊃ state[State, Data1]((q ## ok_result(data))(s)) = state(q(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_q_state. Q.E.D.

C.144.5 Ok_Result_Rewrite.ok_result_q_data_TCC1

Terse proof for ok_result_q_data_TCC1.
ok_result_q_data_TCC1:

{1} ∀ (data: Data1, q: [State → ExprResult[State, Data2]], s: State): OK?(q(s)) ⊃ OK?[State, Data1]

((##[State, Data2, Data1](q, ok_result[State, Data1](data)))(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_q_data_TCC1. Q.E.D.

C.144.6 Ok_Result_Rewrite.ok_result_q_data

Terse proof for ok_result_q_data.
ok_result_q_data:

{1} ∀ (data1: Data1, q: [State → ExprResult[State, Data2]], s: State): OK?(q(s)) ⊃ data((q ## ok_result(data1))(s)) = data1

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_q_data. Q.E.D.

C.144.7 Ok_Result_Rewrite.ok_result_elemination_1

Terse proof for ok_result_elemination_1.
ok_result_elemination_1:

{1} ∀ (data: Data1, q: [State → ExprResult[State, Data2]]):

(ok_result[State, Data1](data) ## q) = q

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_elemination_1. Q.E.D.

C.145 Proofs for PDBR_Data_Model (paging-data-models.pvs)

C.145.1 PDBR_Data_Model.pdbr_valid?_TCC1

Terse proof for pdbr_valid?_TCC1.
pdbr_valid?_TCC1:

{1} ∀ (data: list[Byte]): length(data) = 4 ⊃ 1 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pdbr_valid?_TCC1. Q.E.D.

C.145.2 PDBR_Data_Model.pdbr_valid?_TCC2

Terse proof for pdbr_valid?_TCC2.
pdbr_valid?_TCC2:

{1} ∀ (data: list[Byte]):

cut_bits(nth(data, 1), 0, 4) = 0 ∧ length(data) = 4 ⊃ 0 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pdbr_valid?_TCC2. Q.E.D.

C.145.3 PDBR_Data_Model.pdbr_to_byte_TCC1

Terse proof for pdbr_to_byte_TCC1.
pdbr_to_byte_TCC1:

{1} ∀ (pdbr: Pdbr_type): overwrite_bool_bit(overwrite_bool_bit(0, pdbr`pwt, 3), pdbr`pcd, 4) < max_byte

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pdbr_to_byte_TCC1. Q.E.D.

C.145.4 PDBR_Data_Model.pdbr_to_byte_TCC2

Terse proof for pdbr_to_byte_TCC2.
pdbr_to_byte_TCC2:

{1} ∀ (pdbr: Pdbr_type): offset(pdbr`base_addr) ≥ 0

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pdbr_to_byte_TCC2. Q.E.D.

C.145 Proofs for PDBR_Data_Model (paging-data-models.pvs)

C.145.5 PDBR_Data_Model.pdbr_to_byte_TCC3

Terse proof for pdbr_to_byte_TCC3.
pdbr_to_byte_TCC3:

{1} ∀ (pdbr: Pdbr_type): every[nat]

({s: nat | s < max_byte})

((:cut_bits(offset(pdbr`base_addr), 8, 8), cut_bits(offset(pdbr`base_addr), 16, 8), cut_bits(offset(pdbr`base_addr), 24, 8):))

Installing automatic rewrites from: every cut_bits_below max_byte min_bits_per_byte bits_per_byte_minimum

Repeatedly Skolemizing and flattening, Using lemma bits_per_byte_minimum, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

pdbr_to_byte_TCC3.1:

{-1} bits_per_byte ≥ 8
{1} cut_bits(offset(pdbr′`base_addr), 24, 8) < expt(2, bits_per_byte)

Using lemma cut_bits_below, Using lemma both_sides_expt_gt1_le_aux, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pdbr_to_byte_TCC3.1.

pdbr_to_byte_TCC3.2:

{-1} bits_per_byte ≥ 8
{1} cut_bits(offset(pdbr′`base_addr), 16, 8) < expt(2, bits_per_byte)

Using lemma cut_bits_below, Using lemma both_sides_expt_gt1_le_aux, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pdbr_to_byte_TCC3.2.

pdbr_to_byte_TCC3.3:

{-1} bits_per_byte ≥ 8
{1} cut_bits(offset(pdbr′`base_addr), 8, 8) < expt(2, bits_per_byte)

Using lemma cut_bits_below, Using lemma both_sides_expt_gt1_le_aux, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pdbr_to_byte_TCC3.3. Q.E.D.

C.145.6 PDBR_Data_Model.pdbr_from_byte_TCC1

Terse proof for pdbr_from_byte_TCC1.
pdbr_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address): pdbr_valid?(data, a) ⊃ 1 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pdbr_from_byte_TCC1. Q.E.D.

C.145.7 PDBR_Data_Model.pdbr_from_byte_TCC2

Terse proof for pdbr_from_byte_TCC2.
pdbr_from_byte_TCC2:

{1} ∀ (data: list[Byte], a: Address): pdbr_valid?(data, a) ⊃ 2 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pdbr_from_byte_TCC2. Q.E.D.

C.145.8 PDBR_Data_Model.pdbr_from_byte_TCC3

Terse proof for pdbr_from_byte_TCC3.
pdbr_from_byte_TCC3:

{1} ∀ (data: list[Byte], a: Address): pdbr_valid?(data, a) ⊃ 3 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pdbr_from_byte_TCC3. Q.E.D.

C.145.9 PDBR_Data_Model.pdbr_from_byte_TCC4

Terse proof for pdbr_from_byte_TCC4.

pdbr_from_byte_TCC4:

{1} ∀ (data: list[Byte], a: Address): pdbr_valid?(data, a) ⊃ Mem?(Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0,

nth[Byte] (data, 1),

                                                                                         8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`type_of)

∧ (0 ≤

Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0, nth[Byte] (data, 1),

                                                                                       8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

∧

Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0, nth[Byte] (data, 1),

                                                                                       8,

8),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

< max_linear_offset) ∧ aligned?(12)

(offset

(Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, nth[Byte](data, 1),

                                                                               8,

8), nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less pde_valid? max_linear_offset bus_width

Expanding the definition of Mem, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using aligned_overwrite_shift_bits_more, matching in *, Rewriting using aligned_overwrite_shift_bits_more, matching in *, Rewriting using aligned_overwrite_shift_bits_less, matching in *, Hiding formulas: 2, 3, 4, Expanding the definition of pdbr_valid?, Applying disjunctive simplification to flatten sequent, Using lemma cut_bits_aligned, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pdbr_from_byte_TCC4. Q.E.D.

C.145.10 PDBR_Data_Model.pdbr_from_byte_TCC5

Terse proof for pdbr_from_byte_TCC5.
pdbr_from_byte_TCC5:

{1} ∀ (data: list[Byte], a: Address): pdbr_valid?(data, a) ⊃ 0 < length[Byte](data)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less pde_valid? max_linear_offset bus_width

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pdbr_valid?, which is trivially true. This completes the proof of pdbr_from_byte_TCC5. Q.E.D.

C.145.11 PDBR_Data_Model.pdbr_model_TCC1

Terse proof for pdbr_model_TCC1.
pdbr_model_TCC1:

{1} ∀ (f: [[Pdbr_type, Address] → [list[Byte] → bool]]):

(f = (λ (d: Pdbr_type, a: Address): (zero_mask?(4)))) ⊃ (∀ (x_{1}: [Pdbr_type, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Expanding the definition of singleton?, which is trivially true. This completes the proof of pdbr_model_TCC1. Q.E.D.

C.145.12 PDBR_Data_Model.pdbr_valid_to_byte

Terse proof for pdbr_valid_to_byte.
pdbr_valid_to_byte:

{1} ∀ (d: Pdbr_type, a: Address):

valid?(uidt(pdbr_model))(to_byte(pdbr_model)(d, a), a)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: pdbr_model pdbr_to_byte pdbr_valid? nth length cut_bits_zero

cut_bits_overwrite_bool_bit_disjoined cut_bits_overwrite_bits_disjoined cut_bits_cut_bits Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Adding type constraints for d!1‘base_addr, Using lemma aligned_cut_bits, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pdbr_valid_to_byte. Q.E.D.

C.145.13 PDBR_Data_Model.pdbr_is_pod

Terse proof for pdbr_is_pod.

pdbr_is_pod:

{1} pod_data_type?(pdbr_model)

Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Expanding the definition of uninterpreted_data_type?, Applying propositional simplification, we get 6 subgoals:

pdbr_is_pod.1:

{1} ∀ (l: list[Byte], a: Address): ¬ length(l) = size(pdbr_model`uidt) ⊃ ¬ valid?(pdbr_model`uidt)(l, a)

Repeatedly Skolemizing and flattening, Expanding the definition of pdbr_model, Expanding the definition of pdbr_valid?, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pdbr_is_pod.1.

pdbr_is_pod.2:

{1} ∀ (d: Pdbr_type, a: Address): valid?(uidt(pdbr_model))(to_byte(pdbr_model)(d, a), a)

Applying pdbr_valid_to_byte which is trivially true. This completes the proof of pdbr_is_pod.2.

pdbr_is_pod.3:

{1} ∀ (l: list[Byte], a: Address): valid?(uidt(pdbr_model))(l, a) ≡ up?(from_byte(pdbr_model)(l, a))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of pdbr_model, Expanding the definition of pdbr_from_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pdbr_is_pod.3.

pdbr_is_pod.4:

{1} ∀ (d: Pdbr_type, a: Address): down(from_byte(pdbr_model)(to_byte(pdbr_model)(d, a), a)) = d Repeatedly Skolemizing and flattening, Using lemma pdbr_valid_to_byte, Installing automatic rewrites from: pdbr_model pdbr_to_byte pdbr_from_byte pdbr_valid?

nth length cut_bits_overwrite_bool_bit_disjoined cut_bits_zero cut_bits_overwrite_bits_disjoined cut_bits_cut_bits cut_bits_overwrite_bits_contained cut_bit_overwrite_bool_bit overwrite_shift_bits_zero overwrite_shift_bits_merge aligned_address_aligned

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Adding type constraints for d!1‘base_addr, Expanding the definition of max_linear_offset, Expanding the definition of bus_width, Rewriting using shift_bits_left_cut_bits, matching in *, we get 2 subgoals:

pdbr_is_pod.4.1:

{-1} Mem?(d′`base_addr`type_of)
{-2} 0 ≤ d′`base_addr`offset
{-3} d′`base_addr`offset < expt(2, 32)
{-4} aligned?(12)(offset(d′`base_addr))
{-5} cut_bits(offset(d′`base_addr), 8, 4) = 0
{1} (#base_addr := Mem(offset(d′`base_addr)), pcd := d′`pcd, pwt := d′`pwt#) = d′

Applying extensionality, Applying extensionality, we get 2 subgoals:

pdbr_is_pod.4.1.1:

{-1} Mem?(d′`base_addr`type_of)
{-2} 0 ≤ d′`base_addr`offset
{-3} d′`base_addr`offset < expt(2, 32)
{-4} aligned?(12)(offset(d′`base_addr))
{-5} cut_bits(offset(d′`base_addr), 8, 4) = 0
{1} Mem(offset(d′`base_addr))`offset = d′`base_addr`offset

Expanding the definition of Mem, which is trivially true. This completes the proof of pdbr_is_pod.4.1.1.

pdbr_is_pod.4.1.2:

{-1} Mem?(d′`base_addr`type_of)
{-2} 0 ≤ d′`base_addr`offset
{-3} d′`base_addr`offset < expt(2, 32)
{-4} aligned?(12)(offset(d′`base_addr))
{-5} cut_bits(offset(d′`base_addr), 8, 4) = 0
{1} Mem(offset(d′`base_addr))`type_of = d′`base_addr`type_of

Expanding the definition of Mem, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pdbr_is_pod.4.1.2.

C.146 Proofs for PDBR_Datatype (paging-data.pvs)

pdbr_is_pod.4.2:

{-1} Mem?(d′`base_addr`type_of)
{-2} 0 ≤ d′`base_addr`offset
{-3} d′`base_addr`offset < expt(2, 32)
{-4} aligned?(12)(offset(d′`base_addr))
{-5} cut_bits(offset(d′`base_addr), 8, 4) = 0
{1} aligned?(8)(offset(d′`base_addr))

{2} (#base_addr := Mem(shift_bits_left(cut_bits(offset(d′`base_addr), 8, 24), 8)), pcd := d′`pcd,

pwt := d′`pwt#)
= d′

Applying aligned_bigger Instantiating the top quantifier in -1 with the terms: offset(d′‘base_addr), 12, 8, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pdbr_is_pod.4.2.

pdbr_is_pod.5:

{1} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pdbr_model))(l, a_{1}) ≡ valid?(uidt(pdbr_model))(l, a_{2})

Expanding the definition of pdbr_model, Expanding the definition of pdbr_valid?, which is trivially true. This completes the proof of pdbr_is_pod.5.

pdbr_is_pod.6:

{1} size(uidt(pdbr_model)) > 0

Expanding the definition of pdbr_model, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pdbr_is_pod.6. Q.E.D.

C.146 Proofs for PDBR_Datatype (paging-data.pvs)

C.146.1 PDBR_Datatype.pdbr_data_type_TCC1

Terse proof for pdbr_data_type_TCC1.
pdbr_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[Pdbr_type])): true

Using lemma pdbr_data_type_exists, This completes the proof of pdbr_data_type_TCC1. Q.E.D.

C.147 Proofs for PDBR_Type (paging-data.pvs)

C.147.1 PDBR_Type.Pdbr_type_TCC1

Terse proof for Pdbr_type_TCC1.
Pdbr_type_TCC1:

{1} ∀ (a: Memory_Address_4G): offset(a) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Pdbr_type_TCC1. Q.E.D.

C.148 Proofs for PDE_Datatype (paging-data.pvs)

C.148.1 PDE_Datatype.pde_data_type_TCC1

Terse proof for pde_data_type_TCC1.
pde_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[Pde_type])): true

Using lemma pde_data_type_exists, This completes the proof of pde_data_type_TCC1. Q.E.D.

C.149 Proofs for PDE_Model (paging-data-models.pvs)

C.149.1 PDE_Model.pde_valid?_TCC1

Terse proof for pde_valid?_TCC1.
pde_valid?_TCC1:

{1} ∀ (data: list[Byte]): length(data) = 4 ⊃ 0 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_valid?_TCC1. Q.E.D.

C.149.2 PDE_Model.pde_valid?_TCC2

Terse proof for pde_valid?_TCC2.
pde_valid?_TCC2:

{1} ∀ (data: list[Byte]):

cut_bit(nth(data, 0), 7) ∧ cut_bit(nth(data, 0), 0) ∧ length(data) = 4 ⊃ 1 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_valid?_TCC2.

C.149 Proofs for PDE_Model (paging-data-models.pvs)

Q.E.D.

C.149.3 PDE_Model.pde_valid?_TCC3

Terse proof for pde_valid?_TCC3.
pde_valid?_TCC3:

{1} ∀ (data: list[Byte]): cut_bits(nth(data, 1), 5, 3) = 0 ∧ cut_bit(nth(data, 0), 7) ∧ cut_bit(nth(data, 0), 0) ∧ length(data) = 4 ⊃ 2 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_valid?_TCC3. Q.E.D.

C.149.4 PDE_Model.pde_pte_to_byte_TCC1

Terse proof for pde_pte_to_byte_TCC1.
pde_pte_to_byte_TCC1:

{1} ∀ (pde: Pde_pt_type):

overwrite_bool_bit(overwrite_bool_bit(overwrite_bool_bit(overwrite_bool_bit

(overwrite_bool_bit (overwrite_bool_bit (0, true, 0), mem-

ory_access_to_bools (pde`access)`1, 1), mem-

ory_privilege_to_bool (pde`privilege), 2),

pde`write_through, 3),

pde`cache_disabled, 4),

pde`accessed, 5)

< max_byte

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less over-

write_shift_bits_less Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_pte_to_byte_TCC1. Q.E.D.

C.149.5 PDE_Model.pde_pte_to_byte_TCC2

Terse proof for pde_pte_to_byte_TCC2.

pde_pte_to_byte_TCC2:

{1} ∀ (pde: Pde_pt_type): offset(pde`page_table_base) ≥ 0

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_pte_to_byte_TCC2. Q.E.D.

C.149.6 PDE_Model.pde_pte_to_byte_TCC3

Terse proof for pde_pte_to_byte_TCC3.
pde_pte_to_byte_TCC3:

{1} ∀ (pde: Pde_pt_type): every[nat]

({s: nat | s < max_byte})

((:overwrite_shift_bits(overwrite_bool_bit(0, pde`global_page, 0),

cut_bits(offset(pde`page_table_base), 12, 4), 4, 4),

cut_bits(offset(pde`page_table_base), 16, 8), cut_bits(offset(pde`page_table_base), 24, 8):))

Installing automatic rewrites from: cut_bits_byte every Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less over-

write_shift_bits_less Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_pte_to_byte_TCC3. Q.E.D.

C.149.7 PDE_Model.pde_super_to_byte_TCC1

Terse proof for pde_super_to_byte_TCC1.

pde_super_to_byte_TCC1:

{1} ∀ (spage: Pde_4m_type):

overwrite_bool_bit(overwrite_bool_bit(overwrite_bool_bit(overwrite_bool_bit

(overwrite_bool_bit (overwrite_bool_bit (overwrite_bool_bit (overwrite_bool_bit (0, true, 0), mem-

ory_access_to_bools (spage`access)`1, 1), mem-

ory_privilege_to_bool (spage`privilege), 2),

spage`write_through, 3),

spage`cache_disabled, 4),

spage`accessed,

5),

spage`dirty, 6),

true, 7)

< max_byte

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less over-

write_shift_bits_less shift_bits_left_less Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_super_to_byte_TCC1. Q.E.D.

C.149.8 PDE_Model.pde_super_to_byte_TCC2

Terse proof for pde_super_to_byte_TCC2.
pde_super_to_byte_TCC2:

{1} ∀ (spage: Pde_4m_type): offset(spage`page_base) ≥ 0

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_super_to_byte_TCC2. Q.E.D.

C.149.9 PDE_Model.pde_super_to_byte_TCC3

Terse proof for pde_super_to_byte_TCC3.

pde_super_to_byte_TCC3:

{1} ∀ (spage: Pde_4m_type):

every[nat] ({s: nat | s < max_byte}) ((:overwrite_bool_bit(overwrite_bool_bit(0, spage`global_page, 0),

spage`page_table_attribute_index, 4),

shift_bits_left(cut_bits(offset(spage`page_base), 22, 2), 6), cut_bits(offset(spage`page_base), 24, 8):))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less cut_bits_byte

overwrite_shift_bits_less Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of shift_bits_left, Using lemma cut_bits_below, Expanding the definition of max_byte, Using lemma bits_per_byte_minimum, Expanding the definition of min_bits_per_byte, Using lemma both_sides_expt_gt1_le_aux, we get 2 subgoals:

pde_super_to_byte_TCC3.1:

{-1} expt(2, 7 + 1) ≤ expt(2, bits_per_byte − 1 + 1) ≡

7 ≤ bits_per_byte − 1

{-2} bits_per_byte ≥ 8
{-3} cut_bits(offset(spage′`page_base), 22, 2) < expt(2, 2)
{1} cut_bits(offset(spage′‘page_base), 22, 2) × expt(2, 6) < expt(2, bits_per_byte)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma expt_plus_aux, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pde_super_to_byte_TCC3.1.
pde_super_to_byte_TCC3.2:

{-1} bits_per_byte ≥ 8
{-2} cut_bits(offset(spage′`page_base), 22, 2) < expt(2, 2)
{1} bits_per_byte − 1 ≥ 0
{2} cut_bits(offset(spage′‘page_base), 22, 2) × expt(2, 6) < expt(2, bits_per_byte)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pde_super_to_byte_TCC3.2.

Q.E.D.

C.149.10 PDE_Model.pde_to_byte_TCC1

Terse proof for pde_to_byte_TCC1.
pde_to_byte_TCC1:

{1} ∀ (pde: Pde_type): pde = Not_present ⊃ 0 < max_byte

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte expt_2_8 Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_to_byte_TCC1. Q.E.D.

C.149.11 PDE_Model.pde_to_byte_TCC2

Terse proof for pde_to_byte_TCC2.
pde_to_byte_TCC2:

{1} ∀ (pde: Pde_type): pde = Not_present ⊃ every[real] (λ (x: real): rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) ((:0, 0, 0:))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_to_byte_TCC2. Q.E.D.

C.149.12 PDE_Model.pde_4m_from_byte_TCC1

Terse proof for pde_4m_from_byte_TCC1.
pde_4m_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ⊃ 0 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_4m_from_byte_TCC1. Q.E.D.

C.149.13 PDE_Model.pde_4m_from_byte_TCC2

Terse proof for pde_4m_from_byte_TCC2.
pde_4m_from_byte_TCC2:

{1} ∀ (data: list[Byte], a: Address):

pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ cut_bit(nth(data, 0), 7) ⊃ ((singleton [Memory_access](Read) ∪ {Execute}) ⊆ bools_to_memory_access (cut_bit(nth [Byte](data, 0), 1), true))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_4m_from_byte_TCC2. Q.E.D.

C.149.14 PDE_Model.pde_4m_from_byte_TCC3

Terse proof for pde_4m_from_byte_TCC3.
pde_4m_from_byte_TCC3:

{1} ∀ (data: list[Byte], a: Address):

pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ cut_bit(nth(data, 0), 7) ⊃ 1 < length[Byte](data)

Repeatedly Skolemizing and flattening, Expanding the definition of pde_valid?, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pde_4m_from_byte_TCC3. Q.E.D.

C.149.15 PDE_Model.pde_4m_from_byte_TCC4

Terse proof for pde_4m_from_byte_TCC4.
pde_4m_from_byte_TCC4:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ cut_bit(nth(data, 0), 7) ⊃ 2 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_4m_from_byte_TCC4. Q.E.D.

C.149.16 PDE_Model.pde_4m_from_byte_TCC5

Terse proof for pde_4m_from_byte_TCC5.
pde_4m_from_byte_TCC5:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ cut_bit(nth(data, 0), 7) ⊃ 3 < length[Byte](data)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less pde_valid? bus_width max_linear_offset

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_4m_from_byte_TCC5. Q.E.D.

C.149.17 PDE_Model.pde_4m_from_byte_TCC6

Terse proof for pde_4m_from_byte_TCC6.

pde_4m_from_byte_TCC6:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ cut_bit(nth(data, 0), 7) ⊃ Mem?(Mem(overwrite_shift_bits(overwrite_shift_bits(0,

cut_bits(nth[Byte](data, 2),

                                                                             6,

2),

22, 2),

nth[Byte](data, 3), 24, 8))`type_of)

∧ (0 ≤

Mem(overwrite_shift_bits(overwrite_shift_bits(0,

cut_bits(nth[Byte](data, 2),

                                                                           6,

2),

22, 2),

nth[Byte](data, 3), 24, 8))`offset

∧

Mem(overwrite_shift_bits(overwrite_shift_bits(0,

cut_bits(nth[Byte](data, 2),

                                                                           6,

2),

22, 2),

nth[Byte](data, 3), 24, 8))`offset

< max_linear_offset) ∧ aligned?(22)

(offset

(Mem(overwrite_shift_bits(overwrite_shift_bits(0, cut_bits (nth[Byte](data, 2),

                                                                               6,

2), 22, 2),

nth[Byte](data, 3), 24, 8))))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less pde_valid? bus_width max_linear_offset

Expanding the definition of Mem, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_4m_from_byte_TCC6. Q.E.D.

C.149.18 PDE_Model.pde_4k_from_byte_TCC1

Terse proof for pde_4k_from_byte_TCC1.

pde_4k_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ ¬ cut_bit(nth(data, 0), 7) ⊃ ((singleton [Memory_access](Read) ∪ {Execute}) ⊆ bools_to_memory_access (cut_bit(nth [Byte](data, 0), 1), true))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_4k_from_byte_TCC1. Q.E.D.

C.149.19 PDE_Model.pde_4k_from_byte_TCC2

Terse proof for pde_4k_from_byte_TCC2.
pde_4k_from_byte_TCC2:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ ¬ cut_bit(nth(data, 0), 7) ⊃ 1 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_4k_from_byte_TCC2. Q.E.D.

C.149.20 PDE_Model.pde_4k_from_byte_TCC3

Terse proof for pde_4k_from_byte_TCC3.
pde_4k_from_byte_TCC3:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ ¬ cut_bit(nth(data, 0), 7) ⊃ 2 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_4k_from_byte_TCC3. Q.E.D.

C.149.21 PDE_Model.pde_4k_from_byte_TCC4

Terse proof for pde_4k_from_byte_TCC4.
pde_4k_from_byte_TCC4:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ ¬ cut_bit(nth(data, 0), 7) ⊃ 3 < length[Byte](data)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less pde_valid? max_linear_offset bus_width

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_4k_from_byte_TCC4.

C.149 Proofs for PDE_Model (paging-data-models.pvs)

Q.E.D.

C.149.22 PDE_Model.pde_4k_from_byte_TCC5

Terse proof for pde_4k_from_byte_TCC5.

pde_4k_from_byte_TCC5:

{1} ∀ (data: list[Byte], a: Address): pde_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ∧ ¬ cut_bit(nth(data, 0), 7) ⊃ Mem?(Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0,

cut_bits (nth[Byte]

(data, 1),

  4,

4), 12, 4),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`type_of)

∧ (0 ≤

Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0, cut_bits (nth[Byte]

(data, 1),

4,

4), 12, 4),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

∧ Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0,

cut_bits (nth[Byte]

(data, 1),

4,

4), 12, 4),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

< max_linear_offset) ∧ aligned?(12)

(offset

(Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, cut_bits (nth[Byte](data, 1),

4,

4), 12, 4),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less pde_valid? bus_width max_linear_offset

Expanding the definition of Mem, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_4k_from_byte_TCC5. Q.E.D.

C.149.23 PDE_Model.pde_from_byte_TCC1

Terse proof for pde_from_byte_TCC1.
pde_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address):

cut_bit(nth(data, 0), 7) ∧ cut_bit(nth(data, 0), 0) ∧ pde_valid?(data, a) ⊃ up?[Pde_4m_type](pde_4m_from_byte(data, a))

Repeatedly Skolemizing and flattening, Expanding the definition of pde_4m_from_byte, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pde_from_byte_TCC1. Q.E.D.

C.149.24 PDE_Model.pde_from_byte_TCC2

Terse proof for pde_from_byte_TCC2.
pde_from_byte_TCC2:

{1} ∀ (data: list[Byte], a: Address): ¬ cut_bit(nth(data, 0), 7) ∧ cut_bit(nth(data, 0), 0) ∧ pde_valid?(data, a) ⊃ up?[Pde_pt_type](pde_4k_from_byte(data, a))

Repeatedly Skolemizing and flattening, Expanding the definition of pde_4k_from_byte, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pde_from_byte_TCC2. Q.E.D.

C.149.25 PDE_Model.pde_model_TCC1

Terse proof for pde_model_TCC1.
pde_model_TCC1:

{1} ∀ (f: [[Pde_type, Address] → [list[Byte] → bool]]):

(f = (λ (d: Pde_type, a: Address): (zero_mask?(4)))) ⊃ (∀ (x_{1}: [Pde_type, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Expanding the definition of singleton?, which is trivially true. This completes the proof of pde_model_TCC1. Q.E.D.

C.149.26 PDE_Model.pde_valid_to_byte

The L^{A}TEX code for this proof is broken.

C.149.27 PDE_Model.pde_is_pod

Terse proof for pde_is_pod.

pde_is_pod:

{1} pod_data_type?(pde_model)

Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Expanding the definition of uninterpreted_data_type?, Applying propositional simplification, we get 6 subgoals:

pde_is_pod.1:

{1} ∀ (l: list[Byte], a: Address):

¬ length(l) = size(pde_model`uidt) ⊃ ¬ valid?(pde_model`uidt)(l, a)

Repeatedly Skolemizing and flattening, Expanding the definition of pde_model, Expanding the definition of pde_valid?, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pde_is_pod.1.

pde_is_pod.2:

{1} ∀ (d: Pde_type, a: Address): valid?(uidt(pde_model))(to_byte(pde_model)(d, a), a)

Repeatedly Skolemizing and flattening, Rewriting using pde_valid_to_byte, matching in *, This completes the proof of pde_is_pod.2.

pde_is_pod.3:

{1} ∀ (l: list[Byte], a: Address):

valid?(uidt(pde_model))(l, a) ≡ up?(from_byte(pde_model)(l, a))

Repeatedly Skolemizing and flattening, Expanding the definition of pde_model, Expanding the definition of pde_from_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_is_pod.3.

pde_is_pod.4:

{1} ∀ (d: Pde_type, a: Address):

down(from_byte(pde_model)(to_byte(pde_model)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Expanding the definition of pde_model, Expanding the definition of pde_to_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

pde_is_pod.4.1:

{-1} not_present?(d′)
{1} down(pde_from_byte((:0, 0, 0, 0:), a′)) = d′

Installing automatic rewrites from: pde_from_byte! pde_valid? nth length length_cdr length_is_cons cut_bits_overwrite_bool_bit_disjoined cut_bits_zero cut_bits_overwrite_bits_disjoined cut_bits_cut_bits cut_bits_overwrite_bits_contained cut_bit_overwrite_bool_bit overwrite_shift_bits_zero overwrite_shift_bits_merge aligned_address_aligned cut_bit_cut_bits cut_bit_overwrite_shift_bits length_to_byte from_byte_to_byte valid_to_byte cut_bit_zero

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_is_pod.4.1.

pde_is_pod.4.2:

{-1} pde_pt?(d′)
{1} down(pde_from_byte(pde_pte_to_byte(pde_pt(d′), a′), a′)) = d′

Installing automatic rewrites from: pde_pte_to_byte! pde_4k_from_byte pde_from_byte! pde_valid? nth length length_cdr length_is_cons cut_bits_overwrite_bool_bit_disjoined cut_bits_zero cut_bits_overwrite_bits_disjoined cut_bits_cut_bits cut_bits_overwrite_bits_contained cut_bit_overwrite_bool_bit overwrite_shift_bits_zero overwrite_shift_bits_merge aligned_address_aligned cut_bit_cut_bits cut_bit_overwrite_shift_bits cut_bits_overwrite_shift_bits_contained length_to_byte from_byte_to_byte valid_to_byte cut_bit_zero bool_to_memory_access_iso bool_to_memory_privilege_iso max_linear_offset bus_width

Adding type constraints for pde_pt(d!1)‘page_table_base, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using shift_bits_left_cut_bits, matching in *, Applying extensionality, we get 3 subgoals:

pde_is_pod.4.2.1:

{-1} Mem?(pde_pt(d′)`page_table_base`type_of)
{-2} 0 ≤ pde_pt(d′)`page_table_base`offset
{-3} pde_pt(d′)`page_table_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pde_pt(d′)`page_table_base))
{-5} pde_pt?(d′)

{1} (#page_table_base := Mem(offset(pde_pt(d′)`page_table_base)), global_page := pde_pt(d′)`global_page, accessed := pde_pt(d′)`accessed, cache_disabled := pde_pt(d′)`cache_disabled, write_through := pde_pt(d′)`write_through, privilege := pde_pt(d′)`privilege, access := bools_to_memory_access(memory_access_to_bools(pde_pt(d′)`access)`1, true)#) = pde_pt(d′)

Expanding the definition of bools_to_memory_access, Expanding the definition of Mem, Expanding the definition of memory_access_to_bools, Applying extensionality, we get 2 subgoals:

pde_is_pod.4.2.1.1:

{-1} Mem?(pde_pt(d′)`page_table_base`type_of)
{-2} 0 ≤ pde_pt(d′)`page_table_base`offset
{-3} pde_pt(d′)`page_table_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pde_pt(d′)`page_table_base))
{-5} pde_pt?(d′)

{1} if (Write ∈ pde_pt(d′)‘access)

then ((singleton(Read) ∪ {Write}) ∪ {Execute}) else (singleton(Read) ∪ {Execute}) endif = pde_pt(d′)`access

Adding type constraints for pde_pt(d!1)‘access, Keeping (-1 1) and hiding *, Applying extensionality, Expanding the definition of subset?, Instantiating the top quantifier in -1 with the terms: x′, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_is_pod.4.2.1.1.

pde_is_pod.4.2.1.2:

{-1} Mem?(pde_pt(d′)`page_table_base`type_of)
{-2} 0 ≤ pde_pt(d′)`page_table_base`offset
{-3} pde_pt(d′)`page_table_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pde_pt(d′)`page_table_base))
{-5} pde_pt?(d′)

{1} (#type_of := Mem_, offset := offset(pde_pt(d′)`page_table_base)#) = pde_pt(d′)`page_table_base

Applying extensionality, This completes the proof of pde_is_pod.4.2.1.2.

pde_is_pod.4.2.2:

{-1} Mem?(pde_pt(d′)`page_table_base`type_of)
{-2} 0 ≤ pde_pt(d′)`page_table_base`offset
{-3} pde_pt(d′)`page_table_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pde_pt(d′)`page_table_base))
{-5} pde_pt?(d′)

{1} Mem?(Mem(offset(pde_pt(d′)`page_table_base))`type_of) ∧ (0 ≤ Mem(offset(pde_pt(d′)`page_table_base))`offset ∧

Mem(offset(pde_pt(d′)`page_table_base))`offset < expt(2, 32)) ∧ aligned?(12)(offset(Mem(offset(pde_pt(d′)`page_table_base))))

Expanding the definition of Mem, which is trivially true. This completes the proof of pde_is_pod.4.2.2.

pde_is_pod.4.2.3:

{-1} Mem?(pde_pt(d′)`page_table_base`type_of)
{-2} 0 ≤ pde_pt(d′)`page_table_base`offset
{-3} pde_pt(d′)`page_table_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pde_pt(d′)`page_table_base))
{-5} pde_pt?(d′)
{1} ((singleton[Memory_access](Read) ∪ {Execute}) ⊆ bools_to_memory_access (memory_access_to_bools (pde_pt(d′)‘access)‘1, true))

Adding type constraints for pde_pt(d!1)‘access, Keeping (-1 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: x′, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_is_pod.4.2.3.

pde_is_pod.4.3:

{1} not_present?(d′)
{2} pde_pt?(d′)
{3} down(pde_from_byte(pde_super_to_byte(pde_4m(d′), a′), a′)) = d′

Installing automatic rewrites from: pde_super_to_byte! pde_4m_from_byte pde_from_byte! pde_valid? nth length length_cdr length_is_cons cut_bits_overwrite_bool_bit_disjoined cut_bits_zero cut_bits_overwrite_bits_disjoined cut_bits_cut_bits cut_bits_overwrite_bits_contained cut_bit_overwrite_bool_bit overwrite_shift_bits_zero overwrite_shift_bits_merge aligned_address_aligned cut_bit_cut_bits cut_bit_overwrite_shift_bits cut_bits_overwrite_shift_bits_contained cut_bits_overwrite_shift_bits_disjoint cut_bits_shift_bits_left_outside cut_bits_shift_bits_left_in length_to_byte from_byte_to_byte valid_to_byte cut_bit_zero bool_to_memory_access_iso bool_to_memory_privilege_iso max_linear_offset bus_width

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Adding type constraints for pde_4m(d!1)‘page_base, Rewriting using shift_bits_left_cut_bits, matching in *, Applying extensionality, we get 3 subgoals:

pde_is_pod.4.3.1:

{-1} Mem?(pde_4m(d′)`page_base`type_of)
{-2} 0 ≤ pde_4m(d′)`page_base`offset
{-3} pde_4m(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(22)(offset(pde_4m(d′)`page_base))

{1} (#page_base := Mem(offset(pde_4m(d′)`page_base)), page_table_attribute_index := pde_4m(d′)`page_table_attribute_index, global_page := pde_4m(d′)`global_page, dirty := pde_4m(d′)`dirty, accessed := pde_4m(d′)`accessed, cache_disabled := pde_4m(d′)`cache_disabled, write_through := pde_4m(d′)`write_through, privilege := pde_4m(d′)`privilege, access := bools_to_memory_access(memory_access_to_bools(pde_4m(d′)`access)`1, true)#) = pde_4m(d′)

{2} not_present?(d′)
{3} pde_pt?(d′)

Applying extensionality, we get 2 subgoals:

pde_is_pod.4.3.1.1:

{-1} Mem?(pde_4m(d′)`page_base`type_of)
{-2} 0 ≤ pde_4m(d′)`page_base`offset
{-3} pde_4m(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(22)(offset(pde_4m(d′)`page_base))

{1} bools_to_memory_access(memory_access_to_bools(pde_4m(d′)`access)`1, true) =

pde_4m(d′)`access

{2} not_present?(d′)
{3} pde_pt?(d′)

Expanding the definition of bools_to_memory_access, Expanding the definition of memory_access_to_bools, Adding type constraints for pde_4m(d!1)‘access, Applying extensionality, Expanding the definition of subset?, Instantiating the top quantifier in -1 with the terms: x′, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_is_pod.4.3.1.1.

pde_is_pod.4.3.1.2:

{-1} Mem?(pde_4m(d′)`page_base`type_of)
{-2} 0 ≤ pde_4m(d′)`page_base`offset
{-3} pde_4m(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(22)(offset(pde_4m(d′)`page_base))
{1} Mem(offset(pde_4m(d′)`page_base)) = pde_4m(d′)`page_base
{2} not_present?(d′)
{3} pde_pt?(d′)

Expanding the definition of Mem, Applying extensionality, This completes the proof of pde_is_pod.4.3.1.2.

pde_is_pod.4.3.2:

{-1} Mem?(pde_4m(d′)`page_base`type_of)
{-2} 0 ≤ pde_4m(d′)`page_base`offset
{-3} pde_4m(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(22)(offset(pde_4m(d′)`page_base))

{1} Mem?(Mem(offset(pde_4m(d′)`page_base))`type_of) ∧ (0 ≤ Mem(offset(pde_4m(d′)`page_base))`offset ∧

Mem(offset(pde_4m(d′)`page_base))`offset < expt(2, 32)) ∧ aligned?(22)(offset(Mem(offset(pde_4m(d′)`page_base))))

{2} not_present?(d′)
{3} pde_pt?(d′)

Expanding the definition of Mem, which is trivially true. This completes the proof of pde_is_pod.4.3.2.

C.150 Proofs for PF_EC_Model (paging-data-models.pvs)

pde_is_pod.4.3.3:

{-1} Mem?(pde_4m(d′)`page_base`type_of)
{-2} 0 ≤ pde_4m(d′)`page_base`offset
{-3} pde_4m(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(22)(offset(pde_4m(d′)`page_base))
{1} ((singleton[Memory_access](Read) ∪ {Execute}) ⊆ bools_to_memory_access (memory_access_to_bools (pde_4m(d′)‘access)‘1, true))
{2} not_present?(d′)
{3} pde_pt?(d′)

Keeping (-1 1) and hiding *, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pde_is_pod.4.3.3.

pde_is_pod.5:

{1} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pde_model))(l, a_{1}) ≡ valid?(uidt(pde_model))(l, a_{2})

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of pde_model, Expanding the definition of pde_valid?, which is trivially true. This completes the proof of pde_is_pod.5.

pde_is_pod.6:

{1} size(uidt(pde_model)) > 0

Expanding the definition of pde_model, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pde_is_pod.6. Q.E.D.

C.150 Proofs for PF_EC_Model (paging-data-models.pvs)

C.150.1 PF_EC_Model.pf_ec_valid?_TCC1

Terse proof for pf_ec_valid?_TCC1.
pf_ec_valid?_TCC1:

{1} ∀ (data: list[Byte]): length(data) = 4 ⊃ 3 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pf_ec_valid?_TCC1. Q.E.D.

C.150.2 PF_EC_Model.pf_ec_valid?_TCC2

Terse proof for pf_ec_valid?_TCC2.
pf_ec_valid?_TCC2:

{1} ∀ (data: list[Byte]): cut_bits(nth(data, 3), 0, 8) = 0 ∧ length(data) = 4 ⊃ 2 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pf_ec_valid?_TCC2. Q.E.D.

C.150.3 PF_EC_Model.pf_ec_valid?_TCC3

Terse proof for pf_ec_valid?_TCC3.
pf_ec_valid?_TCC3:

{1} ∀ (data: list[Byte]): cut_bits(nth(data, 2), 0, 8) = 0 ∧ cut_bits(nth(data, 3), 0, 8) = 0 ∧ length(data) = 4 ⊃ 1 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pf_ec_valid?_TCC3. Q.E.D.

C.150.4 PF_EC_Model.pf_ec_valid?_TCC4

Terse proof for pf_ec_valid?_TCC4.
pf_ec_valid?_TCC4:

{1} ∀ (data: list[Byte]): cut_bits(nth(data, 1), 0, 8) = 0 ∧ cut_bits(nth(data, 2), 0, 8) = 0 ∧ cut_bits(nth(data, 3), 0, 8) = 0 ∧ length(data) = 4 ⊃ 0 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pf_ec_valid?_TCC4. Q.E.D.

C.150.5 PF_EC_Model.pf_ec_to_byte_TCC1

Terse proof for pf_ec_to_byte_TCC1.

pf_ec_to_byte_TCC1:

{1} ∀ (pf_ec: PF_error_code_type):

overwrite_bool_bit(overwrite_bool_bit(overwrite_bool_bit(overwrite_bool_bit

(overwrite_bool_bit (0, pf_ec`present, 0), (Write ∈ pf_ec‘access), 1), mem-

ory_privilege_to_bool (pf_ec`privilege), 2),

pf_ec`reserved_bit_violation, 3),

(Execute ∈ pf_ec‘access), 4)

< max_byte

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pf_ec_to_byte_TCC1. Q.E.D.

C.150.6 PF_EC_Model.pf_ec_to_byte_TCC2

Terse proof for pf_ec_to_byte_TCC2.
pf_ec_to_byte_TCC2:

{1} ∀ (pf_ec: PF_error_code_type): every[real] (λ (x: real): rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) ((:0, 0, 0:))

Expanding the definition of max_byte, Adding type constraints for expt(2, bits_per_byte), Installing automatic rewrites from: every Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pf_ec_to_byte_TCC2. Q.E.D.

C.150.7 PF_EC_Model.pf_ec_from_byte_TCC1

Terse proof for pf_ec_from_byte_TCC1.
pf_ec_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address): pf_ec_valid?(data, a) ⊃ 0 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pf_ec_from_byte_TCC1. Q.E.D.

C.150.8 PF_EC_Model.pf_ec_from_byte_TCC2

Terse proof for pf_ec_from_byte_TCC2.
pf_ec_from_byte_TCC2:

{1} ∀ (data: list[Byte], a: Address): pf_ec_valid?(data, a) ⊃ (Read ∈ bools_to_memory_access (cut_bit(nth[Byte](data, 0), 1), cut_bit(nth [Byte](data, 0), 4)))

Repeatedly Skolemizing and flattening, Expanding the definition of every, Expanding the definition of bools_to_memory_access, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pf_ec_from_byte_TCC2. Q.E.D.

C.150.9 PF_EC_Model.pf_ec_model_TCC1

Terse proof for pf_ec_model_TCC1.
pf_ec_model_TCC1:

{1} ∀ (f: [[PF_error_code_type, Address] → [list[Byte] → bool]]): (f = (λ (d: PF_error_code_type, a: Address): (zero_mask?(4)))) ⊃ (∀ (x_{1}: [PF_error_code_type, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Expanding the definition of singleton?, which is trivially true. This completes the proof of pf_ec_model_TCC1. Q.E.D.

C.150.10 PF_EC_Model.pf_ec_valid_to_byte

Terse proof for pf_ec_valid_to_byte.
pf_ec_valid_to_byte:

{1} ∀ (d: PF_error_code_type, a: Address):

valid?(uidt(pf_ec_model))(to_byte(pf_ec_model)(d, a), a)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: pf_ec_model pf_ec_to_byte pf_ec_valid? nth length cut_bits_zero

cut_bits_overwrite_bool_bit_disjoined cut_bits_overwrite_bits_disjoined cut_bits_cut_bits Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pf_ec_valid_to_byte. Q.E.D.

C.150.11 PF_EC_Model.pf_ec_is_pod

Terse proof for pf_ec_is_pod.

pf_ec_is_pod:

{1} pod_data_type?(pf_ec_model)

Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Expanding the definition of uninterpreted_data_type?, Applying propositional simplification, we get 6 subgoals:

pf_ec_is_pod.1:

{1} ∀ (l: list[Byte], a: Address):

¬ length(l) = size(pf_ec_model`uidt) ⊃ ¬ valid?(pf_ec_model`uidt)(l, a)

Repeatedly Skolemizing and flattening, Expanding the definition of pf_ec_model, Expanding the definition of pf_ec_valid?, Simplifying, rewriting, and recording with decision procedures, This completes the proof of pf_ec_is_pod.1.

pf_ec_is_pod.2:

{1} ∀ (d: PF_error_code_type, a: Address): valid?(uidt(pf_ec_model))(to_byte(pf_ec_model)(d, a), a)

Repeatedly Skolemizing and flattening, Rewriting using pf_ec_valid_to_byte, matching in *, This completes the proof of pf_ec_is_pod.2.

pf_ec_is_pod.3:

{1} ∀ (l: list[Byte], a: Address):

valid?(uidt(pf_ec_model))(l, a) ≡ up?(from_byte(pf_ec_model)(l, a))

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of pf_ec_model, Expanding the definition of pf_ec_from_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pf_ec_is_pod.3.

pf_ec_is_pod.4:

{1} ∀ (d: PF_error_code_type, a: Address): down(from_byte(pf_ec_model)(to_byte(pf_ec_model)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Using lemma pf_ec_valid_to_byte, Installing automatic rewrites from: pf_ec_model pf_ec_to_byte pf_ec_from_byte pf_ec_valid? nth length

cut_bits_overwrite_bool_bit_disjoined cut_bits_zero cut_bits_overwrite_bits_disjoined cut_bits_cut_bits cut_bits_overwrite_bits_contained cut_bit_overwrite_bool_bit bool_to_memory_access_iso bool_to_memory_privilege_iso

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Applying decompose-equality, Expanding the definition of bools_to_memory_access, Keeping (1) and hiding *, Adding type constraints for d!1‘access, Applying extensionality, Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pf_ec_is_pod.4.

pf_ec_is_pod.5:

{1} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pf_ec_model))(l, a_{1}) ≡ valid?(uidt(pf_ec_model))(l, a_{2})

Expanding the definition of pf_ec_model, Expanding the definition of pf_ec_valid?, which is trivially true. This completes the proof of pf_ec_is_pod.5.

pf_ec_is_pod.6:

{1} size(uidt(pf_ec_model)) > 0

Expanding the definition of pf_ec_model, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pf_ec_is_pod.6. Q.E.D.

C.151 Proofs for PF_Error_Code_Type (paging-data.pvs)

C.151.1 PF_Error_Code_Type.pf_ec_data_type_TCC1

Terse proof for pf_ec_data_type_TCC1.
pf_ec_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[PF_error_code_type])): true

Using lemma pf_ec_type_exists, This completes the proof of pf_ec_data_type_TCC1. Q.E.D.

C.152 Proofs for PTE_Datatype (paging-data.pvs)

C.152.1 PTE_Datatype.pte_data_type_TCC1

Terse proof for pte_data_type_TCC1.
pte_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[Pte_type])): true

Using lemma pte_data_type_exists, This completes the proof of pte_data_type_TCC1. Q.E.D.

C.153 Proofs for PTE_Model (paging-data-models.pvs)

C.153 Proofs for PTE_Model (paging-data-models.pvs)

C.153.1 PTE_Model.pte_page_to_byte_TCC1

Terse proof for pte_page_to_byte_TCC1.
pte_page_to_byte_TCC1:

{1} ∀ (pte: Pte_4k_type):

overwrite_bool_bit(overwrite_bool_bit(overwrite_bool_bit(overwrite_bool_bit

(overwrite_bool_bit (overwrite_bool_bit (overwrite_bool_bit (overwrite_bool_bit (0, true, 0), mem-

ory_access_to_bools (pte`access)`1, 1), mem-

ory_privilege_to_bool (pte`privilege), 2),

pte`write_through, 3),

pte`cache_disabled, 4),

pte`accessed,

5),

pte`dirty, 6),

pte`page_table_attribute_index, 7)

< max_byte

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte overwrite_bool_bit_less over-

write_shift_bits_less max_linear_offset bus_width Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_page_to_byte_TCC1. Q.E.D.

C.153.2 PTE_Model.pte_page_to_byte_TCC2

Terse proof for pte_page_to_byte_TCC2.
pte_page_to_byte_TCC2:

{1} ∀ (pte: Pte_4k_type): offset(pte`page_base) ≥ 0

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_page_to_byte_TCC2. Q.E.D.

C.153.3 PTE_Model.pte_page_to_byte_TCC3

Terse proof for pte_page_to_byte_TCC3.
pte_page_to_byte_TCC3:

{1} ∀ (pte: Pte_4k_type): every[nat]

({s: nat | s < max_byte})

((:overwrite_shift_bits(overwrite_bool_bit(0, pte`global_page, 0),

cut_bits(offset(pte`page_base), 12, 4), 4, 4),

cut_bits(offset(pte`page_base), 16, 8), cut_bits(offset(pte`page_base), 24, 8):))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte cut_bits_byte overwrite_bool_bit_less

overwrite_shift_bits_less Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_page_to_byte_TCC3. Q.E.D.

C.153.4 PTE_Model.pte_to_byte_TCC1

Terse proof for pte_to_byte_TCC1.
pte_to_byte_TCC1:

{1} ∀ (pte: Pte_type): pte = Not_present ⊃ 0 < max_byte

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every less_than_max_byte expt_2_8 Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_to_byte_TCC1. Q.E.D.

C.153.5 PTE_Model.pte_to_byte_TCC2

Terse proof for pte_to_byte_TCC2.
pte_to_byte_TCC2:

{1} ∀ (pte: Pte_type): pte = Not_present ⊃ every[real] (λ (x: real): rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte) ((:0, 0, 0:))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of max_byte, Adding type constraints for expt(2, bits_per_byte), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_to_byte_TCC2. Q.E.D.

C.153.6 PTE_Model.pte_page_from_byte_TCC1

Terse proof for pte_page_from_byte_TCC1.
pte_page_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address): pte_valid?(data, a) ⊃ 0 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pte_page_from_byte_TCC1. Q.E.D.

C.153.7 PTE_Model.pte_page_from_byte_TCC2

Terse proof for pte_page_from_byte_TCC2.
pte_page_from_byte_TCC2:

{1} ∀ (data: list[Byte], a: Address):

pte_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ⊃

((singleton [Memory_access](Read) ∪ {Execute}) ⊆ bools_to_memory_access (cut_bit(nth [Byte](data, 0), 1), true))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pte_page_from_byte_TCC2. Q.E.D.

C.153.8 PTE_Model.pte_page_from_byte_TCC3

Terse proof for pte_page_from_byte_TCC3.
pte_page_from_byte_TCC3:

{1} ∀ (data: list[Byte], a: Address):

pte_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ⊃ 1 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pte_page_from_byte_TCC3. Q.E.D.

C.153.9 PTE_Model.pte_page_from_byte_TCC4

Terse proof for pte_page_from_byte_TCC4.
pte_page_from_byte_TCC4:

{1} ∀ (data: list[Byte], a: Address):

pte_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ⊃ 2 < length[Byte](data)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pte_page_from_byte_TCC4. Q.E.D.

C Proof scripts

C.153.10 PTE_Model.pte_page_from_byte_TCC5

Terse proof for pte_page_from_byte_TCC5.
pte_page_from_byte_TCC5:

{1} ∀ (data: list[Byte], a: Address):

pte_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ⊃ 3 < length[Byte](data)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less pte_valid? max_linear_offset bus_width

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_page_from_byte_TCC5. Q.E.D.

C.153.11 PTE_Model.pte_page_from_byte_TCC6

Terse proof for pte_page_from_byte_TCC6.

pte_page_from_byte_TCC6:

{1} ∀ (data: list[Byte], a: Address): pte_valid?(data, a) ∧ cut_bit(nth(data, 0), 0) ⊃ Mem?(Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0,

cut_bits (nth[Byte]

(data, 1),

  4,

4), 12, 4),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`type_of)

∧ (0 ≤

Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0, cut_bits (nth[Byte]

(data, 1),

4,

4), 12, 4),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

∧ Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits(0,

cut_bits (nth[Byte]

(data, 1),

4,

4), 12, 4),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))`offset

< max_linear_offset) ∧ aligned?(12)

(offset

(Mem(overwrite_shift_bits(overwrite_shift_bits(overwrite_shift_bits

(0, cut_bits (nth[Byte](data, 1),

4,

4), 12, 4),

nth[Byte](data, 2), 16, 8),

nth[Byte](data, 3), 24, 8))))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: every aligned_address? aligned_overwrite_shift_bits_more

aligned_overwrite_shift_bits_less aligned_zero max_linear_expt_val overwrite_shift_bits_less pte_valid? max_linear_offset bus_width

Expanding the definition of Mem, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_page_from_byte_TCC6. Q.E.D.

C.153.12 PTE_Model.pte_from_byte_TCC1

Terse proof for pte_from_byte_TCC1.
pte_from_byte_TCC1:

{1} ∀ (data: list[Byte], a: Address):

cut_bit(nth(data, 0), 0) ∧ pte_valid?(data, a) ⊃ up?[Pte_4k_type](pte_page_from_byte(data, a))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pte_from_byte_TCC1. Q.E.D.

C.153.13 PTE_Model.pte_model_TCC1

Terse proof for pte_model_TCC1.
pte_model_TCC1:

{1} ∀ (f: [[Pte_type, Address] → [list[Byte] → bool]]):

(f = (λ (d: Pte_type, a: Address): (zero_mask?(4)))) ⊃ (∀ (x_{1}: [Pte_type, Address]): singleton?[list[Byte]](f(x_{1})))

Repeatedly Skolemizing and flattening, Replacing using formula -1, Using lemma singleton_zero_mask, Expanding the definition of singleton?, which is trivially true. This completes the proof of pte_model_TCC1. Q.E.D.

C.153.14 PTE_Model.pte_valid_to_byte

The L^{A}TEX code for this proof is broken.

C.153.15 PTE_Model.pte_is_pod

Terse proof for pte_is_pod.

pte_is_pod:

{1} pod_data_type?(pte_model)

Expanding the definition of pod_data_type?, Expanding the definition of interpreted_data_type?, Expanding the definition of uninterpreted_data_type?, Applying propositional simplification, we get 6 subgoals:

pte_is_pod.1:

{1} ∀ (l: list[Byte], a: Address):

¬ length(l) = size(pte_model`uidt) ⊃ ¬ valid?(pte_model`uidt)(l, a)

Repeatedly Skolemizing and flattening, Expanding the definition of pte_model, Expanding the definition of pte_valid?, which is trivially true. This completes the proof of pte_is_pod.1.

pte_is_pod.2:

{1} ∀ (d: Pte_type, a: Address): valid?(uidt(pte_model))(to_byte(pte_model)(d, a), a)

Repeatedly Skolemizing and flattening, Rewriting using pte_valid_to_byte, matching in *, This completes the proof of pte_is_pod.2.

pte_is_pod.3:

{1} ∀ (l: list[Byte], a: Address):

valid?(uidt(pte_model))(l, a) ≡ up?(from_byte(pte_model)(l, a))

Repeatedly Skolemizing and flattening, Expanding the definition of pte_model, Expanding the definition of pte_from_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_is_pod.3.

pte_is_pod.4:

{1} ∀ (d: Pte_type, a: Address):

down(from_byte(pte_model)(to_byte(pte_model)(d, a), a)) = d

Repeatedly Skolemizing and flattening, Expanding the definition of pte_model, Expanding the definition of pte_to_byte, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

pte_is_pod.4.1:

{-1} not_present?(d′)
{1} down(pte_from_byte((:0, 0, 0, 0:), a′)) = d′

Installing automatic rewrites from: pte_from_byte cut_bit_zero nth pte_valid? length pte_page_from_byte

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_is_pod.4.1.

pte_is_pod.4.2:

{1} not_present?(d′)
{2} down(pte_from_byte(pte_page_to_byte(pte(d′), a′), a′)) = d′

Installing automatic rewrites from: pte_page_to_byte! pte_from_byte pte_page_from_byte pte_valid? nth length length_cdr length_is_cons cut_bits_overwrite_bool_bit_disjoined cut_bits_zero cut_bits_overwrite_bits_disjoined cut_bits_cut_bits cut_bits_overwrite_bits_contained cut_bit_overwrite_bool_bit overwrite_shift_bits_zero overwrite_shift_bits_merge aligned_address_aligned cut_bit_cut_bits cut_bit_overwrite_shift_bits cut_bits_overwrite_shift_bits_contained length_to_byte from_byte_to_byte valid_to_byte cut_bit_zero bool_to_memory_access_iso bool_to_memory_privilege_iso max_linear_offset bus_width

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Adding type constraints for pte(d!1)‘page_base, Rewriting using shift_bits_left_cut_bits, matching in *, Applying extensionality, we get 3 subgoals:

pte_is_pod.4.2.1:

{-1} Mem?(pte(d′)`page_base`type_of)
{-2} 0 ≤ pte(d′)`page_base`offset
{-3} pte(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pte(d′)`page_base))

{1} (#page_base := Mem(offset(pte(d′)`page_base)), global_page := pte(d′)`global_page, page_table_attribute_index := pte(d′)`page_table_attribute_index, dirty := pte(d′)`dirty, accessed := pte(d′)`accessed, cache_disabled := pte(d′)`cache_disabled, write_through := pte(d′)`write_through, privilege := pte(d′)`privilege, access := bools_to_memory_access(memory_access_to_bools(pte(d′)`access)`1, true)#) = pte(d′)

{2} not_present?(d′)

Applying extensionality, we get 2 subgoals:

pte_is_pod.4.2.1.1:

{-1} Mem?(pte(d′)`page_base`type_of)
{-2} 0 ≤ pte(d′)`page_base`offset
{-3} pte(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pte(d′)`page_base))
{1} bools_to_memory_access(memory_access_to_bools(pte(d′)`access)`1, true) = pte(d′)`access
{2} not_present?(d′)

Applying extensionality, Expanding the definition of bools_to_memory_access, Expanding the definition of memory_access_to_bools, Adding type constraints for pte(d!1)‘access, Expanding the definition of subset?, Instantiating the top quantifier in -1 with the terms: x′, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pte_is_pod.4.2.1.1.

pte_is_pod.4.2.1.2:

{-1} Mem?(pte(d′)`page_base`type_of)
{-2} 0 ≤ pte(d′)`page_base`offset
{-3} pte(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pte(d′)`page_base))
{1} Mem(offset(pte(d′)`page_base)) = pte(d′)`page_base
{2} not_present?(d′)

Expanding the definition of Mem, Applying extensionality, This completes the proof of pte_is_pod.4.2.1.2.

pte_is_pod.4.2.2:

{-1} Mem?(pte(d′)`page_base`type_of)
{-2} 0 ≤ pte(d′)`page_base`offset
{-3} pte(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pte(d′)`page_base))

{1} Mem?(Mem(offset(pte(d′)`page_base))`type_of) ∧ (0 ≤ Mem(offset(pte(d′)`page_base))`offset ∧

Mem(offset(pte(d′)`page_base))`offset < expt(2, 32)) ∧ aligned?(12)(offset(Mem(offset(pte(d′)`page_base))))

{2} not_present?(d′)

Expanding the definition of Mem, which is trivially true. This completes the proof of pte_is_pod.4.2.2.

pte_is_pod.4.2.3:

{-1} Mem?(pte(d′)`page_base`type_of)
{-2} 0 ≤ pte(d′)`page_base`offset
{-3} pte(d′)`page_base`offset < expt(2, 32)
{-4} aligned?(12)(offset(pte(d′)`page_base))
{1} ((singleton[Memory_access](Read) ∪ {Execute}) ⊆ bools_to_memory_access (memory_access_to_bools (pte(d′)‘access)‘1, true))
{2} not_present?(d′)

Expanding the definition of bools_to_memory_access, Expanding the definition of memory_access_to_bools, Adding type constraints for pte(d!1)‘access, Expanding the definition of subset?, Repeatedly Skolemizing and flattening, Instantiating the top quantifier in -1 with the terms: x′, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pte_is_pod.4.2.3.

pte_is_pod.5:

{1} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pte_model))(l, a_{1}) ≡ valid?(uidt(pte_model))(l, a_{2})

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Expanding the definition of pte_model, Expanding the definition of pte_valid?, which is trivially true. This completes the proof of pte_is_pod.5.

pte_is_pod.6:

{1} size(uidt(pte_model)) > 0

Expanding the definition of pte_model, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pte_is_pod.6. Q.E.D.

C.154 Proofs for Page_Directory_Types (paging-data.pvs)

C.154.1 Page_Directory_Types.Pde_pt_type_TCC1

Terse proof for Pde_pt_type_TCC1.
Pde_pt_type_TCC1:

{1} ∀ (a: Memory_Address_4G): offset(a) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Pde_pt_type_TCC1. Q.E.D.

C.155 Proofs for Paging_Datatype (paging-data.pvs)

C.155.1 Paging_Datatype.paging_data_type_TCC1

Terse proof for paging_data_type_TCC1.
paging_data_type_TCC1:

{1} ∀ (lvl: Level): lvl = 0 ⊃ (∀ (x: ((range_pt(lvl)))): (pdir?)(x))

Repeatedly Skolemizing and flattening, Expanding the definition of range_pt, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of paging_data_type_TCC1. Q.E.D.

C.155.2 Paging_Datatype.paging_data_type_TCC2

Terse proof for paging_data_type_TCC2.
paging_data_type_TCC2:

{1} ∀ (lvl: Level): lvl = 0 ⊃ (∀ (x_{1}: Pde_type): range_pt(lvl)(Pdir(x_{1})))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of paging_data_type_TCC2. Q.E.D.

C.155 Proofs for Paging_Datatype (paging-data.pvs)

C.155.3 Paging_Datatype.paging_data_type_TCC3

Terse proof for paging_data_type_TCC3.
paging_data_type_TCC3:

{1} ∀ (lvl: Level):

lvl = 0 ⊃ pod_data_type?[(range_pt(lvl))]

(dt_lift[Pde_type, (range_pt(lvl))] (pde_data_type, restrict[(pdir?), (range_pt(lvl)), Pde_type](pdir), Pdir))

Repeatedly Skolemizing and flattening,

Expanding the definition of dt_lift,

Adding type constraints for pde_data_type,

Expanding the definition of pod_data_type?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of interpreted_data_type?,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

paging_data_type_TCC3.1:

{-1} uninterpreted_data_type?(pde_data_type`uidt)

{-2} ∀ (d: Pde_type, a: Address):

valid?(uidt(pde_data_type))(to_byte(pde_data_type)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(pde_data_type))(l, a) ≡ up?(from_byte(pde_data_type)(l, a))

{-4} ∀ (d: Pde_type, a: Address):

down(from_byte(pde_data_type)(to_byte(pde_data_type)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pde_data_type))(l, a_{1}) ≡ valid?(uidt(pde_data_type))(l, a_{2})

{-6} size(uidt(pde_data_type)) > 0
{-7} lvl′ < max_level
{-8} lvl′ = 0

{1} ∀ (d: ((range_pt(lvl′))), a_1: Address):

down(cases from_byte(pde_data_type)

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d),

a_1), a_1) of

up(d_{1}): up(Pdir(d_{1})), bottom: bottom endcases)

= d

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

paging_data_type_TCC3.1.1:

{-1} range_pt(lvl′)(d′)
{-2} uninterpreted_data_type?(pde_data_type`uidt)

{-3} ∀ (d: Pde_type, a: Address):

valid?(uidt(pde_data_type))(to_byte(pde_data_type)(d, a), a)

{-4} ∀ (l: list[Byte], a: Address):

valid?(uidt(pde_data_type))(l, a) ≡ up?(from_byte(pde_data_type)(l, a))

{-5} ∀ (d: Pde_type, a: Address):

down(from_byte(pde_data_type)(to_byte(pde_data_type)(d, a), a)) = d

{-6} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pde_data_type))(l, a_{1}) ≡ valid?(uidt(pde_data_type))(l, a_{2})

{-7} size(uidt(pde_data_type)) > 0
{-8} lvl′ < max_level
{-9} lvl′ = 0

{-10} up?(from_byte(pde_data_type)

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d′), a′), a′))

{1} Pdir(down(from_byte(pde_data_type)

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d′),

a′),

a′)))
= d′

Instantiating the top quantifier in -5 with the terms: (pdir(d!1) a!1), we get 2 subgoals:

paging_data_type_TCC3.1.1.1:

{-1} range_pt(lvl′)(d′)
{-2} uninterpreted_data_type?(pde_data_type`uidt)

{-3} ∀ (d: Pde_type, a: Address):

valid?(uidt(pde_data_type))(to_byte(pde_data_type)(d, a), a)

{-4} ∀ (l: list[Byte], a: Address):

valid?(uidt(pde_data_type))(l, a) ≡ up?(from_byte(pde_data_type)(l, a))

{-5} down(from_byte(pde_data_type)(to_byte(pde_data_type)(pdir(d′), a′), a′)) =

pdir(d′) {-6} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pde_data_type))(l, a_{1}) ≡ valid?(uidt(pde_data_type))(l, a_{2})

{-7} size(uidt(pde_data_type)) > 0
{-8} lvl′ < max_level
{-9} lvl′ = 0

{-10} up?(from_byte(pde_data_type)

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d′), a′), a′))

{1} Pdir(down(from_byte(pde_data_type)

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d′),

a′),

a′)))
= d′

Expanding the definition of restrict, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -5, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma Paging_type_Pdir_eta,

This completes the proof of paging_data_type_TCC3.1.1.1.
paging_data_type_TCC3.1.1.2:

{-1} range_pt(lvl′)(d′)
{-2} uninterpreted_data_type?(pde_data_type`uidt)

{-3} ∀ (d: Pde_type, a: Address):

valid?(uidt(pde_data_type))(to_byte(pde_data_type)(d, a), a)

{-4} ∀ (l: list[Byte], a: Address):

valid?(uidt(pde_data_type))(l, a) ≡ up?(from_byte(pde_data_type)(l, a))

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pde_data_type))(l, a_{1}) ≡ valid?(uidt(pde_data_type))(l, a_{2})

{-6} size(uidt(pde_data_type)) > 0
{-7} lvl′ < max_level
{-8} lvl′ = 0

{-9} up?(from_byte(pde_data_type)

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d′), a′), a′))

{1} pdir?(d′)

{2} Pdir(down(from_byte(pde_data_type)

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d′),

a′),

a′)))
= d′

Expanding the definition of range_pt, which is trivially true.

This completes the proof of paging_data_type_TCC3.1.1.2.
paging_data_type_TCC3.1.2:

{-1} range_pt(lvl′)(d′)
{-2} uninterpreted_data_type?(pde_data_type`uidt)

{-3} ∀ (d: Pde_type, a: Address):

valid?(uidt(pde_data_type))(to_byte(pde_data_type)(d, a), a)

{-4} ∀ (l: list[Byte], a: Address):

valid?(uidt(pde_data_type))(l, a) ≡ up?(from_byte(pde_data_type)(l, a))

{-5} ∀ (d: Pde_type, a: Address):

down(from_byte(pde_data_type)(to_byte(pde_data_type)(d, a), a)) = d

{-6} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pde_data_type))(l, a_{1}) ≡ valid?(uidt(pde_data_type))(l, a_{2})

{-7} size(uidt(pde_data_type)) > 0
{-8} lvl′ < max_level
{-9} lvl′ = 0

{1} up?(from_byte(pde_data_type)

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d′), a′), a′))

{2} down(bottom) = d′

Expanding the definition of restrict, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of paging_data_type_TCC3.1.2.
paging_data_type_TCC3.2:

{-1} uninterpreted_data_type?(pde_data_type`uidt)

{-2} ∀ (d: Pde_type, a: Address):

valid?(uidt(pde_data_type))(to_byte(pde_data_type)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(pde_data_type))(l, a) ≡ up?(from_byte(pde_data_type)(l, a))

{-4} ∀ (d: Pde_type, a: Address):

down(from_byte(pde_data_type)(to_byte(pde_data_type)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pde_data_type))(l, a_{1}) ≡ valid?(uidt(pde_data_type))(l, a_{2})

{-6} size(uidt(pde_data_type)) > 0
{-7} lvl′ < max_level
{-8} lvl′ = 0

{1} ∀ (l_1: list[Byte], a_1: Address): valid?(uidt(pde_data_type))(l_1, a_1) ≡ up?(cases from_byte(pde_data_type)(l_1, a_1) of up(d_{1}): up(Pdir(d_{1})), bot-

tom: bottom endcases)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of paging_data_type_TCC3.2.

paging_data_type_TCC3.3:

{-1} uninterpreted_data_type?(pde_data_type`uidt)

{-2} ∀ (d: Pde_type, a: Address):

valid?(uidt(pde_data_type))(to_byte(pde_data_type)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(pde_data_type))(l, a) ≡ up?(from_byte(pde_data_type)(l, a))

{-4} ∀ (d: Pde_type, a: Address):

down(from_byte(pde_data_type)(to_byte(pde_data_type)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pde_data_type))(l, a_{1}) ≡ valid?(uidt(pde_data_type))(l, a_{2})

{-6} size(uidt(pde_data_type)) > 0
{-7} lvl′ < max_level
{-8} lvl′ = 0

{1} ∀ (d: ((range_pt(lvl′))), a_1: Address):

valid?(uidt(pde_data_type))

(to_byte(pde_data_type)

(restrict[(pdir?), ((range_pt(lvl′))), Pde_type](pdir)(d), a_1), a_1)

Repeatedly Skolemizing and flattening, Expanding the definition of restrict, Instantiating quantified variables, This completes the proof of paging_data_type_TCC3.3. Q.E.D.

C.155.4 Paging_Datatype.paging_data_type_TCC4

Terse proof for paging_data_type_TCC4.
paging_data_type_TCC4:

{1} ∀ (lvl: Level): lvl = 1 ⊃ (∀ (x: ((range_pt(lvl)))): (ptab?)(x))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of paging_data_type_TCC4. Q.E.D.

C.155.5 Paging_Datatype.paging_data_type_TCC5

Terse proof for paging_data_type_TCC5.
paging_data_type_TCC5:

{1} ∀ (lvl: Level): lvl = 1 ⊃ (∀ (x_{1}: Pte_type): range_pt(lvl)(Ptab(x_{1})))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of paging_data_type_TCC5. Q.E.D.

C.155.6 Paging_Datatype.paging_data_type_TCC6

Terse proof for paging_data_type_TCC6.
paging_data_type_TCC6:

{1} ∀ (lvl: Level):

lvl = 1 ⊃ pod_data_type?[(range_pt(lvl))]

(dt_lift[Pte_type, (range_pt(lvl))] (pte_data_type, restrict[(ptab?), (range_pt(lvl)), Pte_type](ptab), Ptab))

Expanding the definition of restrict, Expanding the definition of dt_lift, Repeatedly Skolemizing and flattening, Adding type constraints for pte_data_type, Expanding the definition of pod_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of interpreted_data_type?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 3 subgoals:

paging_data_type_TCC6.1:

{-1} uninterpreted_data_type?(pte_data_type`uidt)

{-2} ∀ (d: Pte_type, a: Address):

valid?(uidt(pte_data_type))(to_byte(pte_data_type)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(pte_data_type))(l, a) ≡ up?(from_byte(pte_data_type)(l, a))

{-4} ∀ (d: Pte_type, a: Address):

down(from_byte(pte_data_type)(to_byte(pte_data_type)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pte_data_type))(l, a_{1}) ≡ valid?(uidt(pte_data_type))(l, a_{2})

{-6} size(uidt(pte_data_type)) > 0
{-7} lvl′ < max_level
{-8} lvl′ = 1

{1} ∀ (d: ((range_pt(lvl′))), a_1: Address):

down(cases from_byte(pte_data_type)(to_byte(pte_data_type)(ptab(d), a_1), a_1) of up(d_{1}): up(Ptab(d_{1})), bottom: bottom endcases)

= d

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -5, Using lemma Paging_type_Ptab_eta, This completes the proof of paging_data_type_TCC6.1.

paging_data_type_TCC6.2:

{-1} uninterpreted_data_type?(pte_data_type`uidt)

{-2} ∀ (d: Pte_type, a: Address):

valid?(uidt(pte_data_type))(to_byte(pte_data_type)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(pte_data_type))(l, a) ≡ up?(from_byte(pte_data_type)(l, a))

{-4} ∀ (d: Pte_type, a: Address):

down(from_byte(pte_data_type)(to_byte(pte_data_type)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pte_data_type))(l, a_{1}) ≡ valid?(uidt(pte_data_type))(l, a_{2})

{-6} size(uidt(pte_data_type)) > 0
{-7} lvl′ < max_level
{-8} lvl′ = 1

{1} ∀ (l_1: list[Byte], a_1: Address): valid?(uidt(pte_data_type))(l_1, a_1) ≡ up?(cases from_byte(pte_data_type)(l_1, a_1) of up(d_{1}): up(Ptab(d_{1})), bot-

tom: bottom endcases)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of paging_data_type_TCC6.2.

C.156 Proofs for Paging_type (paging-data.pvs)

paging_data_type_TCC6.3:

{-1} uninterpreted_data_type?(pte_data_type`uidt)

{-2} ∀ (d: Pte_type, a: Address):

valid?(uidt(pte_data_type))(to_byte(pte_data_type)(d, a), a)

{-3} ∀ (l: list[Byte], a: Address):

valid?(uidt(pte_data_type))(l, a) ≡ up?(from_byte(pte_data_type)(l, a))

{-4} ∀ (d: Pte_type, a: Address):

down(from_byte(pte_data_type)(to_byte(pte_data_type)(d, a), a)) = d

{-5} ∀ (l: list[Byte], a_{1}, a_{2}: Address):

valid?(uidt(pte_data_type))(l, a_{1}) ≡ valid?(uidt(pte_data_type))(l, a_{2})

{-6} size(uidt(pte_data_type)) > 0
{-7} lvl′ < max_level
{-8} lvl′ = 1

{1} ∀ (d: ((range_pt(lvl′))), a_1: Address): valid?(uidt(pte_data_type))(to_byte(pte_data_type)(ptab(d), a_1), a_1)

Repeatedly Skolemizing and flattening, Instantiating quantified variables, This completes the proof of paging_data_type_TCC6.3. Q.E.D.

C.155.7 Paging_Datatype.paging_data_type_TCC7

Terse proof for paging_data_type_TCC7.
paging_data_type_TCC7:

{1} ∀ (lvl: Level): lvl = 0 ∨ lvl = 1

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of paging_data_type_TCC7. Q.E.D.

C.156 Proofs for Paging_type (paging-data.pvs)

This theory contains no provable formal statements.

C.157 Proofs for Paging_type_adt (Paging_type_adt.pvs)

This theory contains no provable formal statements.

C.158 Proofs for Paging_type_adt_reduce (Paging_type_adt.pvs)

This theory contains no provable formal statements.

C.159 Proofs for Paging_type_helpers (paging-data.pvs)

C.159.1 Paging_type_helpers.range_pt_TCC1

Terse proof for range_pt_TCC1.

range_pt_TCC1:

{1} ∀ (lvl: Level): lvl = 0 ∨ lvl = 1

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of range_pt_TCC1. Q.E.D.

C.159.2 Paging_type_helpers.base_TCC1

Terse proof for base_TCC1.

base_TCC1:

{1} ∀ (pt: (present?), ptab: Pte_type): pt = Ptab(ptab) ⊃ pte?(ptab)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of base_TCC1. Q.E.D.

C.159.3 Paging_type_helpers.base_TCC2

Terse proof for base_TCC2.

base_TCC2:

{1} ∀ (pt: (present?), pdir: Pde_type): pt = Pdir(pdir) ⊃ ¬ not_present?(pdir)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of base_TCC2. Q.E.D.

C.159.4 Paging_type_helpers.set_reference_range

Terse proof for set_reference_range.
set_reference_range:

{1} ∀ (lvl: Level, pt: (range_pt(lvl)), access: Memory_access):

range_pt(lvl)(set_reference(pt, access))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of set_reference_range. Q.E.D.

C.159.5 Paging_type_helpers.set_reference_pdir_entry

Terse proof for set_reference_pdir_entry.

C.159 Proofs for Paging_type_helpers (paging-data.pvs)

set_reference_pdir_entry:

{1} ∀ (pt1, pt2: Paging_type, access: Memory_access):

set_reference(pt1, access) = set_reference(pt2, access) ⊃ pdir_entry?(pt1) = pdir_entry?(pt2)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of set_reference_pdir_entry.

Q.E.D.

C.159.6 Paging_type_helpers.set_reference_ptab_entry

Terse proof for set_reference_ptab_entry.
set_reference_ptab_entry:

{1} ∀ (pt1, pt2: Paging_type, access: Memory_access):

set_reference(pt1, access) = set_reference(pt2, access) ⊃ ptab_entry?(pt1) = ptab_entry?(pt2)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of set_reference_ptab_entry.

Q.E.D.

C.159.7 Paging_type_helpers.set_reference_paging_type

Terse proof for set_reference_paging_type.
set_reference_paging_type:

{1} ∀ (pt1, pt2: Paging_type, access: Memory_access, lvl: Level): set_reference(pt1, access) = set_reference(pt2, access) ⊃ paging_type?(lvl, pt1) = paging_type?(lvl, pt2)

Repeatedly Skolemizing and flattening, Expanding the definition of paging_type?, Case splitting on lvl!1 = 0, we get 2 subgoals:

set_reference_paging_type.1:

{-1} lvl′ = 0
{-2} lvl′ < max_level
{-3} set_reference(pt1′, access′) = set_reference(pt2′, access′)

{1} cond lvl′ = 0 → pdir_entry?(pt1′), ELSE → ptab_entry?(pt1′) endcond = cond lvl′ = 0 → pdir_entry?(pt2′), ELSE → ptab_entry?(pt2′) endcond

Using lemma set_reference_pdir_entry, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of set_reference_paging_type.1.
set_reference_paging_type.2:

{-1} lvl′ < max_level
{-2} set_reference(pt1′, access′) = set_reference(pt2′, access′)
{1} lvl′ = 0

{2} cond lvl′ = 0 → pdir_entry?(pt1′), ELSE → ptab_entry?(pt1′) endcond = cond lvl′ = 0 → pdir_entry?(pt2′), ELSE → ptab_entry?(pt2′) endcond Using lemma set_reference_ptab_entry, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of set_reference_paging_type.2.

Q.E.D.

C.159.8 Paging_type_helpers.set_reference_present

Terse proof for set_reference_present.
set_reference_present:

{1} ∀ (pt1, pt2: Paging_type, access: Memory_access):

set_reference(pt1, access) = set_reference(pt2, access) ⊃ present?(pt1) = present?(pt2)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, we get 12 subgoals:

set_reference_present.1:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) = Ptab(Not_present)
{-4} ptab?(pt2′)
{-5} not_present?(ptab(pt2′))
{1} not_present?(ptab(pt1′))

Applying decompose-equality, This completes the proof of set_reference_present.1.

set_reference_present.2:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-4} not_present?(pdir(pt2′))
{1} ptab?(pt1′)
{2} ptab?(pt2′)

Applying decompose-equality, This completes the proof of set_reference_present.2.

set_reference_present.3:

{-1} Write?(access′)

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Not_present)

{-3} not_present?(pdir(pt2′))
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)

Applying decompose-equality, This completes the proof of set_reference_present.3.

set_reference_present.4:

{-1} ptab?(pt1′)
{-2} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) = Ptab(Not_present)
{-3} ptab?(pt2′)
{-4} not_present?(ptab(pt2′))
{1} Write?(access′)
{2} not_present?(ptab(pt1′))

Applying decompose-equality, This completes the proof of set_reference_present.4.

set_reference_present.5:

{-1} pde_pt?(pdir(pt1′))
{-2} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-3} not_present?(pdir(pt2′))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)

Applying decompose-equality, This completes the proof of set_reference_present.5.

set_reference_present.6:

{-1} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-2} not_present?(pdir(pt2′))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)

Applying decompose-equality, This completes the proof of set_reference_present.6.

set_reference_present.7:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} not_present?(ptab(pt1′))

{-4} Ptab(Not_present) = Ptab(Pte(pte(ptab(pt2′)) with [dirty := true, ac-

cessed := true]))

{-5} ptab?(pt2′)
{1} not_present?(ptab(pt2′))

Applying decompose-equality, This completes the proof of set_reference_present.7.

set_reference_present.8:

{-1} Write?(access′)
{-2} not_present?(pdir(pt1′))
{-3} pde_pt?(pdir(pt2′))
{-4} Pdir(Not_present) = Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))
{1} ptab?(pt1′)
{2} ptab?(pt2′)

Applying decompose-equality, This completes the proof of set_reference_present.8.

set_reference_present.9:

{-1} Write?(access′)
{-2} not_present?(pdir(pt1′))

{-3} Pdir(Not_present) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{1} ptab?(pt1′)
{2} pde_pt?(pdir(pt2′))
{3} ptab?(pt2′)
{4} not_present?(pdir(pt2′))

Applying decompose-equality, This completes the proof of set_reference_present.9.

set_reference_present.10:

{-1} ptab?(pt1′)
{-2} not_present?(ptab(pt1′))
{-3} Ptab(Not_present) = Ptab(Pte(pte(ptab(pt2′)) with [accessed := true]))
{-4} ptab?(pt2′)
{1} Write?(access′)
{2} not_present?(ptab(pt2′))

Applying decompose-equality,

This completes the proof of set_reference_present.10.
set_reference_present.11:

{-1} not_present?(pdir(pt1′))
{-2} pde_pt?(pdir(pt2′))
{-3} Pdir(Not_present) = Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)

Applying decompose-equality,

This completes the proof of set_reference_present.11.
set_reference_present.12:

{-1} not_present?(pdir(pt1′))
{-2} Pdir(Not_present) = Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} pde_pt?(pdir(pt2′))
{4} ptab?(pt2′)
{5} not_present?(pdir(pt2′))

Applying decompose-equality,

This completes the proof of set_reference_present.12.

Q.E.D.

C.159.9 Paging_type_helpers.set_reference_base_TCC1

Terse proof for set_reference_base_TCC1.

set_reference_base_TCC1:

{1} ∀ (pt1, pt2: Paging_type, access: Memory_access):

set_reference(pt1, access) = set_reference(pt2, access) ∧ present?(pt1) ⊃ present?(pt2)

Repeatedly Skolemizing and flattening, Using lemma set_reference_present, Simplifying, rewriting, and recording with decision procedures, This completes the proof of set_reference_base_TCC1. Q.E.D.

C.159.10 Paging_type_helpers.set_reference_base

Terse proof for set_reference_base.
set_reference_base:

{1} ∀ (pt1, pt2: Paging_type, access: Memory_access):

set_reference(pt1, access) = set_reference(pt2, access) ∧ present?(pt1) ⊃

base(pt1) = base(pt2)

Trying repeated skolemization, instantiation, and if-lifting, we get 16 subgoals:

set_reference_base.1:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)
{-4} not_present?(ptab(pt2′))
{-5} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) = Ptab(Not_present)
{1} not_present?(ptab(pt1′))
{2} page_base(pte(ptab(pt1′))) = page_base(pte(ptab(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.1.

set_reference_base.2:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)

{-4} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [dirty := true, accessed := true]))

{1} not_present?(ptab(pt1′))
{2} not_present?(ptab(pt2′))
{3} page_base(pte(ptab(pt1′))) = page_base(pte(ptab(pt2′)))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality, Applying decompose-equality, This completes the proof of set_reference_base.2.

set_reference_base.3:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} not_present?(pdir(pt2′))
{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} page_table_base(pde_pt(pdir(pt1′))) = page_base(pde_4m(pdir(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.3.

set_reference_base.4:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} pde_pt?(pdir(pt2′))

{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} page_table_base(pde_pt(pdir(pt1′))) = page_table_base(pde_pt(pdir(pt2′)))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality, This completes the proof of set_reference_base.4.

set_reference_base.5:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} not_present?(pdir(pt2′))
{4} pde_pt?(pdir(pt2′))
{5} page_table_base(pde_pt(pdir(pt1′))) = page_base(pde_4m(pdir(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.5.

set_reference_base.6:

{-1} Write?(access′)
{-2} not_present?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Not_present)

{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} page_base(pde_4m(pdir(pt1′))) = page_base(pde_4m(pdir(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.6.

set_reference_base.7:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} page_base(pde_4m(pdir(pt1′))) = page_table_base(pde_pt(pdir(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.7.

set_reference_base.8:

{-1} Write?(access′)

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} not_present?(pdir(pt2′))
{6} pde_pt?(pdir(pt2′))
{7} page_base(pde_4m(pdir(pt1′))) = page_base(pde_4m(pdir(pt2′)))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality, This completes the proof of set_reference_base.8.

set_reference_base.9:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)
{-3} not_present?(ptab(pt2′))
{-4} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) = Ptab(Not_present)
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} page_base(pte(ptab(pt1′))) = page_base(pte(ptab(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.9.

set_reference_base.10:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)

{-3} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [accessed := true]))

{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} not_present?(ptab(pt2′))
{4} page_base(pte(ptab(pt1′))) = page_base(pte(ptab(pt2′)))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality, This completes the proof of set_reference_base.10.

set_reference_base.11:

{-1} pde_pt?(pdir(pt1′))
{-2} not_present?(pdir(pt2′))
{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} page_table_base(pde_pt(pdir(pt1′))) = page_base(pde_4m(pdir(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.11.

set_reference_base.12:

{-1} pde_pt?(pdir(pt1′))
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} page_table_base(pde_pt(pdir(pt1′))) = page_table_base(pde_pt(pdir(pt2′)))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality, This completes the proof of set_reference_base.12.

set_reference_base.13:

{-1} pde_pt?(pdir(pt1′))

{-2} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} not_present?(pdir(pt2′))
{5} pde_pt?(pdir(pt2′))
{6} page_table_base(pde_pt(pdir(pt1′))) = page_base(pde_4m(pdir(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.13.

set_reference_base.14:

{-1} not_present?(pdir(pt2′))
{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} page_base(pde_4m(pdir(pt1′))) = page_base(pde_4m(pdir(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.14.

set_reference_base.15:

{-1} pde_pt?(pdir(pt2′))

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} page_base(pde_4m(pdir(pt1′))) = page_table_base(pde_pt(pdir(pt2′)))

Applying decompose-equality, This completes the proof of set_reference_base.15.

set_reference_base.16:

{-1} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} not_present?(pdir(pt2′))
{7} pde_pt?(pdir(pt2′))
{8} page_base(pde_4m(pdir(pt1′))) = page_base(pde_4m(pdir(pt2′)))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality, This completes the proof of set_reference_base.16. Q.E.D.

C.159.11 Paging_type_helpers.set_reference_accessible

Terse proof for set_reference_accessible.
set_reference_accessible:

{1} ∀ (pt1, pt2: Paging_type, access, ac1: Memory_access):

set_reference(pt1, access) = set_reference(pt2, access) ∧ present?(pt1) ⊃ accessible?(pt1, ac1) = accessible?(pt2, ac1)

Trying repeated skolemization, instantiation, and if-lifting, we get 32 subgoals:

set_reference_accessible.1:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)
{-4} not_present?(ptab(pt2′))
{-5} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) = Ptab(Not_present)
{-6} access(pte(ptab(pt1′)))(ac1′)
{1} not_present?(ptab(pt1′))
{2} access(pte(ptab(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.1.
set_reference_accessible.2:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)

{-4} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [dirty := true, accessed := true]))

{-5} access(pte(ptab(pt1′)))(ac1′)
{1} not_present?(ptab(pt1′))
{2} not_present?(ptab(pt2′))
{3} access(pte(ptab(pt2′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.2.
set_reference_accessible.3:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)
{-4} not_present?(ptab(pt2′))
{-5} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) = Ptab(Not_present)
{-6} access(pte(ptab(pt2′)))(ac1′)
{1} not_present?(ptab(pt1′))
{2} access(pte(ptab(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.3.
set_reference_accessible.4:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)

{-4} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [dirty := true, accessed := true]))

{-5} access(pte(ptab(pt2′)))(ac1′)
{1} not_present?(ptab(pt1′))
{2} not_present?(ptab(pt2′))
{3} access(pte(ptab(pt1′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.4.

set_reference_accessible.5:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} not_present?(pdir(pt2′))
{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-5} access(pde_4m(pdir(pt2′)))(ac1′)
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} access(pde_pt(pdir(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.5.
set_reference_accessible.6:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} pde_pt?(pdir(pt2′))

{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-5} access(pde_pt(pdir(pt2′)))(ac1′)
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} access(pde_pt(pdir(pt1′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.6.
set_reference_accessible.7:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{-4} access(pde_4m(pdir(pt2′)))(ac1′)
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} not_present?(pdir(pt2′))
{4} pde_pt?(pdir(pt2′))
{5} access(pde_pt(pdir(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.7.
set_reference_accessible.8:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} not_present?(pdir(pt2′))
{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-5} access(pde_pt(pdir(pt1′)))(ac1′)
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} access(pde_4m(pdir(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.8.
set_reference_accessible.9:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} pde_pt?(pdir(pt2′))

{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-5} access(pde_pt(pdir(pt1′)))(ac1′)
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} access(pde_pt(pdir(pt2′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.9.
set_reference_accessible.10:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{-4} access(pde_pt(pdir(pt1′)))(ac1′)
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} not_present?(pdir(pt2′))
{4} pde_pt?(pdir(pt2′))
{5} access(pde_4m(pdir(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.10.
set_reference_accessible.11:

{-1} Write?(access′)
{-2} not_present?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Not_present)

{-4} access(pde_4m(pdir(pt2′)))(ac1′)
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} access(pde_4m(pdir(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.11.

set_reference_accessible.12:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} access(pde_pt(pdir(pt2′)))(ac1′)
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} access(pde_4m(pdir(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.12.
set_reference_accessible.13:

{-1} Write?(access′)

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{-3} access(pde_4m(pdir(pt2′)))(ac1′)
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} not_present?(pdir(pt2′))
{6} pde_pt?(pdir(pt2′))
{7} access(pde_4m(pdir(pt1′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.13.
set_reference_accessible.14:

{-1} Write?(access′)
{-2} not_present?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Not_present)

{-4} access(pde_4m(pdir(pt1′)))(ac1′)
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} access(pde_4m(pdir(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.14.

set_reference_accessible.15:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} access(pde_4m(pdir(pt1′)))(ac1′)
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} access(pde_pt(pdir(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.15.
set_reference_accessible.16:

{-1} Write?(access′)

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{-3} access(pde_4m(pdir(pt1′)))(ac1′)
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} not_present?(pdir(pt2′))
{6} pde_pt?(pdir(pt2′))
{7} access(pde_4m(pdir(pt2′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.16.
set_reference_accessible.17:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)
{-3} not_present?(ptab(pt2′))
{-4} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) = Ptab(Not_present)
{-5} access(pte(ptab(pt1′)))(ac1′)
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} access(pte(ptab(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.17.

set_reference_accessible.18:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)

{-3} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [accessed := true]))

{-4} access(pte(ptab(pt1′)))(ac1′)
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} not_present?(ptab(pt2′))
{4} access(pte(ptab(pt2′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.18.
set_reference_accessible.19:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)
{-3} not_present?(ptab(pt2′))
{-4} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) = Ptab(Not_present)
{-5} access(pte(ptab(pt2′)))(ac1′)
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} access(pte(ptab(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.19.
set_reference_accessible.20:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)

{-3} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [accessed := true]))

{-4} access(pte(ptab(pt2′)))(ac1′)
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} not_present?(ptab(pt2′))
{4} access(pte(ptab(pt1′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.20.
set_reference_accessible.21:

{-1} pde_pt?(pdir(pt1′))
{-2} not_present?(pdir(pt2′))
{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-4} access(pde_4m(pdir(pt2′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} access(pde_pt(pdir(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.21.
set_reference_accessible.22:

{-1} pde_pt?(pdir(pt1′))
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} access(pde_pt(pdir(pt2′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} access(pde_pt(pdir(pt1′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.22.
set_reference_accessible.23:

{-1} pde_pt?(pdir(pt1′))

{-2} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{-3} access(pde_4m(pdir(pt2′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} not_present?(pdir(pt2′))
{5} pde_pt?(pdir(pt2′))
{6} access(pde_pt(pdir(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.23.
set_reference_accessible.24:

{-1} pde_pt?(pdir(pt1′))
{-2} not_present?(pdir(pt2′))
{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-4} access(pde_pt(pdir(pt1′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} access(pde_4m(pdir(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.24.

set_reference_accessible.25:

{-1} pde_pt?(pdir(pt1′))
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} access(pde_pt(pdir(pt1′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} access(pde_pt(pdir(pt2′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.25.
set_reference_accessible.26:

{-1} pde_pt?(pdir(pt1′))

{-2} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{-3} access(pde_pt(pdir(pt1′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} not_present?(pdir(pt2′))
{5} pde_pt?(pdir(pt2′))
{6} access(pde_4m(pdir(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.26.
set_reference_accessible.27:

{-1} not_present?(pdir(pt2′))
{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-3} access(pde_4m(pdir(pt2′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} access(pde_4m(pdir(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.27.

set_reference_accessible.28:

{-1} pde_pt?(pdir(pt2′))

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-3} access(pde_pt(pdir(pt2′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} access(pde_4m(pdir(pt1′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.28.
set_reference_accessible.29:

{-1} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{-2} access(pde_4m(pdir(pt2′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} not_present?(pdir(pt2′))
{7} pde_pt?(pdir(pt2′))
{8} access(pde_4m(pdir(pt1′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.29.
set_reference_accessible.30:

{-1} not_present?(pdir(pt2′))
{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-3} access(pde_4m(pdir(pt1′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} access(pde_4m(pdir(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.30.

set_reference_accessible.31:

{-1} pde_pt?(pdir(pt2′))

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-3} access(pde_4m(pdir(pt1′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} access(pde_pt(pdir(pt2′)))(ac1′)

Applying decompose-equality,

This completes the proof of set_reference_accessible.31.
set_reference_accessible.32:

{-1} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{-2} access(pde_4m(pdir(pt1′)))(ac1′)
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} not_present?(pdir(pt2′))
{7} pde_pt?(pdir(pt2′))
{8} access(pde_4m(pdir(pt2′)))(ac1′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_accessible.32.

Q.E.D.

C.159.12 Paging_type_helpers.set_reference_privileged

Terse proof for set_reference_privileged.
set_reference_privileged:

{1} ∀ (pt1, pt2: Paging_type, access: Memory_access, priv: Memory_privilege): set_reference(pt1, access) = set_reference(pt2, access) ∧ present?(pt1) ⊃ privileged?(pt1, priv) = privileged?(pt2, priv)

Trying repeated skolemization, instantiation, and if-lifting, we get 32 subgoals:

set_reference_privileged.1:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)
{-4} not_present?(ptab(pt2′))
{-5} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) = Ptab(Not_present)
{-6} User?(privilege(pte(ptab(pt1′))))
{1} not_present?(ptab(pt1′))
{2} Supervisor?(priv′)
{3} User?(privilege(pte(ptab(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.1.
set_reference_privileged.2:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)

{-4} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [dirty := true, accessed := true]))

{-5} User?(privilege(pte(ptab(pt1′))))
{1} not_present?(ptab(pt1′))
{2} not_present?(ptab(pt2′))
{3} Supervisor?(priv′)
{4} User?(privilege(pte(ptab(pt2′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.2.
set_reference_privileged.3:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)
{-4} not_present?(ptab(pt2′))
{-5} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) = Ptab(Not_present)
{-6} User?(privilege(pte(ptab(pt2′))))
{1} not_present?(ptab(pt1′))
{2} User?(privilege(pte(ptab(pt1′))))
{3} Supervisor?(priv′)

Applying decompose-equality,

This completes the proof of set_reference_privileged.3.

set_reference_privileged.4:

{-1} Write?(access′)
{-2} ptab?(pt1′)
{-3} ptab?(pt2′)

{-4} Ptab(Pte(pte(ptab(pt1′)) with [dirty := true, accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [dirty := true, accessed := true]))

{-5} User?(privilege(pte(ptab(pt2′))))
{1} not_present?(ptab(pt1′))
{2} not_present?(ptab(pt2′))
{3} User?(privilege(pte(ptab(pt1′))))
{4} Supervisor?(priv′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.4.
set_reference_privileged.5:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} not_present?(pdir(pt2′))
{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-5} User?(privilege(pde_4m(pdir(pt2′))))
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} Supervisor?(priv′)
{4} User?(privilege(pde_pt(pdir(pt1′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.5.
set_reference_privileged.6:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} pde_pt?(pdir(pt2′))

{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-5} User?(privilege(pde_pt(pdir(pt2′))))
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} Supervisor?(priv′)
{4} User?(privilege(pde_pt(pdir(pt1′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.6.

set_reference_privileged.7:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{-4} User?(privilege(pde_4m(pdir(pt2′))))
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} not_present?(pdir(pt2′))
{4} pde_pt?(pdir(pt2′))
{5} Supervisor?(priv′)
{6} User?(privilege(pde_pt(pdir(pt1′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.7.
set_reference_privileged.8:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} not_present?(pdir(pt2′))
{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-5} User?(privilege(pde_pt(pdir(pt1′))))
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} Supervisor?(priv′)
{4} User?(privilege(pde_4m(pdir(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.8.
set_reference_privileged.9:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))
{-3} pde_pt?(pdir(pt2′))

{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-5} User?(privilege(pde_pt(pdir(pt1′))))
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} Supervisor?(priv′)
{4} User?(privilege(pde_pt(pdir(pt2′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.9.

set_reference_privileged.10:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt1′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{-4} User?(privilege(pde_pt(pdir(pt1′))))
{1} ptab?(pt1′)
{2} ptab?(pt2′)
{3} not_present?(pdir(pt2′))
{4} pde_pt?(pdir(pt2′))
{5} Supervisor?(priv′)
{6} User?(privilege(pde_4m(pdir(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.10.
set_reference_privileged.11:

{-1} Write?(access′)
{-2} not_present?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Not_present)

{-4} User?(privilege(pde_4m(pdir(pt2′))))
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} Supervisor?(priv′)
{6} User?(privilege(pde_4m(pdir(pt1′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.11.
set_reference_privileged.12:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} User?(privilege(pde_pt(pdir(pt2′))))
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} Supervisor?(priv′)
{6} User?(privilege(pde_4m(pdir(pt1′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.12.

set_reference_privileged.13:

{-1} Write?(access′)

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{-3} User?(privilege(pde_4m(pdir(pt2′))))
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} not_present?(pdir(pt2′))
{6} pde_pt?(pdir(pt2′))
{7} Supervisor?(priv′)
{8} User?(privilege(pde_4m(pdir(pt1′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.13.
set_reference_privileged.14:

{-1} Write?(access′)
{-2} not_present?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Not_present)

{-4} User?(privilege(pde_4m(pdir(pt1′))))
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} Supervisor?(priv′)
{6} User?(privilege(pde_4m(pdir(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.14.
set_reference_privileged.15:

{-1} Write?(access′)
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} User?(privilege(pde_4m(pdir(pt1′))))
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} Supervisor?(priv′)
{6} User?(privilege(pde_pt(pdir(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.15.

set_reference_privileged.16:

{-1} Write?(access′)

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{-3} User?(privilege(pde_4m(pdir(pt1′))))
{1} ptab?(pt1′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))
{4} ptab?(pt2′)
{5} not_present?(pdir(pt2′))
{6} pde_pt?(pdir(pt2′))
{7} Supervisor?(priv′)
{8} User?(privilege(pde_4m(pdir(pt2′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.16.
set_reference_privileged.17:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)
{-3} not_present?(ptab(pt2′))
{-4} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) = Ptab(Not_present)
{-5} User?(privilege(pte(ptab(pt1′))))
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} Supervisor?(priv′)
{4} User?(privilege(pte(ptab(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.17.
set_reference_privileged.18:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)

{-3} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [accessed := true]))

{-4} User?(privilege(pte(ptab(pt1′))))
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} not_present?(ptab(pt2′))
{4} Supervisor?(priv′)
{5} User?(privilege(pte(ptab(pt2′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.18.

set_reference_privileged.19:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)
{-3} not_present?(ptab(pt2′))
{-4} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) = Ptab(Not_present)
{-5} User?(privilege(pte(ptab(pt2′))))
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} User?(privilege(pte(ptab(pt1′))))
{4} Supervisor?(priv′)

Applying decompose-equality,

This completes the proof of set_reference_privileged.19.
set_reference_privileged.20:

{-1} ptab?(pt1′)
{-2} ptab?(pt2′)

{-3} Ptab(Pte(pte(ptab(pt1′)) with [accessed := true])) =

Ptab(Pte(pte(ptab(pt2′)) with [accessed := true]))

{-4} User?(privilege(pte(ptab(pt2′))))
{1} Write?(access′)
{2} not_present?(ptab(pt1′))
{3} not_present?(ptab(pt2′))
{4} User?(privilege(pte(ptab(pt1′))))
{5} Supervisor?(priv′)

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.20.
set_reference_privileged.21:

{-1} pde_pt?(pdir(pt1′))
{-2} not_present?(pdir(pt2′))
{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-4} User?(privilege(pde_4m(pdir(pt2′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} Supervisor?(priv′)
{5} User?(privilege(pde_pt(pdir(pt1′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.21.

set_reference_privileged.22:

{-1} pde_pt?(pdir(pt1′))
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} User?(privilege(pde_pt(pdir(pt2′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} Supervisor?(priv′)
{5} User?(privilege(pde_pt(pdir(pt1′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.22.
set_reference_privileged.23:

{-1} pde_pt?(pdir(pt1′))

{-2} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{-3} User?(privilege(pde_4m(pdir(pt2′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} not_present?(pdir(pt2′))
{5} pde_pt?(pdir(pt2′))
{6} Supervisor?(priv′)
{7} User?(privilege(pde_pt(pdir(pt1′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.23.
set_reference_privileged.24:

{-1} pde_pt?(pdir(pt1′))
{-2} not_present?(pdir(pt2′))
{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-4} User?(privilege(pde_pt(pdir(pt1′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} Supervisor?(priv′)
{5} User?(privilege(pde_4m(pdir(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.24.

set_reference_privileged.25:

{-1} pde_pt?(pdir(pt1′))
{-2} pde_pt?(pdir(pt2′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} User?(privilege(pde_pt(pdir(pt1′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} Supervisor?(priv′)
{5} User?(privilege(pde_pt(pdir(pt2′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.25.
set_reference_privileged.26:

{-1} pde_pt?(pdir(pt1′))

{-2} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{-3} User?(privilege(pde_pt(pdir(pt1′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} ptab?(pt2′)
{4} not_present?(pdir(pt2′))
{5} pde_pt?(pdir(pt2′))
{6} Supervisor?(priv′)
{7} User?(privilege(pde_4m(pdir(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.26.
set_reference_privileged.27:

{-1} not_present?(pdir(pt2′))
{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-3} User?(privilege(pde_4m(pdir(pt2′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} Supervisor?(priv′)
{7} User?(privilege(pde_4m(pdir(pt1′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.27.

set_reference_privileged.28:

{-1} pde_pt?(pdir(pt2′))

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-3} User?(privilege(pde_pt(pdir(pt2′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} Supervisor?(priv′)
{7} User?(privilege(pde_4m(pdir(pt1′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.28.
set_reference_privileged.29:

{-1} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{-2} User?(privilege(pde_4m(pdir(pt2′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} not_present?(pdir(pt2′))
{7} pde_pt?(pdir(pt2′))
{8} Supervisor?(priv′)
{9} User?(privilege(pde_4m(pdir(pt1′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.29.
set_reference_privileged.30:

{-1} not_present?(pdir(pt2′))
{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{-3} User?(privilege(pde_4m(pdir(pt1′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} Supervisor?(priv′)
{7} User?(privilege(pde_4m(pdir(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.30.

set_reference_privileged.31:

{-1} pde_pt?(pdir(pt2′))

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-3} User?(privilege(pde_4m(pdir(pt1′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} Supervisor?(priv′)
{7} User?(privilege(pde_pt(pdir(pt2′))))

Applying decompose-equality,

This completes the proof of set_reference_privileged.31.
set_reference_privileged.32:

{-1} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{-2} User?(privilege(pde_4m(pdir(pt1′))))
{1} Write?(access′)
{2} ptab?(pt1′)
{3} not_present?(pdir(pt1′))
{4} pde_pt?(pdir(pt1′))
{5} ptab?(pt2′)
{6} not_present?(pdir(pt2′))
{7} pde_pt?(pdir(pt2′))
{8} Supervisor?(priv′)
{9} User?(privilege(pde_4m(pdir(pt2′))))

Applying decompose-equality, Applying decompose-equality, Applying decompose-equality,

This completes the proof of set_reference_privileged.32.

Q.E.D.

C.159.13 Paging_type_helpers.set_reference_leaf

Terse proof for set_reference_leaf.
set_reference_leaf:

{1} ∀ (pt1, pt2: Paging_type, access: Memory_access):

set_reference(pt1, access) = set_reference(pt2, access) ∧ present?(pt1) ⊃ is_leaf?(pt1) = is_leaf?(pt2)

Trying repeated skolemization, instantiation, and if-lifting, we get 6 subgoals:

set_reference_leaf.1:

{-1} Write?(access′)
{-2} pdir?(pt1′)
{-3} pde_pt?(pdir(pt1′))
{-4} not_present?(pdir(pt2′))
{-5} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{1} ptab?(pt2′)

Applying decompose-equality, This completes the proof of set_reference_leaf.1.

set_reference_leaf.2:

{-1} Write?(access′)
{-2} pdir?(pt1′)
{-3} pde_pt?(pdir(pt1′))

{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [dirty := true, accessed := true]))

{1} ptab?(pt2′)
{2} not_present?(pdir(pt2′))
{3} pde_pt?(pdir(pt2′))

Applying decompose-equality, This completes the proof of set_reference_leaf.2.

set_reference_leaf.3:

{-1} Write?(access′)
{-2} pdir?(pt1′)

{-3} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [dirty := true, accessed := true])) =

Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-4} pdir?(pt2′)
{-5} pde_pt?(pdir(pt2′))
{1} not_present?(pdir(pt1′))
{2} pde_pt?(pdir(pt1′))

Applying decompose-equality, This completes the proof of set_reference_leaf.3.

set_reference_leaf.4:

{-1} pdir?(pt1′)
{-2} pde_pt?(pdir(pt1′))
{-3} not_present?(pdir(pt2′))
{-4} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) = Pdir(Not_present)
{1} Write?(access′)
{2} ptab?(pt2′)

Applying decompose-equality, This completes the proof of set_reference_leaf.4.

set_reference_leaf.5:

{-1} pdir?(pt1′)
{-2} pde_pt?(pdir(pt1′))

{-3} Pdir(Pde_pt(pde_pt(pdir(pt1′)) with [accessed := true])) =

Pdir(Pde_4m(pde_4m(pdir(pt2′)) with [accessed := true]))

{1} Write?(access′)
{2} ptab?(pt2′)
{3} not_present?(pdir(pt2′))
{4} pde_pt?(pdir(pt2′))

Applying decompose-equality, This completes the proof of set_reference_leaf.5.

set_reference_leaf.6:

{-1} pdir?(pt1′)

{-2} Pdir(Pde_4m(pde_4m(pdir(pt1′)) with [accessed := true])) = Pdir(Pde_pt(pde_pt(pdir(pt2′)) with [accessed := true]))

{-3} pdir?(pt2′)
{-4} pde_pt?(pdir(pt2′))
{1} Write?(access′)
{2} not_present?(pdir(pt1′))
{3} pde_pt?(pdir(pt1′))

Applying decompose-equality, This completes the proof of set_reference_leaf.6. Q.E.D.

C.160 Proofs for Pde_type (paging-data.pvs)

This theory contains no provable formal statements.

C.161 Proofs for Pde_type_adt (Pde_type_adt.pvs)

C.161.1 Pde_type_adt.Pde_4m_TCC1

Terse proof for Pde_4m_TCC1.

Pde_4m_TCC1:

{1} ∀ (a: Memory_Address_4G): offset(a) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Pde_4m_TCC1. Q.E.D.

C.162 Proofs for Pde_type_adt_reduce (Pde_type_adt.pvs)

This theory contains no provable formal statements.

C.163 Proofs for Phy_Mem_Blessing (challenge-phymem.pvs)

C.163 Proofs for Phy_Mem_Blessing (challenge-phymem.pvs)

C.163.1 Phy_Mem_Blessing.phy_mem_plain_memory

Terse proof for phy_mem_plain_memory.
phy_mem_plain_memory:

{1} ∀ (oact: PRED[[Physical_memory → SuperResult[Physical_memory]]]):

unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact, in_memory(min, max)) ⊃ plain_memory?(phy_pm(oact))

Repeatedly Skolemizing and flattening, Expanding the definition of plain_memory?, Expanding the definition of phy_pm, Rewriting using union_empty_left, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 7 subgoals:

phy_mem_plain_memory.1:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))

{1} side_effect_content_unchanged(in_memory(min, max), fullset[Physical_memory], memory_write_side_effect(phy_mem))

Hiding formulas: (-1), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of phy_mem_plain_memory.1.

phy_mem_plain_memory.2:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))

{1} side_effect_content_unchanged(in_memory(min, max), fullset[Physical_memory], memory_read_side_effect(phy_mem))

Hiding formulas: (-1), Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of phy_mem_plain_memory.2.

phy_mem_plain_memory.3:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))

{1} transformers_ok?(fullset[Physical_memory], ((memory_read_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_transformers (phy_mem, in_memory(min, max))) ∪ (memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)))))

Hiding formulas: -1, Using lemma phy_mem_read_transformers_ok, Using lemma phy_mem_write_transformers_ok, Using lemma phy_mem_read_side_effects_transformers_ok, Using lemma phy_mem_write_side_effects_transformers_ok, Rewriting using transformers_ok_union_transformers, matching in *, we get 2 subgoals:

phy_mem_plain_memory.3.1:

{-1} transformers_ok?(fullset[Physical_memory[min, max]],

memory_write_side_effect_super_transformers(phy_mem, in_memory(min, max)))

{-2} transformers_ok?(fullset[Physical_memory[min, max]],

memory_read_side_effect_super_transformers(phy_mem, in_memory(min, max)))

{-3} transformers_ok?(fullset[Physical_memory[min, max]],

memory_write_transformers(phy_mem, in_memory(min, max)))

{-4} transformers_ok?(fullset[Physical_memory[min, max]],

memory_read_transformers(phy_mem, in_memory(min, max)))

{1} transformers_ok?(fullset[Physical_memory],

(memory_read_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_transformers (phy_mem, in_memory(min, max))))

{2} transformers_ok?(fullset[Physical_memory], ((memory_read_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_transformers (phy_mem, in_memory(min, max))) ∪ (memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)))))

Rewriting using transformers_ok_union_transformers, matching in *,

This completes the proof of phy_mem_plain_memory.3.1.
phy_mem_plain_memory.3.2:

{-1} transformers_ok?(fullset[Physical_memory[min, max]],

memory_write_side_effect_super_transformers(phy_mem, in_memory(min, max)))

{-2} transformers_ok?(fullset[Physical_memory[min, max]],

memory_read_side_effect_super_transformers(phy_mem, in_memory(min, max)))

{-3} transformers_ok?(fullset[Physical_memory[min, max]],

memory_write_transformers(phy_mem, in_memory(min, max)))

{-4} transformers_ok?(fullset[Physical_memory[min, max]],

memory_read_transformers(phy_mem, in_memory(min, max)))

{1} transformers_ok?(fullset[Physical_memory],

(memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max))))

{2} transformers_ok?(fullset[Physical_memory], ((memory_read_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_transformers (phy_mem, in_memory(min, max))) ∪ (memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)))))

Rewriting using transformers_ok_union_transformers, matching in *,

This completes the proof of phy_mem_plain_memory.3.2.
phy_mem_plain_memory.4:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))
{1} changed_memory_invariant?(phy_mem, fullset[Physical_memory], in_memory(min, max))

Rewriting using phy_mem_changed_memory_invariant, matching in *, This completes the proof of phy_mem_plain_memory.4.

phy_mem_plain_memory.5:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))
{1} unchanged_memory_write_invariant?(phy_mem, fullset[Physical_memory], in_memory(min, max))

Rewriting using phy_mem_unchanged_memory_write_invariant, matching in *, This completes the proof of phy_mem_plain_memory.5.

phy_mem_plain_memory.6:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))

{1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], memory_write_transformers(phy_mem, in_memory(min, max)), emptyset[Address])

Hiding formulas: -1, Expanding the definition of unchanged_memory_invariant?,

C.163 Proofs for Phy_Mem_Blessing (challenge-phymem.pvs)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

phy_mem_plain_memory.6.1:

{1} ∀ (s: Physical_memory[min, max], q: [Physical_memory[min, max] → SuperResult[Physical_memory[min, max]]], a: Address): fullset[Physical_memory](s) ∧ memory_write_transformers(phy_mem, in_memory(min, max))(q) ∧ emptyset[Address](a) ∧ OK?(q(s)) ∧ OK?(memory_read(phy_mem)(a)(s)) ∧ OK?(memory_read(phy_mem)(a)(state(q(s)))) ⊃ data(memory_read(phy_mem)(a)(state(q(s)))) = data(memory_read(phy_mem)(a)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of emptyset, which is trivially true.

This completes the proof of phy_mem_plain_memory.6.1.
phy_mem_plain_memory.6.2:

{1} transformer_invariant?(fullset[Physical_memory],

memory_write_transformers(phy_mem, in_memory(min, max)))

Rewriting using transformer_invariant_truth, matching in *,

This completes the proof of phy_mem_plain_memory.6.2.
phy_mem_plain_memory.7:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))

{1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], ((oact′ ∪ memory_read_transformers (phy_mem, in_memory(min, max))) ∪ (memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)))), in_memory(min, max))

Using lemma phy_mem_unchanged_memory_invariant_read_transformers, Using lemma phy_mem_unchanged_memory_invariant_read_side_effect_transformers, Using lemma phy_mem_unchanged_memory_invariant_write_side_effect_transformers, Rewriting using unchanged_memory_invariant_union_transformers, matching in *, we get 2 subgoals:

phy_mem_plain_memory.7.1:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory[min, max]],

memory_write_side_effect_super_transformers(phy_mem,

in_memory(min, max)),

in_memory(min, max))

{-2} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory[min, max]],

memory_read_side_effect_super_transformers(phy_mem,

in_memory(min, max)),

in_memory(min, max))

{-3} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory[min, max]], memory_read_transformers(phy_mem, in_memory(min, max)), in_memory(min, max))

{-4} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))

{1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], (oact′ ∪ memory_read_transformers (phy_mem, in_memory(min, max))), in_memory(min, max))

{2} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], ((oact′ ∪ memory_read_transformers (phy_mem, in_memory(min, max))) ∪ (memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)))), in_memory(min, max))

Rewriting using unchanged_memory_invariant_union_transformers, matching in *,

This completes the proof of phy_mem_plain_memory.7.1.
phy_mem_plain_memory.7.2:

{-1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory[min, max]],

memory_write_side_effect_super_transformers(phy_mem,

in_memory(min, max)),

in_memory(min, max))

{-2} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory[min, max]],

memory_read_side_effect_super_transformers(phy_mem,

in_memory(min, max)),

in_memory(min, max))

{-3} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory[min, max]], memory_read_transformers(phy_mem, in_memory(min, max)), in_memory(min, max))

{-4} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], oact′, in_memory(min, max))

{1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], (memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max))), in_memory(min, max))

{2} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], ((oact′ ∪ memory_read_transformers (phy_mem, in_memory(min, max))) ∪ (memory_read_side_effect_super_transformers (phy_mem, in_memory(min, max)) ∪ memory_write_side_effect_super_transformers (phy_mem, in_memory(min, max)))), in_memory(min, max))

Rewriting using unchanged_memory_invariant_union_transformers, matching in *,

This completes the proof of phy_mem_plain_memory.7.2.

Q.E.D.

C.164 Proofs for Phy_Mem_Blessing_Data (challenge-phymem.pvs)

C.164 Proofs for Phy_Mem_Blessing_Data (challenge-phymem.pvs)

C.164.1 Phy_Mem_Blessing_Data.in_memory_blessed_memory

Terse proof for in_memory_blessed_memory.
in_memory_blessed_memory:

{1} ∀ (addr: Address, idt: (interpreted_data_type?[Data])):

in_memory?(idt, addr, min, max) ⊃ in_blessed_memory?(idt, addr, in_memory(min, max))

Installing automatic rewrites from: in_memory? in_blessed_memory? subset? member address_block in_memory + < ≤

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of in_memory_blessed_memory.

Q.E.D.

C.165 Proofs for Phy_Mem_Challenge_Read_Other (challenge-phymem.pvs)

C.165.1 Phy_Mem_Challenge_Read_Other.read_write_other_ok

Terse proof for read_write_other_ok.
read_write_other_ok:

{1} ∀ (addr1, addr2: Address, data1: Data1, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), s: Physical_memory[min, max]): in_memory?(dt1, addr1, min, max) ∧ in_memory?(dt2, addr2, min, max) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ valid_in_mem(phy_mem, dt2)(addr2)(s)

⊃

OK?((write_data(phy_mem, dt1)(addr1, data1) ## read_data(phy_mem, dt2)(addr2))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: unchanged_memory_invariant_empty emptyset_is_empty? Using lemma phy_mem_plain_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_write_other_ok[Physical_memory, Data1, Data2], Installing automatic rewrites from: fullset! union_empty_left phy_pm read_data write_data

valid_in_mem Simplifying, rewriting, and recording with decision procedures, Keeping (-4 -5 1) and hiding *, Using lemma in_memory_blessed_memory[Data1, min, max], Using lemma in_memory_blessed_memory[Data2, min, max], Simplifying, rewriting, and recording with decision procedures, This completes the proof of read_write_other_ok.

Q.E.D.

C.165.2 Phy_Mem_Challenge_Read_Other.read_write_other_res_TCC1

Terse proof for read_write_other_res_TCC1.
read_write_other_res_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), s: Physical_memory[min, max]): valid_in_mem(phy_mem, dt2)(addr2)(s) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_memory?(dt2, addr2, min, max) ∧ in_memory?(dt1, addr1, min, max) ⊃ OK?[Physical_memory[min, max], Data2]

((##[Physical_memory[min, max], Unit, Data2]

(write_data[Physical_memory[min, max], Data1]

(phy_mem[min, max], dt1)(addr1, data1), read_data[Physical_memory[min, max], Data2] (phy_mem[min, max], dt2)(addr2)))

(s))

Repeatedly Skolemizing and flattening, Rewriting using read_write_other_ok, matching in *,

This completes the proof of read_write_other_res_TCC1.

Q.E.D.

C.165.3 Phy_Mem_Challenge_Read_Other.read_write_other_res_TCC2

Terse proof for read_write_other_res_TCC2.
read_write_other_res_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), s: Physical_memory[min, max]): valid_in_mem(phy_mem, dt2)(addr2)(s) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_memory?(dt2, addr2, min, max) ∧ in_memory?(dt1, addr1, min, max) ⊃ OK?[Physical_memory[min, max], Data2]

(read_data[Physical_memory[min, max], Data2] (phy_mem[min, max], dt2)(addr2)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: unchanged_memory_invariant_empty emptyset_is_empty?

union_empty_left phy_pm fullset in_memory_blessed_memory Using lemma phy_mem_plain_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_data_ok[Physical_memory, Data2], Installing automatic rewrites from: (read_data! write_data! valid_in_mem!)

C.165 Proofs for Phy_Mem_Challenge_Read_Other (challenge-phymem.pvs)

Simplifying, rewriting, and recording with decision procedures, Rewriting using in_memory_blessed_memory[Data2, min, max], matching in *,

This completes the proof of read_write_other_res_TCC2.

Q.E.D.

C.165.4 Phy_Mem_Challenge_Read_Other.read_write_other_res

Terse proof for read_write_other_res.
read_write_other_res:

{1} ∀ (addr1, addr2: Address, data1: Data1, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), s: Physical_memory[min, max]): in_memory?(dt1, addr1, min, max) ∧ in_memory?(dt2, addr2, min, max) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ valid_in_mem(phy_mem, dt2)(addr2)(s)

⊃

data((write_data(phy_mem, dt1)(addr1, data1) ## read_data(phy_mem, dt2)(addr2))

(s))

= data(read_data(phy_mem, dt2)(addr2)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: unchanged_memory_invariant_empty emptyset_is_empty?

union_empty_left fullset phy_pm Using lemma phy_mem_plain_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_write_other_res[Physical_memory, Data1, Data2], Installing automatic rewrites from: (read_data! write_data! valid_in_mem!) Simplifying, rewriting, and recording with decision procedures, Rewriting using in_memory_blessed_memory[Data2, min, max], matching in *, Rewriting using in_memory_blessed_memory[Data1, min, max], matching in *, This completes the proof of read_write_other_res. Q.E.D.

C.165.5 Phy_Mem_Challenge_Read_Other.read_read_ok

Terse proof for read_read_ok.

read_read_ok:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), s: Physical_memory[min, max]): in_memory?(dt1, addr1, min, max) ∧ in_memory?(dt2, addr2, min, max) ∧ valid_in_mem(phy_mem, dt1)(addr1)(s) ∧ valid_in_mem(phy_mem, dt2)(addr2)(s) ⊃ OK?((read_data(phy_mem, dt1)(addr1) ## read_data(phy_mem, dt2)(addr2))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: unchanged_memory_invariant_empty emptyset_is_empty?

union_empty_left fullset phy_pm Using lemma phy_mem_plain_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_read_ok[Physical_memory, Data1, Data2], Simplifying, rewriting, and recording with decision procedures, Using lemma in_memory_blessed_memory[Data2, min, max], Using lemma in_memory_blessed_memory[Data1, min, max], Installing automatic rewrites from: (read_data! write_data! valid_in_mem!) Simplifying, rewriting, and recording with decision procedures, This completes the proof of read_read_ok. Q.E.D.

C.165.6 Phy_Mem_Challenge_Read_Other.read_read_TCC1

Terse proof for read_read_TCC1.
read_read_TCC1:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), s: Physical_memory[min, max]): valid_in_mem(phy_mem, dt2)(addr2)(s) ∧ valid_in_mem(phy_mem, dt1)(addr1)(s) ∧ in_memory?(dt2, addr2, min, max) ∧ in_memory?(dt1, addr1, min, max) ⊃ OK?[Physical_memory[min, max], Data2]

((##[Physical_memory[min, max], Data1, Data2]

(read_data[Physical_memory[min, max], Data1] (phy_mem[min, max], dt1)(addr1), read_data[Physical_memory[min, max], Data2] (phy_mem[min, max], dt2)(addr2)))

(s))

Repeatedly Skolemizing and flattening, Rewriting using read_read_ok, matching in *, This completes the proof of read_read_TCC1. Q.E.D.

C.165.7 Phy_Mem_Challenge_Read_Other.read_read_TCC2

Terse proof for read_read_TCC2.
read_read_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), s: Physical_memory[min, max]): valid_in_mem(phy_mem, dt2)(addr2)(s) ∧ valid_in_mem(phy_mem, dt1)(addr1)(s) ∧ in_memory?(dt2, addr2, min, max) ∧ in_memory?(dt1, addr1, min, max) ⊃ OK?[Physical_memory[min, max], Data2]

(read_data[Physical_memory[min, max], Data2] (phy_mem[min, max], dt2)(addr2)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: unchanged_memory_invariant_empty emptyset_is_empty?

union_empty_left fullset phy_pm Using lemma phy_mem_plain_memory,

C.166 Proofs for Phy_Mem_Challenge_Read_Same (challenge-phymem.pvs)

Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_data_ok[Physical_memory, Data2], Installing automatic rewrites from: (read_data! write_data! valid_in_mem!) Simplifying, rewriting, and recording with decision procedures, Rewriting using in_memory_blessed_memory[Data2, min, max], matching in *, This completes the proof of read_read_TCC2. Q.E.D.

C.165.8 Phy_Mem_Challenge_Read_Other.read_read

Terse proof for read_read.

read_read:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), s: Physical_memory[min, max]): in_memory?(dt1, addr1, min, max) ∧ in_memory?(dt2, addr2, min, max) ∧ valid_in_mem(phy_mem, dt1)(addr1)(s) ∧ valid_in_mem(phy_mem, dt2)(addr2)(s) ⊃ data((read_data(phy_mem, dt1)(addr1) ## read_data(phy_mem, dt2)(addr2))(s)) = data(read_data(phy_mem, dt2)(addr2)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: unchanged_memory_invariant_empty emptyset_is_empty?

union_empty_left fullset phy_pm Using lemma phy_mem_plain_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_read[Physical_memory, Data1, Data2], Installing automatic rewrites from: (read_data! write_data! valid_in_mem!) Simplifying, rewriting, and recording with decision procedures, Rewriting using in_memory_blessed_memory[Data1, min, max], matching in *, Rewriting using in_memory_blessed_memory[Data2, min, max], matching in *, This completes the proof of read_read. Q.E.D.

C.166 Proofs for Phy_Mem_Challenge_Read_Same (challenge-phymem.pvs)

C.166.1 Phy_Mem_Challenge_Read_Same.read_write_ok

Terse proof for read_write_ok.

read_write_ok:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]),

s: Physical_memory[min, max]): in_memory?(dt, addr, min, max) ⊃ OK?((write_data(phy_mem, dt)(addr, data) ## read_data(phy_mem, dt)(addr))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: unchanged_memory_invariant_empty emptyset_is_empty?

Using lemma phy_mem_plain_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_write_ok[Physical_memory, Data], Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -2, Expanding the definition of phy_pm, Using lemma in_memory_blessed_memory, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of fullset, Expanding the definition of write_data, Expanding the definition of read_data, which is trivially true. This completes the proof of read_write_ok. Q.E.D.

C.166.2 Phy_Mem_Challenge_Read_Same.read_write_res_TCC1

Terse proof for read_write_res_TCC1.
read_write_res_TCC1:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]),

s: Physical_memory[min, max]): in_memory?(dt, addr, min, max) ⊃ OK?[Physical_memory[min, max], Data]

((##[Physical_memory[min, max], Unit, Data]

(write_data[Physical_memory[min, max], Data]

(phy_mem[min, max], dt)(addr, data), read_data[Physical_memory[min, max], Data] (phy_mem[min, max], dt)(addr)))

(s))

Repeatedly Skolemizing and flattening, Rewriting using read_write_ok, matching in *, This completes the proof of read_write_res_TCC1. Q.E.D.

C.166.3 Phy_Mem_Challenge_Read_Same.read_write_res

Terse proof for read_write_res.
read_write_res:

{1} ∀ (addr: Address, data1: Data, dt: (interpreted_data_type?[Data]),

s: Physical_memory[min, max]): in_memory?(dt, addr, min, max) ⊃ data((write_data(phy_mem, dt)(addr, data1) ## read_data(phy_mem, dt)(addr))(s)) = data1

C.167 Proofs for Phy_Mem_Properties (challenge-phymem.pvs)

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: unchanged_memory_invariant_empty emptyset_is_empty? Using lemma phy_mem_plain_memory, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_write_res[Physical_memory, Data], Installing automatic rewrites from: phy_pm fullset in_memory_blessed_memory read_data write_data Simplifying, rewriting, and recording with decision procedures, This completes the proof of read_write_res. Q.E.D.

C.167 Proofs for Phy_Mem_Properties (challenge-phymem.pvs)

C.167.1 Phy_Mem_Properties.min_TCC1

Terse proof for min_TCC1.

min_TCC1:

{1} ∃ (x: Memory_Address): true

Instantiating the top quantifier in 1 with the terms: Mem(0), Expanding the definition of Mem, which is trivially true. This completes the proof of min_TCC1. Q.E.D.

C.167.2 Phy_Mem_Properties.phy_mem_write_transformers_ok

Terse proof for phy_mem_write_transformers_ok.
phy_mem_write_transformers_ok:

{1} transformers_ok?(fullset[Physical_memory], memory_write_transformers(phy_mem, in_memory(min, max)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_write_transformers_ok.

Q.E.D.

C.167.3 Phy_Mem_Properties.phy_mem_read_transformers_ok

Terse proof for phy_mem_read_transformers_ok.
phy_mem_read_transformers_ok:

{1} transformers_ok?(fullset[Physical_memory], memory_read_transformers(phy_mem, in_memory(min, max)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_read_transformers_ok.

Q.E.D.

C.167.4 Phy_Mem_Properties.phy_mem_read_side_effects_transformers_ok

Terse proof for phy_mem_read_side_effects_transformers_ok.

phy_mem_read_side_effects_transformers_ok:

{1} transformers_ok?(fullset[Physical_memory], memory_read_side_effect_super_transformers(phy_mem, in_memory(min, max)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_read_side_effects_transformers_ok.

Q.E.D.

C.167.5 Phy_Mem_Properties.phy_mem_write_side_effects_transformers_ok

Terse proof for phy_mem_write_side_effects_transformers_ok.
phy_mem_write_side_effects_transformers_ok:

{1} transformers_ok?(fullset[Physical_memory], memory_write_side_effect_super_transformers(phy_mem, in_memory(min, max)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_write_side_effects_transformers_ok.

Q.E.D.

C.167.6 Phy_Mem_Properties.phy_mem_unchanged_memory_invariant_read_transformers

Terse proof for phy_mem_unchanged_memory_invariant_read_transformers.
phy_mem_unchanged_memory_invariant_read_transformers:

{1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory], memory_read_transformers(phy_mem, in_memory(min, max)), in_memory(min, max))

Expanding the definition of unchanged_memory_invariant?, Applying propositional simplification, we get 2 subgoals:

phy_mem_unchanged_memory_invariant_read_transformers.1:

{1} transformer_invariant?(fullset[Physical_memory], memory_read_transformers(phy_mem, in_memory(min, max)))

Rewriting using transformer_invariant_truth, matching in *,

This completes the proof of phy_mem_unchanged_memory_invariant_read_transformers.1.

phy_mem_unchanged_memory_invariant_read_transformers.2:

{1} ∀ (s: Physical_memory[min, max], q: [Physical_memory[min, max] → SuperResult[Physical_memory[min, max]]], a: Address): fullset[Physical_memory](s) ∧ memory_read_transformers(phy_mem, in_memory(min, max))(q) ∧ in_memory(min, max)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(phy_mem)(a)(s)) ∧ OK?(memory_read(phy_mem)(a)(state(q(s)))) ⊃ data(memory_read(phy_mem)(a)(state(q(s)))) = data(memory_read(phy_mem)(a)(s))

Expanding the definition of memory_read_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -3, Keeping (-2 -4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_unchanged_memory_invariant_read_transformers.2.

Q.E.D.

C.167.7 Phy_Mem_Properties.phy_mem_unchanged_memory_invariant_read_side_effect_transformers

Terse proof for phy_mem_unchanged_memory_invariant_read_side_effect_transformers.
phy_mem_unchanged_memory_invariant_read_side_effect_transformers:

{1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory],

memory_read_side_effect_super_transformers(phy_mem,

in_memory(min, max)),

in_memory(min, max))

Expanding the definition of unchanged_memory_invariant?, Applying propositional simplification, we get 2 subgoals:

phy_mem_unchanged_memory_invariant_read_side_effect_transformers.1:

{1} transformer_invariant?(fullset[Physical_memory],

memory_read_side_effect_super_transformers(phy_mem, in_memory(min, max)))

Rewriting using transformer_invariant_truth, matching in *,

This completes the proof of phy_mem_unchanged_memory_invariant_read_side_effect_transformers.1.

phy_mem_unchanged_memory_invariant_read_side_effect_transformers.2:

{1} ∀ (s: Physical_memory[min, max], q: [Physical_memory[min, max] → SuperResult[Physical_memory[min, max]]], a: Address):

fullset[Physical_memory](s) ∧ memory_read_side_effect_super_transformers(phy_mem, in_memory(min, max))(q) ∧ in_memory(min, max)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(phy_mem)(a)(s)) ∧ OK?(memory_read(phy_mem)(a)(state(q(s))))

⊃

data(memory_read(phy_mem)(a)(state(q(s)))) =

data(memory_read(phy_mem)(a)(s))

Expanding the definition of memory_read_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -4, Keeping (-2 -3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_unchanged_memory_invariant_read_side_effect_transformers.2.

Q.E.D.

C.167.8 Phy_Mem_Properties.phy_mem_unchanged_memory_invariant_write_side_effect_transformers

Terse proof for phy_mem_unchanged_memory_invariant_write_side_effect_transformers.
phy_mem_unchanged_memory_invariant_write_side_effect_transformers:

{1} unchanged_memory_invariant?(phy_mem, fullset[Physical_memory],

memory_write_side_effect_super_transformers(phy_mem,

in_memory(min, max)),

in_memory(min, max))

Expanding the definition of unchanged_memory_invariant?, Applying propositional simplification, we get 2 subgoals:

phy_mem_unchanged_memory_invariant_write_side_effect_transformers.1:

{1} transformer_invariant?(fullset[Physical_memory],

memory_write_side_effect_super_transformers(phy_mem, in_memory(min, max)))

Rewriting using transformer_invariant_truth, matching in *,

This completes the proof of phy_mem_unchanged_memory_invariant_write_side_effect_transformers.1.

phy_mem_unchanged_memory_invariant_write_side_effect_transformers.2:

{1} ∀ (s: Physical_memory[min, max], q: [Physical_memory[min, max] → SuperResult[Physical_memory[min, max]]], a: Address):

fullset[Physical_memory](s) ∧ memory_write_side_effect_super_transformers(phy_mem, in_memory(min, max))(q) ∧ in_memory(min, max)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(phy_mem)(a)(s)) ∧ OK?(memory_read(phy_mem)(a)(state(q(s))))

⊃

data(memory_read(phy_mem)(a)(state(q(s)))) =

data(memory_read(phy_mem)(a)(s))

Expanding the definition of memory_write_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Replacing using formula -4, Keeping (-2 -3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_unchanged_memory_invariant_write_side_effect_transformers.2.

Q.E.D.

C.167.9 Phy_Mem_Properties.phy_mem_unchanged_memory_write_invariant

Terse proof for phy_mem_unchanged_memory_write_invariant.
phy_mem_unchanged_memory_write_invariant:

{1} unchanged_memory_write_invariant?(phy_mem, fullset[Physical_memory], in_memory(min, max))

Expanding the definition of unchanged_memory_write_invariant?, Expanding the definition of unchanged_memory_invariant?, Expanding the definition of singleton, Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

phy_mem_unchanged_memory_write_invariant.1:

{-1} b′ < max_byte
{-2} in_memory(min, max)(waddr′)

{1} transformer_invariant?(fullset[Physical_memory], {y | y = expr_2_super(memory_write(phy_mem)(waddr′, b′))})

Rewriting using transformer_invariant_truth, matching in *,

This completes the proof of phy_mem_unchanged_memory_write_invariant.1.

phy_mem_unchanged_memory_write_invariant.2:

{-1} b′ < max_byte
{-2} in_memory(min, max)(waddr′)

{1} ∀ (s: Physical_memory[min, max], q: [Physical_memory[min, max] → SuperResult[Physical_memory[min, max]]], a: Address):

fullset[Physical_memory](s) ∧ q = expr_2_super(memory_write(phy_mem)(waddr′, b′)) ∧ remove(waddr′, in_memory(min, max))(a) ∧ OK?(q(s)) ∧ OK?(memory_read(phy_mem)(a)(s)) ∧ OK?(memory_read(phy_mem)(a)(state(q(s))))

⊃

data(memory_read(phy_mem)(a)(state(q(s)))) =

data(memory_read(phy_mem)(a)(s))

Repeatedly Skolemizing and flattening, Replacing using formula -2, Keeping (-3 -8 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_unchanged_memory_write_invariant.2.

Q.E.D.

C.167.10 Phy_Mem_Properties.phy_mem_changed_memory_invariant

Terse proof for phy_mem_changed_memory_invariant.
phy_mem_changed_memory_invariant:

{1} changed_memory_invariant?(phy_mem, fullset[Physical_memory], in_memory(min, max))

Expanding the definition of changed_memory_invariant?, Rewriting using transformer_invariant_truth, matching in *, Rewriting using transformer_invariant_truth, matching in *, Repeatedly Skolemizing and flattening, Keeping (-3 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of phy_mem_changed_memory_invariant.

Q.E.D.

C.168 Proofs for Physical_Memory (physical_memory.pvs)

This theory contains no provable formal statements.

C.169 Proofs for Physical_Memory_Corollaries (physical_memory.pvs)

C.169 Proofs for Physical_Memory_Corollaries (physical_memory.pvs)

C.169.1 Physical_Memory_Corollaries.physical_read_ok_next_state_TCC1

Terse proof for physical_read_ok_next_state_TCC1.
physical_read_ok_next_state_TCC1:

{1} ∀ (a: Address, s: Physical_memory[min, max]): OK?(physical_read(a)(s)) ⊃ OK?[Physical_memory[min, max], Byte](physical_read[min, max](a)(s)) ∨ Exception?[Physical_memory[min, max], Byte](physical_read[min, max](a)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of physical_read_ok_next_state_TCC1.

Q.E.D.

C.169.2 Physical_Memory_Corollaries.physical_read_ok_next_state

Terse proof for physical_read_ok_next_state.
physical_read_ok_next_state:

{1} ∀ (a: Address, s: Physical_memory[min, max]):

OK?(physical_read(a)(s)) ⊃ state(physical_read(a)(s)) = s

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of physical_read_ok_next_state.

Q.E.D.

C.169.3 Physical_Memory_Corollaries.physical_write_ok_next_state_TCC1

Terse proof for physical_write_ok_next_state_TCC1.
physical_write_ok_next_state_TCC1:

{1} ∀ (a: Address, b: Byte, s: Physical_memory[min, max]): OK?(physical_write(a, b)(s)) ⊃ OK?[Physical_memory[min, max], Unit](physical_write[min, max](a, b)(s)) ∨ Exception?[Physical_memory[min, max], Unit](physical_write[min, max](a, b)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of physical_write_ok_next_state_TCC1.

Q.E.D.

C.169.4 Physical_Memory_Corollaries.physical_write_ok_next_state

Terse proof for physical_write_ok_next_state.

physical_write_ok_next_state:

{1} ∀ (a: Address, b: Byte, s: Physical_memory[min, max]): OK?(physical_write(a, b)(s)) ⊃ state(physical_write(a, b)(s)) = s with [(a) := b]

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of physical_write_ok_next_state.

Q.E.D.

C.169.5 Physical_Memory_Corollaries.physical_read_ok_get_data

Terse proof for physical_read_ok_get_data.
physical_read_ok_get_data:

{1} ∀ (a: Address, s: Physical_memory[min, max]): OK?(physical_read(a)(s)) ⊃ data(physical_read(a)(s)) = s(a)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of physical_read_ok_get_data.

Q.E.D.

C.170 Proofs for Physical_Memory_Properties (physical_memory.pvs)

C.170.1 Physical_Memory_Properties.physical_read_ok

Terse proof for physical_read_ok.
physical_read_ok:

{1} ∀ (a: Address, s: Physical_memory[min, max]): in_memory(min, max)(a) ⊃ OK?(physical_read(a)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of physical_read_ok. Q.E.D.

C.170.2 Physical_Memory_Properties.physical_write_ok

Terse proof for physical_write_ok.
physical_write_ok:

{1} ∀ (a: Address, b: Byte, s: Physical_memory[min, max]): in_memory(min, max)(a) ⊃ OK?(physical_write(a, b)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of physical_write_ok. Q.E.D.

C.171 Proofs for Plain_Mem_Properties (plain_memory.pvs)

C.171 Proofs for Plain_Mem_Properties (plain_memory.pvs)

C.171.1 Plain_Mem_Properties.plain_mem_write_list_read_list_TCC1

Terse proof for plain_mem_write_list_read_list_TCC1.
plain_mem_write_list_read_list_TCC1:

{1} ∀ (addr: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): OK?(memory_write_list(pm`mem)(addr, bl)(s)) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ∧ pm`states(s) ∧ plain_memory?(pm) ∧ size = length(bl) ⊃ OK?[State, Unit](memory_write_list[State](pm`mem)(addr, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm`mem)(addr, bl)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_read_list_TCC1.

Q.E.D.

C.171.2 Plain_Mem_Properties.plain_mem_write_list_read_list

Terse proof for plain_mem_write_list_read_list.
plain_mem_write_list_read_list:

{1} ∀ (addr: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(addr, bl)(s)) ∧ OK?(memory_read_list(pm`mem)(addr, size) (state(memory_write_list(pm`mem)(addr, bl)(s)))) ⊃ data(memory_read_list(pm`mem)(addr, size) (state(memory_write_list(pm`mem)(addr, bl)(s)))) = bl

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: subset_bigger_union_right Using lemma unchanged_memory_read_list_write_list, Replacing using formula -2, Installing automatic rewrites from: plain_memory_transformers_ok_write_block transform-

ers_ok_union_transformers plain_memory_transformers_ok_write_side_effects_block plain_memory_transformers_ok_read_block plain_memory_transformers_ok_read_side_effects_block plain_memory_side_effect_content_unchanged_read_block plain_memory_side_effect_content_unchanged_write_block plain_memory_changed_block plain_memory_unchanged_block plain_memory_unchanged_invariant

Installing automatic rewrites from: unchanged_memory_invariant_union_transformers plain_memory_unchanged_read_block plain_memory_unchanged_read_side_effect_block plain_memory_unchanged_write_side_effect_block

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_mem_write_list_read_list.

Q.E.D.

C.171.3 Plain_Mem_Properties.plain_mem_q_read_list_TCC1

Terse proof for plain_mem_q_read_list_TCC1.
plain_mem_q_read_list_TCC1:

{1} ∀ (addr: Address, pm: Plain_Memory[State], s: State, size: nat,

q: [State → SuperResult[State]]): OK?(q(s)) ∧ OK?(memory_read_list(pm`mem)(addr, size)(s)) ⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_q_read_list_TCC1.

Q.E.D.

C.171.4 Plain_Mem_Properties.plain_mem_q_read_list

Terse proof for plain_mem_q_read_list.
plain_mem_q_read_list:

{1} ∀ (addr: Address, pm: Plain_Memory[State], s: State, size: nat,

q: [State → SuperResult[State]]): OK?(memory_read_list(pm`mem)(addr, size)(s)) ∧ OK?(q(s)) ∧ OK?(memory_read_list(pm`mem)(addr, size)(state(q(s)))) ∧ plain_memory?(pm) ∧ unchanged_memory_invariant?(pm`mem, pm`states, singleton(q),

address_block(addr, size))

∧ pm`states(s) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ data(memory_read_list(pm`mem)(addr, size)(state(q(s)))) = data(memory_read_list(pm`mem)(addr, size)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: union_subset1 subset_reflexive Using lemma unchanged_memory_read_list[State], Installing automatic rewrites from: transformers_ok_union_transformers plain_memory_side_effect_content_unchanged_read_block

plain_memory_transformers_ok_read_block plain_memory_transformers_ok_read_side_effects_block unchanged_memory_invariant_union_transformers plain_memory_unchanged_read_block plain_memory_unchanged_read_side_effect_block

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of plain_mem_q_read_list. Q.E.D.

C.172 Proofs for Plain_Mem_Properties_2 (plain_memory.pvs)

C.172.1 Plain_Mem_Properties_2.plain_memory_inv_pred_write_data_TCC1

Terse proof for plain_memory_inv_pred_write_data_TCC1.

C.172 Proofs for Plain_Mem_Properties_2 (plain_memory.pvs)

plain_memory_inv_pred_write_data_TCC1:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): OK?(write_data(pm, dt)(addr, data)(s)) ∧ (address_block(addr, size(uidt(dt))) ⊆ pm‘rw_addr) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ OK?[State, Unit](write_data[State, Data](pm, dt)(addr, data)(s)) ∨ Exception?[State, Unit](write_data[State, Data](pm, dt)(addr, data)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_inv_pred_write_data_TCC1.

Q.E.D.

C.172.2 Plain_Mem_Properties_2.plain_memory_inv_pred_write_data

The L^{A}TEX code for this proof is broken.

C.172.3 Plain_Mem_Properties_2.plain_memory_read_data_ok

Terse proof for plain_memory_read_data_ok.
plain_memory_read_data_ok:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ valid_in_mem(pm, dt)(addr)(s) ⊃ OK?(read_data(pm, dt)(addr)(s))

Installing automatic rewrites from: (## read_data) Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Case splitting on OK?(memory_read_list(pm!1‘mem)(addr!1, size(uidt(dt!1)))(s!1)), we get 2 subgoals:

plain_memory_read_data_ok.1:

{-1} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))
{-2} interpreted_data_type?[Data](dt′)
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} valid_in_mem(pm′, dt′)(addr′)(s′)

{1} OK?(cases memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′) of OK(state, data): ok_lift(from_byte(dt′)(data, addr′))(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

Simplifying, rewriting, and recording with decision procedures, Rewriting using ok_lift_ok, matching in *, we get 2 subgoals:

plain_memory_read_data_ok.1.1:

{-1} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))
{-2} interpreted_data_type?[Data](dt′)
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} valid_in_mem(pm′, dt′)(addr′)(s′)

{1} OK?(OK(state(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′)),

down(from_byte(dt′)

(data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′)), addr′))))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_read_data_ok.1.1.
plain_memory_read_data_ok.1.2:

{-1} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))
{-2} interpreted_data_type?[Data](dt′)
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} valid_in_mem(pm′, dt′)(addr′)(s′)

{1} up?(from_byte(dt′)

(data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′)), addr′))

{2} OK?(ok_lift(from_byte(dt′)

(data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′)),

addr′))

(state(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))))

Rewriting using valid_from_byte, matching in *, Expanding the definition of valid_in_mem, Expanding the definition of valid_in_mem, which is trivially true.

This completes the proof of plain_memory_read_data_ok.1.2.
plain_memory_read_data_ok.2:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} valid_in_mem(pm′, dt′)(addr′)(s′)
{1} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))

{2} OK?(cases memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′) of OK(state, data): ok_lift(from_byte(dt′)(data, addr′))(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

Expanding the definition of in_blessed_memory?, Rewriting using memory_read_list_ok, matching in * where states gets pm!1‘states, we get 2 subgoals:

plain_memory_read_data_ok.2.1:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(addr′, size(uidt(dt′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} valid_in_mem(pm′, dt′)(addr′)(s′)

{1} transformer_invariant?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{2} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))

{3} OK?(cases memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′) of OK(state, data): ok_lift(from_byte(dt′)(data, addr′))(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

Rewriting using plain_memory_transformer_invariant_read_list_block, matching in * where pm gets pm!1,

This completes the proof of plain_memory_read_data_ok.2.1.
plain_memory_read_data_ok.2.2:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(addr′, size(uidt(dt′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} valid_in_mem(pm′, dt′)(addr′)(s′)

{1} transformers_ok?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{2} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))

{3} OK?(cases memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′) of OK(state, data): ok_lift(from_byte(dt′)(data, addr′))(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

Rewriting using plain_memory_transformers_ok_read_list_block, matching in * where pm gets pm!1,

This completes the proof of plain_memory_read_data_ok.2.2.

Q.E.D.

C.172.4 Plain_Mem_Properties_2.plain_memory_write_data_ok

Terse proof for plain_memory_write_data_ok.
plain_memory_write_data_ok:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ OK?(write_data(pm, dt)(addr, data)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of write_data, Expanding the definition of write_data, Installing automatic rewrites from: length_to_byte Expanding the definition of in_blessed_memory?, Rewriting using memory_write_list_ok, matching in * where pm gets pm!1‘mem, states gets

pm!1‘states, we get 3 subgoals:

plain_memory_write_data_ok.1:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)

{1} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{2} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))

Using lemma plain_memory_transformer_invariant_write_list_block[State], Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_write_data_ok.1.
plain_memory_write_data_ok.2:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{2} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))

Using lemma plain_memory_transformers_ok_write_list_block[State], Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_write_data_ok.2.
plain_memory_write_data_ok.3:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)

{1} side_effect_content_unchanged(address_block(addr′, size(uidt(dt′))), pm′`states,

memory_write_side_effect(pm′`mem))

{2} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))

Using lemma plain_memory_side_effect_content_unchanged_write_block[State], Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_write_data_ok.3.

Q.E.D.

C.172.5 Plain_Mem_Properties_2.plain_memory_write_data_valid_TCC1

Terse proof for plain_memory_write_data_valid_TCC1.

plain_memory_write_data_valid_TCC1:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ OK?[State, Unit](write_data[State, Data](pm, dt)(addr, data)(s)) ∨ Exception?[State, Unit](write_data[State, Data](pm, dt)(addr, data)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_write_data_ok, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_write_data_valid_TCC1.

Q.E.D.

C.172.6 Plain_Mem_Properties_2.plain_memory_write_data_valid

Terse proof for plain_memory_write_data_valid.
plain_memory_write_data_valid:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ valid_in_mem(pm, dt)(addr)(state(write_data(pm, dt)(addr, data)(s)))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_write_data_ok, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of valid_in_mem, Expanding the definition of valid_in_mem, Expanding the definition of write_data, Expanding the definition of write_data, Installing automatic rewrites from: length_to_byte valid_to_byte subset_bigger_union_right Using lemma plain_mem_write_list_read_list[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

plain_memory_write_data_valid.1:

{-1} plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))

{-4} data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem) (addr′, to_byte(dt′)(data′, addr′)) (s′))))

= to_byte(dt′)(data′, addr′)

{-5} interpreted_data_type?[Data](dt′)
{-6} in_blessed_memory?(dt′, addr′, pm′`rw_addr)

{-7} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem) (addr′, to_byte(dt′)(data′, addr′)) (s′))))

{1} dt′`uidt`valid?

(data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem) (addr′, to_byte(dt′)(data′, addr′)) (s′)))),

addr′)

Replacing using formula -4, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_write_data_valid.1.
plain_memory_write_data_valid.2:

{-1} plain_memory?(pm′)
{-2} pm′`states(s′)
{-3} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))
{-4} interpreted_data_type?[Data](dt′)
{-5} in_blessed_memory?(dt′, addr′, pm′`rw_addr)

{-6} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem) (addr′, to_byte(dt′)(data′, addr′)) (s′))))

{1} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)

{2} dt′`uidt`valid?

(data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem) (addr′, to_byte(dt′)(data′, addr′)) (s′)))),

addr′)

Expanding the definition of in_blessed_memory?, which is trivially true.

This completes the proof of plain_memory_write_data_valid.2.

Q.E.D.

C.172.7 Plain_Mem_Properties_2.plain_memory_transformers_ok_write_data

Terse proof for plain_memory_transformers_ok_write_data.

plain_memory_transformers_ok_write_data:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]),

pm: Plain_Memory[State]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ transformers_ok?(pm`states, singleton(expr_2_super(write_data(pm, dt)(addr, data))))

Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: length_to_byte singleton write_data plain_memory_side_effect_content_unchanged_write_block

expr_2_super expr_2_super_res Simplifying, rewriting, and recording with decision procedures, Replacing using formula -5, Using lemma memory_write_list_ok, Using lemma plain_memory_transformer_invariant_write_list_block[State], Using lemma plain_memory_transformers_ok_write_list_block[State], Expanding the definition of in_blessed_memory?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_transformers_ok_write_data.

Q.E.D.

C.172.8 Plain_Mem_Properties_2.plain_memory_transformer_invariant_write_data

Terse proof for plain_memory_transformer_invariant_write_data.
plain_memory_transformer_invariant_write_data:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]),

pm: Plain_Memory[State]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ transformer_invariant?(pm`states,

singleton(expr_2_super(write_data(pm, dt)(addr, data))))

Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Expanding the definition of write_data, Expanding the definition of write_data, Using lemma transformer_invariant_write_list, Using lemma plain_memory_transformer_invariant_write_list_block[State], Installing automatic rewrites from: length_to_byte Expanding the definition of in_blessed_memory?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

plain_memory_transformer_invariant_write_data.1:

{-1} plain_memory?(pm′)

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{-3} pm′`states(s′)
{-4} interpreted_data_type?[Data](dt′)
{-5} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)
{-6} q′ = expr_2_super(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′)))

{1} side_effect_content_unchanged(address_block(addr′, size(uidt(dt′))), pm′`states,

memory_write_side_effect(pm′`mem))

{2} result_pred(pm′`states)(q′(s′))

Rewriting using plain_memory_side_effect_content_unchanged_write_block, matching in *,

This completes the proof of plain_memory_transformer_invariant_write_data.1.
plain_memory_transformer_invariant_write_data.2:

{-1} plain_memory?(pm′)

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{-3} pm′`states(s′)
{-4} interpreted_data_type?[Data](dt′)
{-5} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)
{-6} q′ = expr_2_super(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′)))

{1} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ {expr_2_super (memory_write_side_effect (pm′‘mem)(addr′, to_byte(dt′)(data′, addr′), false))}))

{2} result_pred(pm′`states)(q′(s′))

Keeping (-2 -3 -5 1) and hiding *, Rewriting using add_as_union, matching in *, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: (-1 2), Expanding the definition of subset?, Expanding the definition of union, Expanding the definition of member, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of memory_write_side_effect_super_transformers, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_reflexive, matching in *, Expanding the definition of singleton, which is trivially true.

This completes the proof of plain_memory_transformer_invariant_write_data.2.

Q.E.D.

C.172.9 Plain_Mem_Properties_2.plain_memory_transformer_invariant_read_data

Terse proof for plain_memory_transformer_invariant_read_data.

plain_memory_transformer_invariant_read_data:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ⊃ transformer_invariant?(pm`states, singleton(expr_2_super(read_data(pm, dt)(addr))))

Expanding the definition of transformer_invariant?, Installing automatic rewrites from: result_pred has_next_state Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of singleton, Replacing using formula -5, Installing automatic rewrites from: (expr_2_super! expr_2_super_res! ok_lift! read_data! ##!) Simplifying, rewriting, and recording with decision procedures, Using lemma memory_read_list_next_ok[State], Expanding the definition of in_blessed_memory?, Rewriting using plain_memory_transformers_ok_read_list_block[State], matching in *, Rewriting using plain_memory_transformer_invariant_read_list_block[State], matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_transformer_invariant_read_data.

Q.E.D.

C.172.10 Plain_Mem_Properties_2.plain_memory_unchanged_memory_invariant_write_data

Terse proof for plain_memory_unchanged_memory_invariant_write_data.
plain_memory_unchanged_memory_invariant_write_data:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]),

pm: Plain_Memory[State]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

singleton(expr_2_super(write_data(pm, dt)(addr, data))), ((pm‘ro_addr∪ pm‘rw_addr) \ address_block(addr, size(uidt(dt)))))

Expanding the definition of unchanged_memory_invariant?, Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

plain_memory_unchanged_memory_invariant_write_data.1:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt′, addr′, pm′`rw_addr)

{1} transformer_invariant?(pm′`states, singleton(expr_2_super(write_data(pm′, dt′)(addr′, data′))))

Using lemma plain_memory_transformer_invariant_write_data, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.1.

plain_memory_unchanged_memory_invariant_write_data.2:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt′, addr′, pm′`rw_addr)

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

pm′`states(s) ∧ singleton(expr_2_super(write_data(pm′, dt′)(addr′, data′)))(q) ∧ difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a)

∧

OK?(q(s)) ∧ OK?(memory_read(pm′`mem)(a)(s)) ∧ OK?(memory_read(pm′`mem)(a)(state(q(s))))

⊃

data(memory_read(pm′`mem)(a)(state(q(s)))) =

data(memory_read(pm′`mem)(a)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of write_data, Expanding the definition of write_data, Installing automatic rewrites from: length_to_byte ok_expr_2_super state_expr_2_super has_next_state

subset_singleton Expanding the definition of singleton, Replacing using formula -2, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of in_blessed_memory?, Using lemma unchanged_memory_invariant_unchanged_write_list[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 4 subgoals:

plain_memory_unchanged_memory_invariant_write_data.2.1:

{-1} pm′`states(s′)
{-2} q′ = expr_2_super(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′)))

{-3} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-4} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))
{-5} OK?(memory_read(pm′`mem)(a′)(s′))

{-6} OK?(memory_read(pm′`mem) (a′) (state(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))

(s′))))

{-7} interpreted_data_type?[Data](dt′)
{-8} plain_memory?(pm′)
{-9} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)

{1} side_effect_content_unchanged(address_block(addr′, size(uidt(dt′))), pm′`states,

memory_write_side_effect(pm′`mem))

{2} data(memory_read(pm′`mem) (a′) (state(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))

(s′))))

= data(memory_read(pm′`mem)(a′)(s′))

Rewriting using plain_memory_side_effect_content_unchanged_write_block, matching in *,

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.2.1.

plain_memory_unchanged_memory_invariant_write_data.2.2:

{-1} pm′`states(s′)
{-2} q′ = expr_2_super(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′)))

{-3} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-4} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))
{-5} OK?(memory_read(pm′`mem)(a′)(s′))

{-6} OK?(memory_read(pm′`mem)

(a′)

(state(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))

(s′))))

{-7} interpreted_data_type?[Data](dt′)
{-8} plain_memory?(pm′)
{-9} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)
{1} transformers_ok?(pm′`states, singleton(expr_2_super(memory_read(pm′`mem)(a′))))

{2} data(memory_read(pm′`mem)

(a′)

(state(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))

(s′))))

= data(memory_read(pm′`mem)(a′)(s′))

Keeping (-3 -8 1) and hiding *, Using lemma plain_memory_transformers_ok_read_ro_rw, Simplifying, rewriting, and recording with decision procedures, Using lemma transformers_ok_mono_transformers[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using memory_read_transformers_memory_read, matching in *, Keeping (-2 1) and hiding *, Expanding the definition(s) of (difference member),

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.2.2.
plain_memory_unchanged_memory_invariant_write_data.2.3:

{-1} pm′`states(s′)
{-2} q′ = expr_2_super(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′)))

{-3} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-4} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))
{-5} OK?(memory_read(pm′`mem)(a′)(s′))

{-6} OK?(memory_read(pm′`mem)

(a′)

(state(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))

(s′))))

{-7} interpreted_data_type?[Data](dt′)
{-8} plain_memory?(pm′)
{-9} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)

{1} transformers_ok?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{2} data(memory_read(pm′`mem)

(a′)

(state(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))

(s′))))

= data(memory_read(pm′`mem)(a′)(s′))

Rewriting using plain_memory_transformers_ok_write_list_block, matching in *,

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.2.3.
plain_memory_unchanged_memory_invariant_write_data.2.4:

{-1} pm′`states(s′)
{-2} q′ = expr_2_super(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′)))

{-3} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-4} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))(s′))
{-5} OK?(memory_read(pm′`mem)(a′)(s′))

{-6} OK?(memory_read(pm′`mem)

(a′)

(state(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))

(s′))))

{-7} interpreted_data_type?[Data](dt′)
{-8} plain_memory?(pm′)
{-9} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, (memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))), singleton(a′))

{2} data(memory_read(pm′`mem)

(a′)

(state(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data′, addr′))

(s′))))

= data(memory_read(pm′`mem)(a′)(s′))

Keeping (-3 -8 -10 1) and hiding *,

Rewriting using unchanged_memory_invariant_union_transformers[State], matching in *,

we get 2 subgoals:

plain_memory_unchanged_memory_invariant_write_data.2.4.1:

{-1} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-2} plain_memory?(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_transformers(pm′`mem,

address_block(addr′,

size(uidt(dt′)))),

singleton(a′))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, (memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))), singleton(a′))

Hiding formulas: 2,

Using lemma unchanged_memory_invariant_union[State],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 3 subgoals:

plain_memory_unchanged_memory_invariant_write_data.2.4.1.1:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_transformers(pm′`mem,

address_block(addr′,

size(uidt(dt′)))),

((pm′‘ro_addr∪ pm′‘rw_addr) \ address_block(addr′, size(uidt(dt′)))))

{-2} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-3} plain_memory?(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_transformers(pm′`mem,

address_block(addr′,

size(uidt(dt′)))),

singleton(a′))

Using lemma unchanged_memory_invariant_mono[State],

Installing automatic rewrites from: subset_equal

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.2.4.1.1.
plain_memory_unchanged_memory_invariant_write_data.2.4.1.2:

{-1} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-2} plain_memory?(pm′)
{1} unchanged_memory_write_invariant?(pm′`mem, pm′`states, pm′`rw_addr)

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_transformers(pm′`mem,

address_block(addr′,

size(uidt(dt′)))),

singleton(a′))

Rewriting using plain_memory_unchanged_memory_write_invariant, matching in *,

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.2.4.1.2.
plain_memory_unchanged_memory_invariant_write_data.2.4.1.3:

{-1} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-2} plain_memory?(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_transformers(pm′`mem, pm′`rw_addr), pm′`ro_addr)

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_transformers(pm′`mem,

address_block(addr′,

size(uidt(dt′)))),

singleton(a′))

Rewriting using plain_memory_unchanged_memory_invariant_write, matching in *,

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.2.4.1.3.

plain_memory_unchanged_memory_invariant_write_data.2.4.2:

{-1} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{-2} plain_memory?(pm′)

{1} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_side_effect_super_transformers(pm′`mem,

ad-

dress_block

(addr′, size (uidt(dt′)))),

singleton(a′))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, (memory_write_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))), singleton(a′))

Hiding formulas: 2,

Using lemma plain_memory_unchanged_invariant,

Using lemma unchanged_memory_invariant_mono[State],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

plain_memory_unchanged_memory_invariant_write_data.2.4.2.1:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

{-2} plain_memory?(pm′)

{-3} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{1} union(pm′`ro_addr, pm′`rw_addr)(a′)

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_side_effect_super_transformers(pm′`mem,

ad-

dress_block

(addr′, size (uidt(dt′)))),

singleton(a′))

Keeping (-3 1) and hiding *,

Expanding the definition(s) of (difference member),

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.2.4.2.1.

plain_memory_unchanged_memory_invariant_write_data.2.4.2.2:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states, ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))), (pm′‘ro_addr∪ pm′‘rw_addr))

{-2} plain_memory?(pm′)

{-3} difference((pm′‘ro_addr∪ pm′‘rw_addr), address_block(addr′, size(uidt(dt′))))

(a′)

{1} (memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ⊆ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states,

memory_write_side_effect_super_transformers(pm′`mem,

ad-

dress_block

(addr′, size (uidt(dt′)))),

singleton(a′))

Keeping (-4 1) and hiding *,

Installing automatic rewrites from: memory_write_side_effect_super_transformers_mono

Rewriting using subset_bigger_union_right, matching in *,

Rewriting using subset_bigger_union_right, matching in *,

This completes the proof of plain_memory_unchanged_memory_invariant_write_data.2.4.2.2.

Q.E.D.

C.172.11 Plain_Mem_Properties_2.plain_memory_unchanged_memory_invariant_read_data

Terse proof for plain_memory_unchanged_memory_invariant_read_data.
plain_memory_unchanged_memory_invariant_read_data:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ⊃ unchanged_memory_invariant?(pm`mem, pm`states, singleton(expr_2_super(read_data(pm, dt)(addr))), (pm‘ro_addr∪ pm‘rw_addr))

Installing automatic rewrites from: ok_expr_2_super state_expr_2_super singleton ## ok_lift result_pred has_next_state has_next_state_expr_2_super in_blessed_memory_subset transformers_ok_union_transformers plain_memory_transformers_ok_read_side_effects_ro_rw plain_memory_transformers_ok_read_ro_rw plain_memory_transformers_ok_read_side_effects_block plain_memory_transformers_ok_read_block

Repeatedly Skolemizing and flattening,

Using lemma unchanged_memory_invariant_read_list[State],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

plain_memory_unchanged_memory_invariant_read_data.1:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(memory_read_list(pm′`mem)

(addr′,

size(uidt(dt′))))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{-2} interpreted_data_type?[Data](dt′)
{-3} plain_memory?(pm′)
{-4} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt′)(addr′))), (pm′‘ro_addr∪ pm′‘rw_addr))

Expanding the definition of unchanged_memory_invariant?, Applying propositional simplification, we get 2 subgoals:

plain_memory_unchanged_memory_invariant_read_data.1.1:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(memory_read_list(pm′`mem)

(addr′,

size(uidt(dt′))))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{-2} interpreted_data_type?[Data](dt′)
{-3} plain_memory?(pm′)
{-4} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformer_invariant?(pm′`states, singleton(expr_2_super(read_data(pm′, dt′)(addr′))))

Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_read_list_ok[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

plain_memory_unchanged_memory_invariant_read_data.1.1.1:

{-1} pm′`states(s′)
{-2} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))
{-3} q′ = expr_2_super(read_data(pm′, dt′)(addr′))
{-4} has_next_state(q′(s′))

{-5} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(memory_read_list(pm′`mem)

(addr′,

size(uidt(dt′))))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{-6} interpreted_data_type?[Data](dt′)
{-7} plain_memory?(pm′)
{-8} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))
{1} pm′`states(state(q′(s′)))

Replacing using formula -3, Hiding formulas: -3, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: read_data ok_lift! Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma expr_transformer_invariant_next_ok, Forward chaining on unchanged_memory_invariant_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_memory_invariant_read_data.1.1.1.
plain_memory_unchanged_memory_invariant_read_data.1.1.2:

{-1} pm′`states(s′)
{-2} q′ = expr_2_super(read_data(pm′, dt′)(addr′))
{-3} has_next_state(q′(s′))

{-4} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(memory_read_list(pm′`mem)

(addr′,

size(uidt(dt′))))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{-5} interpreted_data_type?[Data](dt′)
{-6} plain_memory?(pm′)
{-7} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformer_invariant?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{2} pm′`states(state(q′(s′)))

Rewriting using plain_memory_transformer_invariant_read_list_block, matching in *,

This completes the proof of plain_memory_unchanged_memory_invariant_read_data.1.1.2.
plain_memory_unchanged_memory_invariant_read_data.1.2:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states,

singleton(expr_2_super(memory_read_list(pm′`mem)

(addr′,

size(uidt(dt′))))),

(pm′‘ro_addr∪ pm′‘rw_addr))

{-2} interpreted_data_type?[Data](dt′)
{-3} plain_memory?(pm′)
{-4} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address): pm′`states(s) ∧ singleton(expr_2_super(read_data(pm′, dt′)(addr′)))(q) ∧ union(pm′`ro_addr, pm′`rw_addr)(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′`mem)(a)(s)) ∧ OK?(memory_read(pm′`mem)(a)(state(q(s))))

⊃

data(memory_read(pm′`mem)(a)(state(q(s)))) =

data(memory_read(pm′`mem)(a)(s))

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -2, Hiding formulas: -2, Installing automatic rewrites from: read_data ok_lift! ##! Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma expr_unchanged_memory_invariant_unchanged[State, list[Byte]], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_memory_invariant_read_data.1.2.
plain_memory_unchanged_memory_invariant_read_data.2:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))

{1} unchanged_memory_invariant?(pm′`mem, pm′`states, (memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))), (pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt′)(addr′))), (pm′‘ro_addr∪ pm′‘rw_addr))

Hiding formulas: 2, Installing automatic rewrites from: plain_memory_unchanged_read_block_ro_rw_addr plain_memory_unchanged_read_side_effect_block_ro_rw Rewriting using unchanged_memory_invariant_union_transformers, matching in *,

This completes the proof of plain_memory_unchanged_memory_invariant_read_data.2.

Q.E.D.

C.172.12 Plain_Mem_Properties_2.plain_memory_read_data_q_ok_TCC1

Terse proof for plain_memory_read_data_q_ok_TCC1.
plain_memory_read_data_q_ok_TCC1:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → SuperResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ unchanged_memory_invariant?(pm`mem, pm`states, singleton(q),

address_block(addr, size(uidt(dt))))

∧ pm`states(s) ∧ OK?(q(s)) ∧ valid_in_mem(pm, dt)(addr)(s) ⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_read_data_q_ok_TCC1.

Q.E.D.

C.172.13 Plain_Mem_Properties_2.plain_memory_read_data_q_ok

Terse proof for plain_memory_read_data_q_ok.
plain_memory_read_data_q_ok:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → SuperResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ unchanged_memory_invariant?(pm`mem, pm`states, singleton(q),

address_block(addr, size(uidt(dt))))

∧ pm`states(s) ∧ OK?(q(s)) ∧ valid_in_mem(pm, dt)(addr)(s) ⊃ OK?(read_data(pm, dt)(addr)(state(q(s))))

C.172 Proofs for Plain_Mem_Properties_2 (plain_memory.pvs)

Installing automatic rewrites from: (valid_in_mem read_data ## expr_2_super expr_2_super_res ok_lift has_next_state)

Repeatedly Skolemizing and flattening, Using lemma plain_mem_q_read_list[State], Using lemma memory_read_list_ok[State], Using lemma memory_read_list_ok[State], Expanding the definition of in_blessed_memory?, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_transformers_ok_read_list_block[State], Using lemma plain_memory_transformer_invariant_read_list_block[State], Case splitting on OK?(memory_read_list(pm!1‘mem)(addr!1, size(uidt(dt!1))) (state(q!1(s!1)))), we get 2 subgoals:

plain_memory_read_data_q_ok.1:

{-1} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′))))

{-2} plain_memory?(pm′) ∧ (address_block(addr′, size(uidt(dt′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ⊃ transformer_invariant?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{-3} plain_memory?(pm′) ∧ (address_block(addr′, size(uidt(dt′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ⊃ transformers_ok?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{-4} transformer_invariant?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

∧ transformers_ok?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

∧ pm′`states(state(q′(s′))) ⊃ OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′))))

{-5} transformer_invariant?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

∧ transformers_ok?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

⊃ OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′)) {-6} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′)) ∧

OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′)))) ⊃ data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′)))) = data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))

{-7} interpreted_data_type?[Data](dt′)
{-8} plain_memory?(pm′)
{-9} (address_block(addr′, size(uidt(dt′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-10} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(q′),

address_block(addr′, size(uidt(dt′))))

{-11} pm′`states(s′)
{-12} OK?(q′(s′))

{-13} cases memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′) of OK(sn, bl): dt′`uidt`valid?(bl, addr′) else true endcases

{1} OK?(cases memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′))) of OK(state_1, data): ok_lift(from_byte(dt′)(data, addr′))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

Simplifying, rewriting, and recording with decision procedures, Replacing using formula -5, Using lemma valid_from_byte[Data], Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_read_data_q_ok.1.

plain_memory_read_data_q_ok.2:

{-1} plain_memory?(pm′) ∧ (address_block(addr′, size(uidt(dt′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ⊃ transformer_invariant?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{-2} plain_memory?(pm′) ∧ (address_block(addr′, size(uidt(dt′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr)) ⊃ transformers_ok?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

{-3} transformer_invariant?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

∧ transformers_ok?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

∧ pm′`states(state(q′(s′))) ⊃ OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′))))

{-4} transformer_invariant?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

∧ transformers_ok?(pm′`states,

(memory_read_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′)))) ∪ memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size(uidt(dt′))))))

⊃ OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′)) {-5} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′)) ∧

OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′)))) ⊃ data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′)))) = data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′))

{-6} interpreted_data_type?[Data](dt′)
{-7} plain_memory?(pm′)
{-8} (address_block(addr′, size(uidt(dt′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{-9} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(q′),

address_block(addr′, size(uidt(dt′))))

{-10} pm′`states(s′)
{-11} OK?(q′(s′))

{-12} cases memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(s′) of OK(sn, bl): dt′`uidt`valid?(bl, addr′) else true endcases

{1} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′))))

{2} OK?(cases memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))(state(q′(s′))) of OK(state_1, data): ok_lift(from_byte(dt′)(data, addr′))(state_1), Exception(ex_type, state_1): Exception(ex_type, state_1), Fatal: Fatal, Hang: Hang endcases)

Using lemma unchanged_memory_invariant_invariant[State], Using lemma super_transformer_invariant_next_ok[State], Installing automatic rewrites from: (singleton!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_data_q_ok.2.

Q.E.D.

C.172.14 Plain_Mem_Properties_2.plain_memory_read_data_q_same_TCC1

Terse proof for plain_memory_read_data_q_same_TCC1.
plain_memory_read_data_q_same_TCC1:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → SuperResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ unchanged_memory_invariant?(pm`mem, pm`states, singleton(q),

address_block(addr, size(uidt(dt))))

∧ pm`states(s) ∧ OK?(q(s)) ∧ valid_in_mem(pm, dt)(addr)(s) ⊃ OK?[State, Data](read_data[State, Data](pm, dt)(addr)(state[State](q(s))))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_data_q_ok[State, Data], Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_read_data_q_same_TCC1.

Q.E.D.

C.172.15 Plain_Mem_Properties_2.plain_memory_read_data_q_same_TCC2

Terse proof for plain_memory_read_data_q_same_TCC2.
plain_memory_read_data_q_same_TCC2:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → SuperResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ unchanged_memory_invariant?(pm`mem, pm`states, singleton(q),

address_block(addr, size(uidt(dt))))

∧ pm`states(s) ∧ OK?(q(s)) ∧ valid_in_mem(pm, dt)(addr)(s) ⊃ OK?[State, Data](read_data[State, Data](pm, dt)(addr)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_data_ok, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_read_data_q_same_TCC2.

Q.E.D.

C.172.16 Plain_Mem_Properties_2.plain_memory_read_data_q_same

Terse proof for plain_memory_read_data_q_same.

plain_memory_read_data_q_same:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → SuperResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ unchanged_memory_invariant?(pm`mem, pm`states, singleton(q),

address_block(addr, size(uidt(dt))))

∧ pm`states(s) ∧ OK?(q(s)) ∧ valid_in_mem(pm, dt)(addr)(s) ⊃ data(read_data(pm, dt)(addr)(state(q(s)))) = data(read_data(pm, dt)(addr)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_data_q_ok, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_data_ok, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: in_blessed_memory_subset read_data ## expr_2_super

expr_2_super_res ok_lift singleton comp_expr_forget_expr Using lemma super_transformers_ok_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ok_lift, Expanding the definition of ##, Using lemma plain_mem_q_read_list[State], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_data_q_same.

Q.E.D.

C.172.17 Plain_Mem_Properties_2.plain_memory_read_write_ok

Terse proof for plain_memory_read_write_ok.
plain_memory_read_write_ok:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ OK?((write_data(pm, dt)(addr, data) ## read_data(pm, dt)(addr))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: comp_expr_forget_expr ## plain_memory_write_data_ok

plain_memory_read_data_ok subset_bigger_union_right Simplifying, rewriting, and recording with decision procedures, Expanding the definition of ##, Case splitting on OK?(write_data(pm!1‘mem, dt!1)(addr!1, data!1)(s!1)), we get 2 subgoals:

plain_memory_read_write_ok.1:

{-1} OK?(write_data(pm′`mem, dt′)(addr′, data′)(s′))
{-2} interpreted_data_type?[Data](dt′)
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} in_blessed_memory?(dt′, addr′, pm′`rw_addr)

{1} OK?(cases write_data(pm′, dt′)(addr′, data′)(s′) of OK(state, data): read_data(pm′, dt′)(addr′)(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

Using lemma plain_memory_read_data_ok, Using lemma plain_memory_write_data_valid[State, Data], Expanding the definition of in_blessed_memory?, Using lemma plain_memory_inv_pred_write_data[State, Data], Simplifying, rewriting, and recording with decision procedures, Lifting IF-conditions to the top level, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_read_write_ok.1.
plain_memory_read_write_ok.2:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} in_blessed_memory?(dt′, addr′, pm′`rw_addr)
{1} OK?(write_data(pm′`mem, dt′)(addr′, data′)(s′))

{2} OK?(cases write_data(pm′, dt′)(addr′, data′)(s′) of OK(state, data): read_data(pm′, dt′)(addr′)(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

Hiding formulas: 2, Using lemma plain_memory_write_data_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of write_data, Expanding the definition of write_data, which is trivially true.

This completes the proof of plain_memory_read_write_ok.2.

Q.E.D.

C.172.18 Plain_Mem_Properties_2.plain_memory_read_write_res_TCC1

Terse proof for plain_memory_read_write_res_TCC1.

plain_memory_read_write_res_TCC1:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ OK?[State, Data]

((##[State, Unit, Data]

(write_data[State, Data](pm, dt)(addr, data), read_data[State, Data](pm, dt)(addr)))

(s))

Repeatedly Skolemizing and flattening, Applying plain_memory_read_write_ok Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement,

This completes the proof of plain_memory_read_write_res_TCC1.

Q.E.D.

C.172.19 Plain_Mem_Properties_2.plain_memory_read_write_res

Terse proof for plain_memory_read_write_res.
plain_memory_read_write_res:

{1} ∀ (addr: Address, data1: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ data((write_data(pm, dt)(addr, data1) ## read_data(pm, dt)(addr))(s)) = data1

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_write_ok, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: ## write_data read_data ok_lift length_to_byte

from_byte_to_byte memory_read_transformers_mono subset_bigger_union_right Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ok_lift, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using plain_mem_write_list_read_list, matching in * where pm gets pm!1, we get 2 subgoals:

plain_memory_read_write_res.1:

{-1} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data1′, addr′))(s′))

{-2} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem) (addr′, to_byte(dt′)(data1′, addr′)) (s′))))

{-3} OK?(OK(state(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem)

(addr′,

to_byte(dt′)(data1′, addr′)) (s′)))),

down(from_byte(dt′)(to_byte(dt′)(data1′, addr′), addr′))))

{-4} interpreted_data_type?[Data](dt′)
{-5} plain_memory?(pm′)
{-6} pm′`states(s′)
{-7} in_blessed_memory?(dt′, addr′, pm′`rw_addr)
{1} bottom?(from_byte(dt′)(to_byte(dt′)(data1′, addr′), addr′))
{2} down(from_byte(dt′)(to_byte(dt′)(data1′, addr′), addr′)) = data1′

Rewriting using from_byte_to_byte, matching in *,

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_read_write_res.1.

plain_memory_read_write_res.2:

{-1} OK?(memory_write_list(pm′`mem)(addr′, to_byte(dt′)(data1′, addr′))(s′))

{-2} OK?(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem) (addr′, to_byte(dt′)(data1′, addr′)) (s′))))

{-3} OK?(OK(state(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem)

(addr′,

to_byte(dt′)(data1′, addr′)) (s′)))),

down(from_byte(dt′)

(data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem)

(addr′, to_byte(dt′) (data1′, addr′))

(s′)))),

addr′))))
{-4} interpreted_data_type?[Data](dt′)
{-5} plain_memory?(pm′)
{-6} pm′`states(s′)
{-7} in_blessed_memory?(dt′, addr′, pm′`rw_addr)
{1} (address_block(addr′, size(uidt(dt′))) ⊆ pm′‘rw_addr)

{2} bottom?(from_byte(dt′)

(data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem)

(addr′, to_byte(dt′) (data1′, addr′))

(s′)))),

addr′))

{3} down(from_byte(dt′)

(data(memory_read_list(pm′`mem)(addr′, size(uidt(dt′)))

(state(memory_write_list(pm′`mem)

(addr′,

to_byte(dt′)(data1′, addr′)) (s′)))),

addr′))
= data1′

Expanding the definition of in_blessed_memory?, which is trivially true.

This completes the proof of plain_memory_read_write_res.2.

Q.E.D.

C.172.20 Plain_Mem_Properties_2.plain_memory_unchanged_memory_ok_result

Terse proof for plain_memory_unchanged_memory_ok_result.

plain_memory_unchanged_memory_ok_result:

{1} ∀ (addresses: PRED[Address], pm: Plain_Memory[State], d: Data): plain_memory?(pm) ∧ (addresses ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

singleton(expr_2_super[State, Data](ok_result(d))), addresses)

Expanding the definition of unchanged_memory_invariant?, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: (expr_2_super! expr_2_super_res! ok_result!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

plain_memory_unchanged_memory_ok_result.1:

{-1} plain_memory?(pm′)
{-2} (addresses′ ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} ∀ (s: State, q: [State → SuperResult[State]], a: Address):

pm′`states(s) ∧ singleton(expr_2_super[State, Data](ok_result(d′)))(q) ∧ addresses′(a) ∧ OK?(q(s)) ∧ OK?(memory_read(pm′`mem)(a)(s)) ∧ OK?(memory_read(pm′`mem)(a)(state(q(s))))

⊃

data(memory_read(pm′`mem)(a)(state(q(s)))) =

data(memory_read(pm′`mem)(a)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -4, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_memory_ok_result.1.
plain_memory_unchanged_memory_ok_result.2:

{-1} plain_memory?(pm′)
{-2} (addresses′ ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} transformer_invariant?(pm′`states, singleton(expr_2_super[State, Data](ok_result(d′))))

Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -4, Expanding the definition of result_pred, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_memory_ok_result.2.

Q.E.D.

C.173 Proofs for Plain_Mem_Properties_3 (plain_memory.pvs)

C.173.1 Plain_Mem_Properties_3.plain_memory_read_write_other_ok

Terse proof for plain_memory_read_write_other_ok.
plain_memory_read_write_other_ok:

{1} ∀ (addr1, addr2: Address, data1: Data1, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ valid_in_mem(pm, dt2)(addr2)(s) ⊃ OK?((write_data(pm, dt1)(addr1, data1) ## read_data(pm, dt2)(addr2))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of ##, Case splitting on OK?(write_data(pm!1, dt1!1)(addr1!1, data1!1)(s!1)), we get 2 subgoals:

plain_memory_read_write_other_ok.1:

{-1} OK?(write_data(pm′, dt1′)(addr1′, data1′)(s′))
{-2} interpreted_data_type?[Data1](dt1′)
{-3} interpreted_data_type?[Data2](dt2′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} in_blessed_memory?(dt1′, addr1′, pm′`rw_addr)
{-7} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-9} valid_in_mem(pm′, dt2′)(addr2′)(s′)

{1} OK?(cases write_data(pm′, dt1′)(addr1′, data1′)(s′) of OK(state, data): read_data(pm′, dt2′)(addr2′)(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

Simplifying, rewriting, and recording with decision procedures, Using lemma plain_memory_read_data_q_ok[State, Data2], Installing automatic rewrites from: (expr_2_super! expr_2_super_res!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_unchanged_memory_invariant_write_data[State, Data1], Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_reflexive, matching in *, Expanding the definition of in_blessed_memory?, Keeping (-3 -9 -10 1) and hiding *, Using lemma blocks_in_larger_set, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_bigger_union_right, matching in *,

This completes the proof of plain_memory_read_write_other_ok.1.
plain_memory_read_write_other_ok.2:

{-1} interpreted_data_type?[Data1](dt1′)
{-2} interpreted_data_type?[Data2](dt2′)
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} in_blessed_memory?(dt1′, addr1′, pm′`rw_addr)
{-6} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-8} valid_in_mem(pm′, dt2′)(addr2′)(s′)
{1} OK?(write_data(pm′, dt1′)(addr1′, data1′)(s′))

{2} OK?(cases write_data(pm′, dt1′)(addr1′, data1′)(s′) of OK(state, data): read_data(pm′, dt2′)(addr2′)(state), Exception(ex_type, state): Exception(ex_type, state), Fatal: Fatal, Hang: Hang endcases)

Rewriting using plain_memory_write_data_ok, matching in *,

This completes the proof of plain_memory_read_write_other_ok.2.

Q.E.D.

C.173.2 Plain_Mem_Properties_3.plain_memory_read_write_other_res_TCC1

Terse proof for plain_memory_read_write_other_res_TCC1.
plain_memory_read_write_other_res_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): valid_in_mem(pm, dt2)(addr2)(s) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ pm`states(s) ∧ plain_memory?(pm)

⊃

OK?[State, Data2]

((##[State, Unit, Data2]

(write_data[State, Data1](pm, dt1)(addr1, data1), read_data[State, Data2](pm, dt2)(addr2)))

(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_write_other_ok, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_read_write_other_res_TCC1.

Q.E.D.

C.173.3 Plain_Mem_Properties_3.plain_memory_read_write_other_res_TCC2

Terse proof for plain_memory_read_write_other_res_TCC2.
plain_memory_read_write_other_res_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): valid_in_mem(pm, dt2)(addr2)(s) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ pm`states(s) ∧ plain_memory?(pm)

⊃ OK?[State, Data2](read_data[State, Data2](pm, dt2)(addr2)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_data_ok[State, Data2], Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_read_write_other_res_TCC2.

Q.E.D.

C.173.4 Plain_Mem_Properties_3.plain_memory_read_write_other_res

Terse proof for plain_memory_read_write_other_res.
plain_memory_read_write_other_res:

{1} ∀ (addr1, addr2: Address, data1: Data1, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ valid_in_mem(pm, dt2)(addr2)(s) ⊃ data((write_data(pm, dt1)(addr1, data1) ## read_data(pm, dt2)(addr2))(s)) = data(read_data(pm, dt2)(addr2)(s))

Installing automatic rewrites from: (## expr_2_super expr_2_super_res) Repeatedly Skolemizing and flattening, Case splitting on OK?(write_data(pm!1, dt1!1)(addr1!1, data1!1)(s!1)), we get 2 subgoals:

plain_memory_read_write_other_res.1:

{-1} OK?(write_data(pm′, dt1′)(addr1′, data1′)(s′))
{-2} interpreted_data_type?[Data1](dt1′)
{-3} interpreted_data_type?[Data2](dt2′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} in_blessed_memory?(dt1′, addr1′, pm′`rw_addr)
{-7} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-9} valid_in_mem(pm′, dt2′)(addr2′)(s′)

{1} data((write_data(pm′, dt1′)(addr1′, data1′) ## read_data(pm′, dt2′)(addr2′))

(s′))

= data(read_data(pm′, dt2′)(addr2′)(s′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_read_data_q_same[State, Data2], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_unchanged_memory_invariant_write_data[State, Data1], Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_reflexive, matching in *, Expanding the definition of in_blessed_memory?, Keeping (-3 -9 -10 1) and hiding *, Using lemma blocks_in_larger_set, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_bigger_union_right, matching in *,

This completes the proof of plain_memory_read_write_other_res.1.
plain_memory_read_write_other_res.2:

{-1} interpreted_data_type?[Data1](dt1′)
{-2} interpreted_data_type?[Data2](dt2′)
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} in_blessed_memory?(dt1′, addr1′, pm′`rw_addr)
{-6} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-8} valid_in_mem(pm′, dt2′)(addr2′)(s′)
{1} OK?(write_data(pm′, dt1′)(addr1′, data1′)(s′))

{2} data((write_data(pm′, dt1′)(addr1′, data1′) ## read_data(pm′, dt2′)(addr2′))

(s′))

= data(read_data(pm′, dt2′)(addr2′)(s′))

Rewriting using plain_memory_write_data_ok[State, Data1], matching in *,

This completes the proof of plain_memory_read_write_other_res.2.

Q.E.D.

C.173.5 Plain_Mem_Properties_3.plain_memory_read_read_ok

Terse proof for plain_memory_read_read_ok.

C.173 Proofs for Plain_Mem_Properties_3 (plain_memory.pvs)

plain_memory_read_read_ok:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ valid_in_mem(pm, dt1)(addr1)(s) ∧ valid_in_mem(pm, dt2)(addr2)(s) ⊃ OK?((read_data(pm, dt1)(addr1) ## read_data(pm, dt2)(addr2))(s))

Repeatedly Skolemizing and flattening, Case splitting on OK?(read_data(pm!1, dt1!1)(addr1!1)(s!1)), we get 2 subgoals:

plain_memory_read_read_ok.1:

{-1} OK?(read_data(pm′, dt1′)(addr1′)(s′))
{-2} interpreted_data_type?[Data1](dt1′)
{-3} interpreted_data_type?[Data2](dt2′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} valid_in_mem(pm′, dt1′)(addr1′)(s′)
{-9} valid_in_mem(pm′, dt2′)(addr2′)(s′)
{1} OK?((read_data(pm′, dt1′)(addr1′) ## read_data(pm′, dt2′)(addr2′))(s′))

Installing automatic rewrites from: (expr_2_super! expr_2_super_res! ##!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_read_data_q_ok[State, Data2], Instantiating the top quantifier in -1 with the terms: expr_2_super(read_data(pm′, dt1′)(addr1′)), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_unchanged_memory_invariant_read_data[State, Data1], Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

plain_memory_read_read_ok.1.1:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt1′)(addr1′))), (pm′‘ro_addr∪ pm′‘rw_addr))

{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} pm′`states(s′)
{-6} valid_in_mem(pm′, dt2′)(addr2′)(s′)
{-7} OK?(read_data(pm′, dt1′)(addr1′)(s′))
{-8} interpreted_data_type?[Data1](dt1′)
{-9} interpreted_data_type?[Data2](dt2′)
{-10} valid_in_mem(pm′, dt1′)(addr1′)(s′)
{1} (address_block(addr2′, size(uidt(dt2′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt1′)(addr1′))), address_block(addr2′, size(uidt(dt2′))))

{3} OK?(read_data(pm′, dt2′)(addr2′)(state(read_data(pm′, dt1′)(addr1′)(s′))))

Expanding the definition of in_blessed_memory?,

which is trivially true.

This completes the proof of plain_memory_read_read_ok.1.1.
plain_memory_read_read_ok.1.2:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt1′)(addr1′))), (pm′‘ro_addr∪ pm′‘rw_addr))

{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} pm′`states(s′)
{-6} valid_in_mem(pm′, dt2′)(addr2′)(s′)
{-7} OK?(read_data(pm′, dt1′)(addr1′)(s′))
{-8} interpreted_data_type?[Data1](dt1′)
{-9} interpreted_data_type?[Data2](dt2′)
{-10} valid_in_mem(pm′, dt1′)(addr1′)(s′)
{1} (singleton(expr_2_super (read_data(pm′, dt1′)(addr1′))) ⊆ singleton(expr_2_super (read_data(pm′, dt1′)(addr1′))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt1′)(addr1′))), address_block(addr2′, size(uidt(dt2′))))

{3} OK?(read_data(pm′, dt2′)(addr2′)(state(read_data(pm′, dt1′)(addr1′)(s′))))

Rewriting using subset_reflexive, matching in *,

This completes the proof of plain_memory_read_read_ok.1.2.

plain_memory_read_read_ok.2:

{-1} interpreted_data_type?[Data1](dt1′)
{-2} interpreted_data_type?[Data2](dt2′)
{-3} plain_memory?(pm′)
{-4} pm′`states(s′)
{-5} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-6} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-7} valid_in_mem(pm′, dt1′)(addr1′)(s′)
{-8} valid_in_mem(pm′, dt2′)(addr2′)(s′)
{1} OK?(read_data(pm′, dt1′)(addr1′)(s′))
{2} OK?((read_data(pm′, dt1′)(addr1′) ## read_data(pm′, dt2′)(addr2′))(s′))

Rewriting using plain_memory_read_data_ok[State, Data1], matching in *,

This completes the proof of plain_memory_read_read_ok.2.

Q.E.D.

C.173.6 Plain_Mem_Properties_3.plain_memory_read_read_TCC1

Terse proof for plain_memory_read_read_TCC1.
plain_memory_read_read_TCC1:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): valid_in_mem(pm, dt2)(addr2)(s) ∧ valid_in_mem(pm, dt1)(addr1)(s) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ OK?[State, Data2] ((##[State, Data1, Data2] (read_data[State, Data1](pm, dt1)(addr1), read_data[State, Data2](pm, dt2)(addr2))) (s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_read_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_read_TCC1.

Q.E.D.

C.173.7 Plain_Mem_Properties_3.plain_memory_read_read_TCC2

Terse proof for plain_memory_read_read_TCC2.

plain_memory_read_read_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): valid_in_mem(pm, dt2)(addr2)(s) ∧ valid_in_mem(pm, dt1)(addr1)(s) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ OK?[State, Data2](read_data[State, Data2](pm, dt2)(addr2)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_data_ok[State, Data2], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_read_TCC2.

Q.E.D.

C.173.8 Plain_Mem_Properties_3.plain_memory_read_read

Terse proof for plain_memory_read_read.
plain_memory_read_read:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ valid_in_mem(pm, dt1)(addr1)(s) ∧ valid_in_mem(pm, dt2)(addr2)(s) ⊃ data((read_data(pm, dt1)(addr1) ## read_data(pm, dt2)(addr2))(s)) = data(read_data(pm, dt2)(addr2)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_data_ok[State, Data1], Installing automatic rewrites from: (expr_2_super! expr_2_super_res! ##!) Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_read_data_q_same, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_unchanged_memory_invariant_read_data[State, Data1], Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

plain_memory_read_read.1:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt1′)(addr1′))), (pm′‘ro_addr∪ pm′‘rw_addr))

{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} pm′`states(s′)
{-6} valid_in_mem(pm′, dt2′)(addr2′)(s′)
{-7} valid_in_mem(pm′, dt1′)(addr1′)(s′)
{-8} OK?(read_data(pm′, dt1′)(addr1′)(s′))
{1} (address_block(addr2′, size(uidt(dt2′))) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt1′)(addr1′))), address_block(addr2′, size(uidt(dt2′))))

{3} data(read_data(pm′, dt2′)(addr2′)(state(read_data(pm′, dt1′)(addr1′)(s′))))

= data(read_data(pm′, dt2′)(addr2′)(s′))

Expanding the definition of in_blessed_memory?,

which is trivially true.

This completes the proof of plain_memory_read_read.1.
plain_memory_read_read.2:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt1′)(addr1′))), (pm′‘ro_addr∪ pm′‘rw_addr))

{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} pm′`states(s′)
{-6} valid_in_mem(pm′, dt2′)(addr2′)(s′)
{-7} valid_in_mem(pm′, dt1′)(addr1′)(s′)
{-8} OK?(read_data(pm′, dt1′)(addr1′)(s′))
{1} (singleton(expr_2_super (read_data(pm′, dt1′)(addr1′))) ⊆ singleton(expr_2_super (read_data(pm′, dt1′)(addr1′))))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(read_data(pm′, dt1′)(addr1′))), address_block(addr2′, size(uidt(dt2′))))

{3} data(read_data(pm′, dt2′)(addr2′)(state(read_data(pm′, dt1′)(addr1′)(s′))))

= data(read_data(pm′, dt2′)(addr2′)(s′))

Rewriting using subset_reflexive, matching in *,

This completes the proof of plain_memory_read_read.2.

Q.E.D.

C.173.9 Plain_Mem_Properties_3.plain_memory_unchanged_composition

Terse proof for plain_memory_unchanged_composition.

plain_memory_unchanged_composition:

{1} ∀ (addresses: PRED[Address], pm: Plain_Memory[State], q: [State → ExprResult[State, Data1]], r: [Data1 → [State → ExprResult[State, Data2]]], P: PRED[Data1]):

(plain_memory?(pm) ∧ (addresses ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ (∀ (s: (pm`states)): OK?(q(s)) ⊃ P (data(q(s)))) ∧ unchanged_memory_invariant?(pm`mem, pm`states, single-

ton(expr_2_super(q)), addresses) ∧

(∀ (d: (P)):

unchanged_memory_invariant?(pm`mem, pm`states, single-

ton(expr_2_super(r(d))),

addresses)))

⊃

unchanged_memory_invariant?(pm`mem, pm`states, singleton(expr_2_super(q ## r)),

addresses)

Repeatedly Skolemizing and flattening,

Using lemma fexpr_unchanged_memory_invariant_composition,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

we get 2 subgoals:

plain_memory_unchanged_composition.1:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states, single-

ton(expr_2_super(q′)), addresses′)

{-2} ∀ (s: (pm′`states)): OK?(q′(s)) ⊃ P′(data(q′(s)))
{-3} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(r′(d))),

addresses′)

{-4} plain_memory?(pm′)
{-5} (addresses′ ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} transformers_ok?(pm′`states, memory_read_transformers(pm′`mem, addresses′))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, single-

ton(expr_2_super(q′ ## r′)), addresses′)

Keeping (-4 -5 1) and hiding *,

Using lemma plain_memory_transformers_ok_read_ro_rw,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using transformers_ok_mono_transformers, matching in * where states gets pm!1‘states, transformers_1 gets memory_read_transformers(pm!1‘mem, addresses!1), transformers_2 gets memory_read_transformers(pm!1‘mem, union(pm!1‘ro_addr, pm!1‘rw_addr)),

Rewriting using memory_read_transformers_mono, matching in *,

This completes the proof of plain_memory_unchanged_composition.1.

C.174 Proofs for Plain_Mem_Rewrites (plain_memory_rewrites.pvs)

plain_memory_unchanged_composition.2:

{-1} unchanged_memory_invariant?(pm′`mem, pm′`states, single-

ton(expr_2_super(q′)), addresses′)

{-2} ∀ (s: (pm′`states)): OK?(q′(s)) ⊃ P′(data(q′(s)))
{-3} ∀ (d: (P′)):

unchanged_memory_invariant?(pm′`mem, pm′`states, singleton(expr_2_super(r′(d))),

addresses′)

{-4} plain_memory?(pm′)
{-5} (addresses′ ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} singleton(expr_2_super(q′))(expr_2_super(q′))

{2} unchanged_memory_invariant?(pm′`mem, pm′`states, single-

ton(expr_2_super(q′ ## r′)), addresses′)

Expanding the definition of singleton, which is trivially true.

This completes the proof of plain_memory_unchanged_composition.2.

Q.E.D.

C.174 Proofs for Plain_Mem_Rewrites (plain_memory_rewrites.pvs)

This theory contains no provable formal statements.

C.175 Proofs for Plain_Mem_Rewrites1 (plain_memory_rewrites.pvs)

C.175.1 Plain_Mem_Rewrites1.pm_q_prop_TCC1

Terse proof for pm_q_prop_TCC1.
pm_q_prop_TCC1:

{1} ∀ (res: StmtResult[State]):

OK?(res) ⊃ OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_q_prop_TCC1. Q.E.D.

C.175.2 Plain_Mem_Rewrites1.pm_q_prop_ok_stmt

Terse proof for pm_q_prop_ok_stmt.

pm_q_prop_ok_stmt:

{1} ∀ (pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]): plain_memory?(pm) ∧ pm_q_prop(pm)(q(s)) ⊃ OK?(q(s))

Expanding the definition of pm_q_prop, Repeatedly Skolemizing and flattening, This completes the proof of pm_q_prop_ok_stmt. Q.E.D.

C.176 Proofs for Plain_Mem_Rewrites2 (plain_memory_rewrites.pvs)

C.176.1 Plain_Mem_Rewrites2.in_blessed_memory_rw_ro

Terse proof for in_blessed_memory_rw_ro.
in_blessed_memory_rw_ro:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State]): in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr))

Repeatedly Skolemizing and flattening, Expanding the definition of in_blessed_memory?, Rewriting using subset_bigger_union_right, matching in *, This completes the proof of in_blessed_memory_rw_ro. Q.E.D.

C.176.2 Plain_Mem_Rewrites2.pm_q_prop_TCC1

Terse proof for pm_q_prop_TCC1.
pm_q_prop_TCC1:

{1} ∀ (res: ExprResult[State, Data]):

OK?(res) ⊃ OK?[State, Data](res) ∨ Exception?[State, Data](res)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_q_prop_TCC1. Q.E.D.

C.176.3 Plain_Mem_Rewrites2.pm_q_prop_ok_expr

Terse proof for pm_q_prop_ok_expr.
pm_q_prop_ok_expr:

{1} ∀ (pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data]]): plain_memory?(pm) ∧ pm_q_prop(pm)(q(s)) ⊃ OK?(q(s))

Expanding the definition of pm_q_prop, Repeatedly Skolemizing and flattening, This completes the proof of pm_q_prop_ok_expr. Q.E.D.

C.176.4 Plain_Mem_Rewrites2.pm_q_prop_single_read

Terse proof for pm_q_prop_single_read.
pm_q_prop_single_read:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ valid_in_mem(pm, dt)(addr)(s)

⊃ pm_q_prop(pm)(read_data(pm, dt)(addr)(s))

Expanding the definition of pm_q_prop, Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformer_invariant_read_data[State, Data], Using lemma expr_transformer_invariant_next_ok[State, Data], Using lemma plain_memory_read_data_ok[State, Data], Expanding the definition of has_next_state, Expanding the definition of singleton, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_q_prop_single_read. Q.E.D.

C.176.5 Plain_Mem_Rewrites2.pm_q_prop_ok_result_single

Terse proof for pm_q_prop_ok_result_single.
pm_q_prop_ok_result_single:

{1} ∀ (data: Data, pm: Plain_Memory[State], s: State):

pm`states(s) ⊃ pm_q_prop(pm)(ok_result(data)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_ok_result_single.

Q.E.D.

C.176.6 Plain_Mem_Rewrites2.plain_memory_write_ok_single

Terse proof for plain_memory_write_ok_single.
plain_memory_write_ok_single:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ⊃ OK?(write_data(pm, dt)(addr, data)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_write_data_ok, matching in *,

This completes the proof of plain_memory_write_ok_single.

Q.E.D.

C.176.7 Plain_Mem_Rewrites2.pm_q_prop_read_TCC1

Terse proof for pm_q_prop_read_TCC1.
pm_q_prop_read_TCC1:

{1} ∀ (dt: (interpreted_data_type?[Data]), res: StmtResult[State]):

OK?(res) ⊃

OK?[State](res) ∨ Break?[State](res) ∨ Continue?[State](res) ∨ Return?[State](res) ∨ Switch?[State](res) ∨ Default?[State](res) ∨ Exception?[State](res)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_q_prop_read_TCC1. Q.E.D.

C.177 Proofs for Plain_Mem_Rewrites3 (plain_memory_rewrites.pvs)

C.177.1 Plain_Mem_Rewrites3.pm_q_prop_read_TCC1

Terse proof for pm_q_prop_read_TCC1.
pm_q_prop_read_TCC1:

{1} ∀ (dt: (interpreted_data_type?[Data]), res: ExprResult[State, Data_q]):

OK?(res) ⊃ OK?[State, Data_q](res) ∨ Exception?[State, Data_q](res)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_q_prop_read_TCC1. Q.E.D.

C.178 Proofs for Plain_Mem_Rewrites4 (plain_memory_rewrites.pvs)

C.178.1 Plain_Mem_Rewrites4.plain_memory_write_ok_q_expr

Terse proof for plain_memory_write_ok_q_expr.
plain_memory_write_ok_q_expr:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State, q: [State → ExprResult[State, Data_q]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm_q_prop(pm)(q(s)) ⊃ OK?((q ## write_data(pm, dt)(addr, data))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of ##, Expanding the definition of pm_q_prop, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using plain_memory_write_data_ok, matching in *,

This completes the proof of plain_memory_write_ok_q_expr.

Q.E.D.

C.178.2 Plain_Mem_Rewrites4.pm_q_prop_read_ok_expr

Terse proof for pm_q_prop_read_ok_expr.
pm_q_prop_read_ok_expr:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → ExprResult[State, Data_q]]): plain_memory?(pm) ∧ pm_q_prop_read(pm, dt, addr)(q(s)) ⊃ OK?((q ## read_data(pm, dt)(addr))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Expanding the definition of ##, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_q_prop_read_ok_expr. Q.E.D.

C.178.3 Plain_Mem_Rewrites4.pm_q_prop_read_pm_q_prop_expr

Terse proof for pm_q_prop_read_pm_q_prop_expr.
pm_q_prop_read_pm_q_prop_expr:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → ExprResult[State, Data_q]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt, addr)(q(s)) ⊃ pm_q_prop(pm)((q ## read_data(pm, dt)(addr))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of ##, Expanding the definition of pm_q_prop, Expanding the definition of pm_q_prop_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_transformer_invariant_read_data[State, Data], Using lemma expr_transformer_invariant_next_ok[State, Data], Expanding the definition of has_next_state, Expanding the definition of singleton, which is trivially true.

This completes the proof of pm_q_prop_read_pm_q_prop_expr.

Q.E.D.

C.178.4 Plain_Mem_Rewrites4.pm_q_prop_read_write_q_expr

Terse proof for pm_q_prop_read_write_q_expr.
pm_q_prop_read_write_q_expr:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State, q: [State → ExprResult[State, Data_q]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm_q_prop(pm)(q(s)) ⊃ pm_q_prop_read(pm, dt, addr)((q ## write_data(pm, dt)(addr, data))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of ##, Expanding the definition of pm_q_prop, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pm_q_prop_read, Using lemma plain_memory_write_data_ok[State, Data], Using lemma plain_memory_transformer_invariant_write_data[State, Data], Using lemma expr_transformer_invariant_next_ok, Expanding the definition of singleton, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_read_write_ok[State, Data], Expanding the definition of ##, Expanding the definition of ##, which is trivially true.

This completes the proof of pm_q_prop_read_write_q_expr.

Q.E.D.

C.178.5 Plain_Mem_Rewrites4.pm_q_prop_ok_result_q_expr

Terse proof for pm_q_prop_ok_result_q_expr.
pm_q_prop_ok_result_q_expr:

{1} ∀ (data: Data, pm: Plain_Memory[State], s: State,

q: [State → ExprResult[State, Data_q]]): plain_memory?(pm) ∧ pm_q_prop(pm)(q(s)) ⊃ pm_q_prop(pm)((q ## ok_result[State, Data](data))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_ok_result_q_expr.

Q.E.D.

C.178.6 Plain_Mem_Rewrites4.pm_q_prop_read_ok_result_single

Terse proof for pm_q_prop_read_ok_result_single.

pm_q_prop_read_ok_result_single:

{1} ∀ (addr: Address, data_q: Data_q, dt: (interpreted_data_type?[Data]),

pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ valid_in_mem(pm, dt)(addr)(s)

⊃ pm_q_prop_read(pm, dt, addr)(ok_result[State, Data_q](data_q)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Using lemma pm_q_prop_ok_result_single[State, Data_q], Expanding the definition of pm_q_prop, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using plain_memory_read_data_ok, matching in *, Rewriting using ok_result_state, matching in *,

This completes the proof of pm_q_prop_read_ok_result_single.

Q.E.D.

C.178.7 Plain_Mem_Rewrites4.plain_memory_read_write_q_data_expr_TCC1

Terse proof for plain_memory_read_write_q_data_expr_TCC1.
plain_memory_read_write_q_data_expr_TCC1:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State, q: [State → ExprResult[State, Data_q]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm_q_prop(pm)(q(s)) ⊃ OK?[State, Data]

((##[State, Unit, Data]

(##[State, Data_q, Unit]

(q, write_data[State, Data](pm, dt)(addr, data)), read_data[State, Data](pm, dt)(addr)))

(s))

Repeatedly Skolemizing and flattening, Using lemma pm_q_prop_read_write_q_expr, Expanding the definition of pm_q_prop_read, Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_q_data_expr_TCC1.

Q.E.D.

C.178.8 Plain_Mem_Rewrites4.plain_memory_read_write_q_data_expr

Terse proof for plain_memory_read_write_q_data_expr.

plain_memory_read_write_q_data_expr:

{1} ∀ (addr: Address, data1: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State, q: [State → ExprResult[State, Data_q]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm_q_prop(pm)(q(s)) ⊃ data((q ## write_data(pm, dt)(addr, data1) ## read_data(pm, dt)(addr))(s)) = data1

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: (( ##!!)) Expanding the definition of pm_q_prop, Using lemma plain_memory_read_write_res[State, Data], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_q_data_expr.

Q.E.D.

C.178.9 Plain_Mem_Rewrites4.pm_q_prop_read_write_other_single

Terse proof for pm_q_prop_read_write_other_single.
pm_q_prop_read_write_other_single:

{1} ∀ (addr1, addr2: Address, data: Data, dt1: (interpreted_data_type?[Data]), dt2: (interpreted_data_type?[Data_q]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ valid_in_mem(pm, dt2)(addr2)(s) ∧ pm`states(s) ⊃ pm_q_prop_read(pm, dt2, addr2)(write_data(pm, dt1)(addr1, data)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Using lemma plain_memory_write_data_ok[State, Data], Using lemma plain_memory_read_write_other_ok[State, Data, Data_q], Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_transformer_invariant_write_data[State, Data], Using lemma expr_transformer_invariant_next_ok, Expanding the definition of singleton, Expanding the definition of has_next_state, which is trivially true.

This completes the proof of pm_q_prop_read_write_other_single.

Q.E.D.

C.178.10 Plain_Mem_Rewrites4.pm_q_prop_read_read_single

Terse proof for pm_q_prop_read_read_single.

pm_q_prop_read_read_single:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data]), dt2: (interpreted_data_type?[Data_q]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ valid_in_mem(pm, dt1)(addr1)(s) ∧ valid_in_mem(pm, dt2)(addr2)(s) ∧ pm`states(s) ⊃ pm_q_prop_read(pm, dt2, addr2)(read_data(pm, dt1)(addr1)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Using lemma pm_q_prop_single_read[State, Data], Expanding the definition of pm_q_prop, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_read_read_ok[State, Data, Data_q], Installing automatic rewrites from: ## Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pm_q_prop_read_read_single.

Q.E.D.

C.179 Proofs for Plain_Mem_Rewrites5 (plain_memory_rewrites.pvs)

C.179.1 Plain_Mem_Rewrites5.plain_memory_write_ok_q_stmt

Terse proof for plain_memory_write_ok_q_stmt.
plain_memory_write_ok_q_stmt:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State, q: [State → StmtResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm_q_prop(pm)(q(s)) ⊃ OK?((q ## write_data(pm, dt)(addr, data))(s))

Installing automatic rewrites from: ## Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pm_q_prop, Expanding the definition of lift, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Rewriting using plain_memory_write_data_ok, matching in *,

This completes the proof of plain_memory_write_ok_q_stmt.

Q.E.D.

C.179.2 Plain_Mem_Rewrites5.pm_q_prop_read_ok_stmt

Terse proof for pm_q_prop_read_ok_stmt.

pm_q_prop_read_ok_stmt:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → StmtResult[State]]): plain_memory?(pm) ∧ pm_q_prop_read(pm, dt, addr)(q(s)) ⊃ OK?((q ## read_data(pm, dt)(addr))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of lift, Expanding the definition of pm_q_prop_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_q_prop_read_ok_stmt. Q.E.D.

C.179.3 Plain_Mem_Rewrites5.pm_q_prop_read_pm_q_prop_stmt

Terse proof for pm_q_prop_read_pm_q_prop_stmt.
pm_q_prop_read_pm_q_prop_stmt:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State,

q: [State → StmtResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt, addr)(q(s)) ⊃ pm_q_prop(pm)((q ## read_data(pm, dt)(addr))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of pm_q_prop, Expanding the definition of pm_q_prop_read, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

pm_q_prop_read_pm_q_prop_stmt.1:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} OK?(q′(s′))
{-5} OK?(read_data(pm′, dt′)(addr′)(state(q′(s′))))
{-6} pm′`states(state(q′(s′)))
{1} pm′`states(state(lift(read_data(pm′, dt′)(addr′))(q′(s′))))

Using lemma plain_memory_transformer_invariant_read_data[State, Data], Using lemma expr_transformer_invariant_next_ok[State, Data], Expanding the definition of has_next_state, Expanding the definition of singleton, Expanding the definition of lift, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pm_q_prop_read_pm_q_prop_stmt.1.

pm_q_prop_read_pm_q_prop_stmt.2:

{-1} interpreted_data_type?[Data](dt′)
{-2} plain_memory?(pm′)
{-3} in_blessed_memory?(dt′, addr′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} OK?(q′(s′))
{-5} OK?(read_data(pm′, dt′)(addr′)(state(q′(s′))))
{-6} pm′`states(state(q′(s′)))
{1} OK?(lift(read_data(pm′, dt′)(addr′))(q′(s′)))

Expanding the definition of lift, which is trivially true.

This completes the proof of pm_q_prop_read_pm_q_prop_stmt.2.

Q.E.D.

C.179.4 Plain_Mem_Rewrites5.pm_q_prop_read_write_q_stmt

Terse proof for pm_q_prop_read_write_q_stmt.
pm_q_prop_read_write_q_stmt:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State, q: [State → StmtResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm_q_prop(pm)(q(s)) ⊃ pm_q_prop_read(pm, dt, addr)((q ## write_data(pm, dt)(addr, data))(s))

Installing automatic rewrites from: ## Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of lift, Expanding the definition of pm_q_prop, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pm_q_prop_read, Using lemma plain_memory_write_data_ok[State, Data], Using lemma plain_memory_transformer_invariant_write_data[State, Data], Using lemma expr_transformer_invariant_next_ok, Expanding the definition of singleton, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma plain_memory_read_write_ok[State, Data], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pm_q_prop_read_write_q_stmt.

Q.E.D.

C.179.5 Plain_Mem_Rewrites5.pm_q_prop_ok_result_q_stmt

Terse proof for pm_q_prop_ok_result_q_stmt.
pm_q_prop_ok_result_q_stmt:

{1} ∀ (data: Data, pm: Plain_Memory[State], s: State, q: [State → StmtRe-

sult[State]]): plain_memory?(pm) ∧ pm_q_prop(pm)(q(s)) ⊃ pm_q_prop(pm)((q ## ok_result[State, Data](data))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_ok_result_q_stmt.

Q.E.D.

C.179.6 Plain_Mem_Rewrites5.plain_memory_read_write_q_data_stmt_TCC1

Terse proof for plain_memory_read_write_q_data_stmt_TCC1.
plain_memory_read_write_q_data_stmt_TCC1:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State, q: [State → StmtResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm_q_prop(pm)(q(s)) ⊃ OK?[State, Data]

((##[State, Unit, Data]

(##[State, Unit](q, write_data[State, Data](pm, dt)(addr, data)),

read_data[State, Data](pm, dt)(addr))) (s))

Repeatedly Skolemizing and flattening, Using lemma pm_q_prop_read_write_q_stmt, Expanding the definition of pm_q_prop_read, Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_q_data_stmt_TCC1.

Q.E.D.

C.179.7 Plain_Mem_Rewrites5.plain_memory_read_write_q_data_stmt

Terse proof for plain_memory_read_write_q_data_stmt.
plain_memory_read_write_q_data_stmt:

{1} ∀ (addr: Address, data1: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State, q: [State → StmtResult[State]]): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm_q_prop(pm)(q(s)) ⊃ data((q ## write_data(pm, dt)(addr, data1) ## read_data(pm, dt)(addr))(s)) = data1

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: (( ##!!)) Expanding the definition of pm_q_prop, Using lemma plain_memory_read_write_res[State, Data], Installing automatic rewrites from: lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_q_data_stmt.

Q.E.D.

C.179.8 Plain_Mem_Rewrites5.pm_q_prop_single_write

Terse proof for pm_q_prop_single_write.
pm_q_prop_single_write:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm`states(s) ⊃ pm_q_prop(pm)(write_data(pm, dt)(addr, data)(s))

Expanding the definition of pm_q_prop, Repeatedly Skolemizing and flattening, Using lemma plain_memory_write_data_ok[State, Data], Using lemma plain_memory_transformer_invariant_write_data[State, Data], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma expr_transformer_invariant_next_ok, Expanding the definition of singleton, Expanding the definition of has_next_state, which is trivially true. This completes the proof of pm_q_prop_single_write. Q.E.D.

C.179.9 Plain_Mem_Rewrites5.pm_q_prop_read_write_single

Terse proof for pm_q_prop_read_write_single.
pm_q_prop_read_write_single:

{1} ∀ (addr: Address, data: Data, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State],

s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt, addr, pm`rw_addr) ∧ pm`states(s) ⊃ pm_q_prop_read(pm, dt, addr)(write_data(pm, dt)(addr, data)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Using lemma pm_q_prop_single_write, Using lemma plain_memory_read_write_ok[State, Data], Expanding the definition of pm_q_prop, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ##, Expanding the definition of ##, which is trivially true.

This completes the proof of pm_q_prop_read_write_single.

Q.E.D.

C.179.10 Plain_Mem_Rewrites5.pm_q_prop_e2s

Terse proof for pm_q_prop_e2s.

pm_q_prop_e2s:

{1} ∀ (expr: [State → ExprResult[State, Data]], pm: Plain_Memory[State], s: State): pm_q_prop(pm)(e2s(expr)(s)) = pm_q_prop(pm)(expr(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_q_prop_e2s. Q.E.D.

C.179.11 Plain_Mem_Rewrites5.pm_q_prop_stmt_e2s

Terse proof for pm_q_prop_stmt_e2s.
pm_q_prop_stmt_e2s:

{1} ∀ (expr: [State → ExprResult[State, Data]], pm: Plain_Memory[State], s: State, stmt: [State → StmtResult[State]]): pm_q_prop(pm)(stmt(s)) ⊃ pm_q_prop(pm)((stmt ## e2s(expr))(s)) = pm_q_prop(pm)((stmt ## expr)(s))

Expanding the definition of pm_q_prop, Repeatedly Skolemizing and flattening, Using lemma pm_q_prop_e2s, Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of pm_q_prop_stmt_e2s. Q.E.D.

C.180 Proofs for Plain_Mem_Rewrites6 (plain_memory_rewrites.pvs)

C.180.1 Plain_Mem_Rewrites6.pm_q_prop_read_write_other_q_expr

Terse proof for pm_q_prop_read_write_other_q_expr.
pm_q_prop_read_write_other_q_expr:

{1} ∀ (addr1, addr2: Address, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data_q]]):

plain_memory?(pm) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃ pm_q_prop_read(pm, dt1, addr1)((q ## write_data(pm, dt2)(addr2, data2))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Using lemma pm_q_prop_single_write[State, Data2], Expanding the definition of pm_q_prop, Using lemma plain_memory_read_write_other_ok[State, Data2, Data1], Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

pm_q_prop_read_write_other_q_expr.1:

{-1} plain_memory?(pm′)
{-2} pm′`states(state(q′(s′)))
{-3} in_blessed_memory?(dt2′, addr2′, pm′`rw_addr)
{-4} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} OK?(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′))))
{-6} pm′`states(state(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′)))))
{-7} interpreted_data_type?[Data1](dt1′)
{-8} interpreted_data_type?[Data2](dt2′)
{-9} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-10} OK?(q′(s′))
{-11} OK?(read_data(pm′, dt1′)(addr1′)(state(q′(s′))))
{1} valid_in_mem(pm′, dt1′)(addr1′)(state(q′(s′)))

{2} OK?(read_data(pm′, dt1′)(addr1′)

(state(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′))))))

Expanding the definition of valid_in_mem, Expanding the definition of read_data, Rewriting using read_data_valid_in_mem, matching in *,

This completes the proof of pm_q_prop_read_write_other_q_expr.1.
pm_q_prop_read_write_other_q_expr.2:

{-1} plain_memory?(pm′)
{-2} pm′`states(state(q′(s′)))
{-3} in_blessed_memory?(dt2′, addr2′, pm′`rw_addr)
{-4} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} OK?(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′))))
{-6} pm′`states(state(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′)))))
{-7} interpreted_data_type?[Data1](dt1′)
{-8} interpreted_data_type?[Data2](dt2′)
{-9} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-10} OK?(q′(s′))
{-11} OK?(read_data(pm′, dt1′)(addr1′)(state(q′(s′))))
{1} blocks_disjoint?(addr2′, size(uidt(dt2′)), addr1′, size(uidt(dt1′)))

{2} OK?(read_data(pm′, dt1′)(addr1′)

(state(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′))))))

Keeping (-9 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_read_write_other_q_expr.2.

Q.E.D.

C.180.2 Plain_Mem_Rewrites6.pm_q_prop_read_read_q_expr

Terse proof for pm_q_prop_read_read_q_expr.

pm_q_prop_read_read_q_expr:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data_q]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s)) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s))

⊃ pm_q_prop_read(pm, dt2, addr2)((q ## read_data(pm, dt1)(addr1))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Applying disjunctive simplification to flatten sequent, Using lemma pm_q_prop_read_read_single[State, Data1, Data2], Expanding the definition of read_data, Expanding the definition of valid_in_mem, Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

pm_q_prop_read_read_q_expr.1:

{-1} plain_memory?(pm′)
{-2} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} pm′`states(state(q′(s′)))
{-5} interpreted_data_type?[Data1](dt1′)
{-6} interpreted_data_type?[Data2](dt2′)
{-7} OK?(q′(s′))
{-8} OK?(read_data(pm′`mem, dt1′)(addr1′)(state(q′(s′))))
{-9} OK?(read_data(pm′`mem, dt2′)(addr2′)(state(q′(s′))))
{1} valid_in_mem(pm′`mem, dt2′)(addr2′)(state(q′(s′)))

{2} pm_q_prop_read(pm′, dt2′, addr2′)

(read_data(pm′`mem, dt1′)(addr1′)(state(q′(s′))))

Rewriting using read_data_valid_in_mem, matching in *,

This completes the proof of pm_q_prop_read_read_q_expr.1.
pm_q_prop_read_read_q_expr.2:

{-1} plain_memory?(pm′)
{-2} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-3} in_blessed_memory?(dt2′, addr2′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-4} pm′`states(state(q′(s′)))
{-5} interpreted_data_type?[Data1](dt1′)
{-6} interpreted_data_type?[Data2](dt2′)
{-7} OK?(q′(s′))
{-8} OK?(read_data(pm′`mem, dt1′)(addr1′)(state(q′(s′))))
{-9} OK?(read_data(pm′`mem, dt2′)(addr2′)(state(q′(s′))))
{1} valid_in_mem(pm′`mem, dt1′)(addr1′)(state(q′(s′)))

{2} pm_q_prop_read(pm′, dt2′, addr2′)

(read_data(pm′`mem, dt1′)(addr1′)(state(q′(s′))))

Rewriting using read_data_valid_in_mem, matching in *,

This completes the proof of pm_q_prop_read_read_q_expr.2.

Q.E.D.

C.180.3 Plain_Mem_Rewrites6.pm_q_prop_read_ok_result_q_expr

Terse proof for pm_q_prop_read_ok_result_q_expr.
pm_q_prop_read_ok_result_q_expr:

{1} ∀ (addr2: Address, data1: Data1, dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprRe-

sult[State, Data_q]]): plain_memory?(pm) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s)) ⊃ pm_q_prop_read(pm, dt2, addr2)((q ## ok_result[State, Data1](data1))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_read_ok_result_q_expr.

Q.E.D.

C.180.4 Plain_Mem_Rewrites6.plain_memory_read_read_q_data_expr_TCC1

Terse proof for plain_memory_read_read_q_data_expr_TCC1.
plain_memory_read_read_q_data_expr_TCC1:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data_q]]):

plain_memory?(pm) ∧

in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

OK?[State, Data1]

((##[State, Data2, Data1]

(##[State, Data_q, Data2](q, read_data[State, Data2](pm, dt2)(addr2)),

read_data[State, Data1](pm, dt1)(addr1))) (s))

Expanding the definition of pm_q_prop_read, Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_read_ok[State, Data2, Data1], Installing automatic rewrites from: ## lift Installing automatic rewrites from: valid_in_mem read_data read_data_valid_in_mem Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_read_q_data_expr_TCC1.

Q.E.D.

C.180.5 Plain_Mem_Rewrites6.plain_memory_read_read_q_data_expr_TCC2

Terse proof for plain_memory_read_read_q_data_expr_TCC2.

plain_memory_read_read_q_data_expr_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data_q]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

OK?[State, Data1] ((##[State, Data_q, Data1](q, read_data[State, Data1](pm, dt1)(addr1)))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_read_read_q_data_expr_TCC2.

Q.E.D.

C.180.6 Plain_Mem_Rewrites6.plain_memory_read_read_q_data_expr

Terse proof for plain_memory_read_read_q_data_expr.
plain_memory_read_read_q_data_expr:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data_q]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

data((q ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1))(s)) = data((q ## read_data(pm, dt1)(addr1))(s))

Expanding the definition of pm_q_prop_read, Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_read[State, Data2, Data1], Installing automatic rewrites from: ## lift valid_in_mem read_data read_data_valid_in_mem Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_read_q_data_expr.

Q.E.D.

C.181 Proofs for Plain_Mem_Rewrites7 (plain_memory_rewrites.pvs)

C.181.1 Plain_Mem_Rewrites7.pm_q_prop_read_write_other_q_stmt

Terse proof for pm_q_prop_read_write_other_q_stmt.

pm_q_prop_read_write_other_q_stmt:

{1} ∀ (addr1, addr2: Address, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]):

plain_memory?(pm) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃ pm_q_prop_read(pm, dt1, addr1)((q ## write_data(pm, dt2)(addr2, data2))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Using lemma pm_q_prop_single_write[State, Data2], Expanding the definition of pm_q_prop, Using lemma plain_memory_read_write_other_ok[State, Data2, Data1], Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

pm_q_prop_read_write_other_q_stmt.1:

{-1} plain_memory?(pm′)
{-2} pm′`states(state(q′(s′)))
{-3} in_blessed_memory?(dt2′, addr2′, pm′`rw_addr)
{-4} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} OK?(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′))))
{-6} pm′`states(state(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′)))))
{-7} interpreted_data_type?[Data1](dt1′)
{-8} interpreted_data_type?[Data2](dt2′)
{-9} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-10} OK?(q′(s′))
{-11} OK?(read_data(pm′, dt1′)(addr1′)(state(q′(s′))))
{1} valid_in_mem(pm′, dt1′)(addr1′)(state(q′(s′)))

{2} OK?(read_data(pm′, dt1′)(addr1′)

(state(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′))))))

Expanding the definition of valid_in_mem, Expanding the definition of read_data, Rewriting using read_data_valid_in_mem, matching in *,

This completes the proof of pm_q_prop_read_write_other_q_stmt.1.

pm_q_prop_read_write_other_q_stmt.2:

{-1} plain_memory?(pm′)
{-2} pm′`states(state(q′(s′)))
{-3} in_blessed_memory?(dt2′, addr2′, pm′`rw_addr)
{-4} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} OK?(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′))))
{-6} pm′`states(state(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′)))))
{-7} interpreted_data_type?[Data1](dt1′)
{-8} interpreted_data_type?[Data2](dt2′)
{-9} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-10} OK?(q′(s′))
{-11} OK?(read_data(pm′, dt1′)(addr1′)(state(q′(s′))))
{1} blocks_disjoint?(addr2′, size(uidt(dt2′)), addr1′, size(uidt(dt1′)))

{2} OK?(read_data(pm′, dt1′)(addr1′)

(state(write_data(pm′, dt2′)(addr2′, data2′)(state(q′(s′))))))

Keeping (-9 1) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_read_write_other_q_stmt.2.

Q.E.D.

C.181.2 Plain_Mem_Rewrites7.plain_memory_read_write_other_single_data_TCC1

Terse proof for plain_memory_read_write_other_single_data_TCC1.
plain_memory_read_write_other_single_data_TCC1:

{1} ∀ (addr1, addr2: Address, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): pm`states(s) ∧ pm_q_prop(pm)(read_data(pm, dt1)(addr1)(s)) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ plain_memory?(pm)

⊃

OK?[State, Data1]

((##[State, Unit, Data1]

(write_data[State, Data2](pm, dt2)(addr2, data2), read_data[State, Data1](pm, dt1)(addr1)))

(s))

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_read_write_other_ok[State, Data2, Data1], matching in *,

we get 2 subgoals:

plain_memory_read_write_other_single_data_TCC1.1:

{-1} interpreted_data_type?[Data1](dt1′)
{-2} interpreted_data_type?[Data2](dt2′)
{-3} pm′`states(s′)
{-4} pm_q_prop(pm′)(read_data(pm′, dt1′)(addr1′)(s′))
{-5} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-6} in_blessed_memory?(dt2′, addr2′, pm′`rw_addr)
{-7} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} plain_memory?(pm′)
{1} blocks_disjoint?(addr2′, size(uidt(dt2′)), addr1′, size(uidt(dt1′)))

{2} OK?[State, Data1]

((##[State, Unit, Data1]

(write_data[State, Data2](pm′, dt2′)(addr2′, data2′), read_data[State, Data1](pm′, dt1′)(addr1′)))

(s′))

Keeping (-5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_read_write_other_single_data_TCC1.1.
plain_memory_read_write_other_single_data_TCC1.2:

{-1} interpreted_data_type?[Data1](dt1′)
{-2} interpreted_data_type?[Data2](dt2′)
{-3} pm′`states(s′)
{-4} pm_q_prop(pm′)(read_data(pm′, dt1′)(addr1′)(s′))
{-5} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))
{-6} in_blessed_memory?(dt2′, addr2′, pm′`rw_addr)
{-7} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-8} plain_memory?(pm′)
{1} valid_in_mem(pm′, dt1′)(addr1′)(s′)

{2} OK?[State, Data1]

((##[State, Unit, Data1]

(write_data[State, Data2](pm′, dt2′)(addr2′, data2′), read_data[State, Data1](pm′, dt1′)(addr1′)))

(s′))

Keeping (-4 1) and hiding *, Expanding the definition of pm_q_prop, Installing automatic rewrites from: read_data valid_in_mem read_data_valid_in_mem Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_other_single_data_TCC1.2.

Q.E.D.

C.181.3 Plain_Mem_Rewrites7.plain_memory_read_write_other_single_data_TCC2

Terse proof for plain_memory_read_write_other_single_data_TCC2.

plain_memory_read_write_other_single_data_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): pm`states(s) ∧ pm_q_prop(pm)(read_data(pm, dt1)(addr1)(s)) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ plain_memory?(pm)

⊃ OK?[State, Data1](read_data[State, Data1](pm, dt1)(addr1)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_read_write_other_single_data_TCC2.

Q.E.D.

C.181.4 Plain_Mem_Rewrites7.plain_memory_read_write_other_single_data

Terse proof for plain_memory_read_write_other_single_data.
plain_memory_read_write_other_single_data:

{1} ∀ (addr1, addr2: Address, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ pm_q_prop(pm)(read_data(pm, dt1)(addr1)(s)) ∧ pm`states(s) ⊃ data((write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1))(s)) = data(read_data(pm, dt1)(addr1)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop, Rewriting using plain_memory_read_write_other_res, matching in *, we get 2 subgoals:

plain_memory_read_write_other_single_data.1:

{-1} interpreted_data_type?[Data1](dt1′)
{-2} interpreted_data_type?[Data2](dt2′)
{-3} plain_memory?(pm′)
{-4} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} in_blessed_memory?(dt2′, addr2′, pm′`rw_addr)
{-6} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))

{-7} OK?(read_data(pm′, dt1′)(addr1′)(s′)) ∧

pm′`states(state(read_data(pm′, dt1′)(addr1′)(s′)))

{-8} pm′`states(s′)
{1} blocks_disjoint?(addr2′, size(uidt(dt2′)), addr1′, size(uidt(dt1′)))

{2} data((write_data(pm′, dt2′)(addr2′, data2′) ## read_data(pm′, dt1′)(addr1′))

(s′))

= data(read_data(pm′, dt1′)(addr1′)(s′))

Keeping (-6 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_read_write_other_single_data.1.
plain_memory_read_write_other_single_data.2:

{-1} interpreted_data_type?[Data1](dt1′)
{-2} interpreted_data_type?[Data2](dt2′)
{-3} plain_memory?(pm′)
{-4} in_blessed_memory?(dt1′, addr1′, (pm′‘ro_addr∪ pm′‘rw_addr))
{-5} in_blessed_memory?(dt2′, addr2′, pm′`rw_addr)
{-6} blocks_disjoint?(addr1′, size(uidt(dt1′)), addr2′, size(uidt(dt2′)))

{-7} OK?(read_data(pm′, dt1′)(addr1′)(s′)) ∧

pm′`states(state(read_data(pm′, dt1′)(addr1′)(s′)))

{-8} pm′`states(s′)
{1} valid_in_mem(pm′, dt1′)(addr1′)(s′)

{2} data((write_data(pm′, dt2′)(addr2′, data2′) ## read_data(pm′, dt1′)(addr1′))

(s′))

= data(read_data(pm′, dt1′)(addr1′)(s′))

Expanding the definition of valid_in_mem, Expanding the definition of read_data, Rewriting using read_data_valid_in_mem, matching in *,

This completes the proof of plain_memory_read_write_other_single_data.2.

Q.E.D.

C.181.5 Plain_Mem_Rewrites7.pm_q_prop_read_read_q_stmt

Terse proof for pm_q_prop_read_read_q_stmt.
pm_q_prop_read_read_q_stmt:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s)) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s))

⊃ pm_q_prop_read(pm, dt2, addr2)((q ## read_data(pm, dt1)(addr1))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Applying disjunctive simplification to flatten sequent, Using lemma pm_q_prop_read_read_single[State, Data1, Data2], Installing automatic rewrites from: ## lift read_data valid_in_mem read_data_valid_in_mem Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of pm_q_prop_read_read_q_stmt.

Q.E.D.

C.181.6 Plain_Mem_Rewrites7.pm_q_prop_read_ok_result_q_stmt

Terse proof for pm_q_prop_read_ok_result_q_stmt.

pm_q_prop_read_ok_result_q_stmt:

{1} ∀ (addr2: Address, data1: Data1, dt2: (interpreted_data_type?[Data2]),

pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]): plain_memory?(pm) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s)) ⊃ pm_q_prop_read(pm, dt2, addr2)((q ## ok_result[State, Data1](data1))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_read_ok_result_q_stmt.

Q.E.D.

C.181.7 Plain_Mem_Rewrites7.plain_memory_read_write_other_q_data_stmt_TCC1

Terse proof for plain_memory_read_write_other_q_data_stmt_TCC1.
plain_memory_read_write_other_q_data_stmt_TCC1:

{1} ∀ (addr1, addr2: Address, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]):

plain_memory?(pm) ∧

in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧

in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

OK?[State, Data1]

((##[State, Unit, Data1]

(##[State, Unit](q, write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data1](pm, dt1)(addr1))) (s))

Repeatedly Skolemizing and flattening, Using lemma pm_q_prop_read_write_other_q_stmt, Expanding the definition of pm_q_prop_read, Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_other_q_data_stmt_TCC1.

Q.E.D.

C.181.8 Plain_Mem_Rewrites7.plain_memory_read_write_other_q_data_stmt_TCC2

Terse proof for plain_memory_read_write_other_q_data_stmt_TCC2.

plain_memory_read_write_other_q_data_stmt_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

OK?[State, Data1] ((##[State, Data1](q, read_data[State, Data1](pm, dt1)(addr1)))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_read_write_other_q_data_stmt_TCC2.

Q.E.D.

C.181.9 Plain_Mem_Rewrites7.plain_memory_read_write_other_q_data_stmt

Terse proof for plain_memory_read_write_other_q_data_stmt.
plain_memory_read_write_other_q_data_stmt:

{1} ∀ (addr1, addr2: Address, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

data((q ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1))(s)) = data((q ## read_data(pm, dt1)(addr1))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Using lemma plain_memory_read_write_other_single_data, Using lemma pm_q_prop_single_read[State, Data1], Installing automatic rewrites from: valid_in_mem read_data read_data_valid_in_mem ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_other_q_data_stmt.

Q.E.D.

C.181.10 Plain_Mem_Rewrites7.plain_memory_read_read_q_data_stmt_TCC1

Terse proof for plain_memory_read_read_q_data_stmt_TCC1.

plain_memory_read_read_q_data_stmt_TCC1:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

OK?[State, Data1]

((##[State, Data2, Data1]

(##[State, Data2](q, read_data[State, Data2](pm, dt2)(addr2)),

read_data[State, Data1](pm, dt1)(addr1))) (s))

Expanding the definition of pm_q_prop_read, Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_read_ok[State, Data2, Data1], Installing automatic rewrites from: valid_in_mem read_data read_data_valid_in_mem ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_read_q_data_stmt_TCC1.

Q.E.D.

C.181.11 Plain_Mem_Rewrites7.plain_memory_read_read_q_data_stmt_TCC2

Terse proof for plain_memory_read_read_q_data_stmt_TCC2.
plain_memory_read_read_q_data_stmt_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

OK?[State, Data1] ((##[State, Data1](q, read_data[State, Data1](pm, dt1)(addr1)))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_read_read_q_data_stmt_TCC2.

Q.E.D.

C.181.12 Plain_Mem_Rewrites7.plain_memory_read_read_q_data_stmt

Terse proof for plain_memory_read_read_q_data_stmt.

plain_memory_read_read_q_data_stmt:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → StmtResult[State]]):

plain_memory?(pm) ∧

in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm_q_prop_read(pm, dt2, addr2)(q(s)) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

data((q ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1))(s)) = data((q ## read_data(pm, dt1)(addr1))(s))

Expanding the definition of pm_q_prop_read, Repeatedly Skolemizing and flattening, Using lemma plain_memory_read_read[State, Data2, Data1], Installing automatic rewrites from: ## lift valid_in_mem read_data read_data_valid_in_mem Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_read_q_data_stmt.

Q.E.D.

C.181.13 Plain_Mem_Rewrites7.pm_q_prop_read_e2s

Terse proof for pm_q_prop_read_e2s.
pm_q_prop_read_e2s:

{1} ∀ (addr1: Address, dt1: (interpreted_data_type?[Data1]),

expr1: [State → ExprResult[State, Data2]], pm: Plain_Memory[State], s: State): pm_q_prop_read(pm, dt1, addr1)(expr1(s)) ⊃ pm_q_prop_read(pm, dt1, addr1)(e2s(expr1)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_q_prop_read_e2s. Q.E.D.

C.181.14 Plain_Mem_Rewrites7.pm_q_prop_read_stmt_e2s

Terse proof for pm_q_prop_read_stmt_e2s.
pm_q_prop_read_stmt_e2s:

{1} ∀ (addr1: Address, dt1: (interpreted_data_type?[Data1]), expr1: [State → ExprResult[State, Data2]], pm: Plain_Memory[State], s: State, stmt: [State → StmtResult[State]]): pm_q_prop_read(pm, dt1, addr1)(stmt(s)) ⊃ pm_q_prop_read(pm, dt1, addr1)((stmt ## e2s(expr1))(s)) = pm_q_prop_read(pm, dt1, addr1)((stmt ## expr1)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of pm_q_prop_read_stmt_e2s. Q.E.D.

C.182 Proofs for Plain_Mem_Rewrites8 (plain_memory_rewrites.pvs)

C.182.1 Plain_Mem_Rewrites8.plain_memory_read_write_other_q_data_expr_TCC1

Terse proof for plain_memory_read_write_other_q_data_expr_TCC1.
plain_memory_read_write_other_q_data_expr_TCC1:

{1} ∀ (addr1, addr2: Address, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data_q]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

OK?[State, Data1]

((##[State, Unit, Data1]

(##[State, Data_q, Unit]

(q, write_data[State, Data2](pm, dt2)(addr2, data2)), read_data[State, Data1](pm, dt1)(addr1)))

(s))

Repeatedly Skolemizing and flattening, Using lemma pm_q_prop_read_write_other_q_expr[State, Data1, Data2, Data_q], Expanding the definition of pm_q_prop_read, Installing automatic rewrites from: ## lift Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_other_q_data_expr_TCC1.

Q.E.D.

C.182.2 Plain_Mem_Rewrites8.plain_memory_read_write_other_q_data_expr_TCC2

Terse proof for plain_memory_read_write_other_q_data_expr_TCC2.

plain_memory_read_write_other_q_data_expr_TCC2:

{1} ∀ (addr1, addr2: Address, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data_q]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

OK?[State, Data1] ((##[State, Data_q, Data1](q, read_data[State, Data1](pm, dt1)(addr1)))(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_read_write_other_q_data_expr_TCC2.

Q.E.D.

C.182.3 Plain_Mem_Rewrites8.plain_memory_read_write_other_q_data_expr

Terse proof for plain_memory_read_write_other_q_data_expr.
plain_memory_read_write_other_q_data_expr:

{1} ∀ (addr1, addr2: Address, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State, q: [State → ExprResult[State, Data_q]]):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ pm_q_prop_read(pm, dt1, addr1)(q(s))

⊃

data((q ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1))(s)) = data((q ## read_data(pm, dt1)(addr1))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of pm_q_prop_read, Using lemma plain_memory_read_write_other_single_data[State, Data1, Data2], Expanding the definition of ##, Expanding the definition of ##, Using lemma pm_q_prop_single_read[State, Data1], Installing automatic rewrites from: valid_in_mem read_data read_data_valid_in_mem Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_read_write_other_q_data_expr.

Q.E.D.

C.183 Proofs for Plain_Memory (plain_memory.pvs)

C.183.1 Plain_Memory.plain_memory_invariant_read_transformers_ro_addr

Terse proof for plain_memory_invariant_read_transformers_ro_addr.
plain_memory_invariant_read_transformers_ro_addr:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ transformer_invariant?(pm`states, memory_read_transformers(pm`mem, pm`ro_addr))

Repeatedly Skolemizing and flattening, Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Keeping (-1 1) and hiding *, Using lemma unchanged_memory_invariant_invariant, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -2, Using lemma transformer_invariant_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_invariant_read_transformers_ro_addr.

Q.E.D.

C.183.2 Plain_Memory.plain_memory_invariant_read_transformers_rw_addr

Terse proof for plain_memory_invariant_read_transformers_rw_addr.
plain_memory_invariant_read_transformers_rw_addr:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ transformer_invariant?(pm`states, memory_read_transformers(pm`mem, pm`rw_addr))

Skolemizing and flattening, Expanding the definition of plain_memory?, Expanding the definition of changed_memory_invariant?, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_invariant_read_transformers_rw_addr.

Q.E.D.

C.183.3 Plain_Memory.plain_memory_invariant_read_transformers_ro_rw_addr

Terse proof for plain_memory_invariant_read_transformers_ro_rw_addr.

C.183 Proofs for Plain_Memory (plain_memory.pvs)

plain_memory_invariant_read_transformers_ro_rw_addr:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ transformer_invariant?(pm`states,

memory_read_transformers(pm`mem, (pm‘ro_addr∪ pm‘rw_addr)))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_invariant_read_transformers_ro_addr, Using lemma plain_memory_invariant_read_transformers_rw_addr, Simplifying, rewriting, and recording with decision procedures, Using lemma transformer_invariant_union_transformers, Simplifying, rewriting, and recording with decision procedures, Rewriting using memory_read_transformers_union, matching in *,

This completes the proof of plain_memory_invariant_read_transformers_ro_rw_addr.

Q.E.D.

C.183.4 Plain_Memory.plain_memory_invariant_write_transformers_rw_addr

Terse proof for plain_memory_invariant_write_transformers_rw_addr.
plain_memory_invariant_write_transformers_rw_addr:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ transformer_invariant?(pm`states, memory_write_transformers(pm`mem, pm`rw_addr))

Skolemizing and flattening, Expanding the definition of plain_memory?, Expanding the definition of changed_memory_invariant?, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_invariant_write_transformers_rw_addr.

Q.E.D.

C.183.5 Plain_Memory.plain_memory_invariant

Terse proof for plain_memory_invariant.
plain_memory_invariant:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ transformer_invariant?(pm`states,

(pm‘other_actions∪ ((memory_read_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_transformers (pm‘mem, pm‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr)))))

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Expanding the definition of unchanged_memory_invariant?, Applying disjunctive simplification to flatten sequent, Keeping (-1 -3 1) and hiding *, Using lemma transformer_invariant_union_transformers,

Case splitting on union(pm!1‘other_actions, union(union(memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_transformers(pm!1‘mem, pm!1‘rw_addr)), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr)))) = union(memory_write_transformers(pm!1‘mem, pm!1‘rw_addr), union(union(pm!1‘other_actions, memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr))), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr)))),

we get 2 subgoals:

plain_memory_invariant.1:

{-1} (pm′‘other_actions∪ ((memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))) = (memory_write_transformers (pm′‘mem, pm′‘rw_addr) ∪ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

{-2} transformer_invariant?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr)) ∧

transformer_invariant?(pm′`states,

((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

⊃

transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, pm′‘rw_addr) ∪ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))))

{-3} transformer_invariant?(pm′`states,

((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

{-4} transformer_invariant?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr))

{1} transformer_invariant?(pm′`states, (pm′‘other_actions∪ ((memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_invariant.1.
plain_memory_invariant.2:

{-1} transformer_invariant?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr)) ∧

transformer_invariant?(pm′`states,

((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

⊃

transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, pm′‘rw_addr) ∪ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))))

{-2} transformer_invariant?(pm′`states,

((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

{-3} transformer_invariant?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr))

{1} (pm′‘other_actions∪ ((memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))) = (memory_write_transformers (pm′‘mem, pm′‘rw_addr) ∪ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

{2} transformer_invariant?(pm′`states, (pm′‘other_actions∪ ((memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_transformers (pm′‘mem, pm′‘rw_addr)) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr)))))

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_invariant.2.

Q.E.D.

C.183.6 Plain_Memory.plain_memory_unchanged_invariant

Terse proof for plain_memory_unchanged_invariant.

plain_memory_unchanged_invariant:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

((pm‘other_actions∪ memory_read_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm‘mem, (pm‘ro_addr∪ pm‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm‘mem, pm‘rw_addr))), (pm‘ro_addr∪ pm‘rw_addr))

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening,

This completes the proof of plain_memory_unchanged_invariant.

Q.E.D.

C.183.7 Plain_Memory.plain_memory_unchanged_memory_invariant_write

Terse proof for plain_memory_unchanged_memory_invariant_write.
plain_memory_unchanged_memory_invariant_write:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ unchanged_memory_invariant?(pm`mem, pm`states, mem-

ory_write_transformers(pm`mem, pm`rw_addr), pm`ro_addr)

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening,

This completes the proof of plain_memory_unchanged_memory_invariant_write.

Q.E.D.

C.183.8 Plain_Memory.plain_memory_unchanged_memory_write_invariant

Terse proof for plain_memory_unchanged_memory_write_invariant.
plain_memory_unchanged_memory_write_invariant:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ unchanged_memory_write_invariant?(pm`mem, pm`states, pm`rw_addr)

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening,

This completes the proof of plain_memory_unchanged_memory_write_invariant.

Q.E.D.

C.183.9 Plain_Memory.plain_memory_changed_memory_invariant

Terse proof for plain_memory_changed_memory_invariant.
plain_memory_changed_memory_invariant:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ changed_memory_invariant?(pm`mem, pm`states, pm`rw_addr)

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening,

This completes the proof of plain_memory_changed_memory_invariant.

Q.E.D.

C.183.10 Plain_Memory.plain_memory_invariant_read_block

Terse proof for plain_memory_invariant_read_block.
plain_memory_invariant_read_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ transformer_invariant?(pm`states,

memory_read_transformers(pm`mem, ad-

dress_block(addr, size)))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: memory_read_transformers_mono Using lemma plain_memory_invariant_read_transformers_ro_rw_addr, Simplifying, rewriting, and recording with decision procedures, Using lemma transformer_invariant_mono_transformers, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_invariant_read_block.

Q.E.D.

C.183.11 Plain_Memory.plain_memory_invariant_write_block

Terse proof for plain_memory_invariant_write_block.
plain_memory_invariant_write_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ transformer_invariant?(pm`states,

memory_write_transformers(pm`mem, ad-

dress_block(addr, size)))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_invariant_write_transformers_rw_addr, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: memory_write_transformers_mono Rewriting using transformer_invariant_mono_transformers, matching in * where transformers_1

gets memory_write_transformers(pm!1‘mem, address_block(addr!1, size!1)), transformers_2 gets memory_write_transformers(pm!1‘mem, pm!1‘rw_addr),

This completes the proof of plain_memory_invariant_write_block.

Q.E.D.

C.183.12 Plain_Memory.plain_memory_transformer_invariant_read_side_effects

Terse proof for plain_memory_transformer_invariant_read_side_effects.

plain_memory_transformer_invariant_read_side_effects:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat):

plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ transformer_invariant?(pm`states,

memory_read_side_effect_super_transformers(pm`mem,

ad-

dress_block (addr, size)))

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Using lemma transformer_invariant_mono_transformers, Using lemma unchanged_memory_invariant_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-9 1) and hiding *, Rewriting using subset_transitive, matching in * where a gets memory_read_side_effect_super_transformers(pm!1‘mem,

address_block (addr!1, size!1)), b gets memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), c gets union(union(pm!1‘other_actions, memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr))), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr))),

we get 2 subgoals:

plain_memory_transformer_invariant_read_side_effects.1:

{-1} side_effect_content_unchanged(pm′`rw_addr, pm′`states, mem-

ory_write_side_effect(pm′`mem))

{1} (memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size′)) ⊆ memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)))
{2} (memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size′)) ⊆ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

Hiding formulas: 2, Expanding the definition of subset?, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of memory_read_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -4 1) and hiding *, Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets

address_block(addr!1, size!1), c gets union(pm!1‘ro_addr, pm!1‘rw_addr),

This completes the proof of plain_memory_transformer_invariant_read_side_effects.1.
plain_memory_transformer_invariant_read_side_effects.2:

{-1} side_effect_content_unchanged(pm′`rw_addr, pm′`states, mem-

ory_write_side_effect(pm′`mem))

{1} (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ⊆ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))
{2} (memory_read_side_effect_super_transformers (pm′‘mem, address_block(addr′, size′)) ⊆ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

Hiding formulas: (-1 2), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_transformer_invariant_read_side_effects.2.

Q.E.D.

C.183.13 Plain_Memory.plain_memory_transformer_invariant_write_side_effects

Terse proof for plain_memory_transformer_invariant_write_side_effects.
plain_memory_transformer_invariant_write_side_effects:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat):

plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ transformer_invariant?(pm`states,

memory_write_side_effect_super_transformers(pm`mem,

ad-

dress_block (addr, size)))

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Using lemma transformer_invariant_mono_transformers, Using lemma unchanged_memory_invariant_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-9 1) and hiding *, Rewriting using subset_transitive, matching in * where a gets memory_write_side_effect_super_transformers(pm!1‘mem,

address_block (addr!1, size!1)), b gets memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr), c gets union(union(pm!1‘other_actions, memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr))), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr))),

we get 2 subgoals:

plain_memory_transformer_invariant_write_side_effects.1:

{-1} side_effect_content_unchanged(pm′`rw_addr, pm′`states, mem-

ory_write_side_effect(pm′`mem))

{1} (memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size′)) ⊆ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))
{2} (memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size′)) ⊆ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

Hiding formulas: 2, Expanding the definition of subset?, Expanding the definition of member, Repeatedly Skolemizing and flattening, Expanding the definition of memory_write_side_effect_super_transformers, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-2 -4 1) and hiding *, Rewriting using subset_transitive, matching in * where a gets address_block(a!1, length(bl!1)), b gets

address_block(addr!1, size!1), c gets pm!1‘rw_addr,

This completes the proof of plain_memory_transformer_invariant_write_side_effects.1.
plain_memory_transformer_invariant_write_side_effects.2:

{-1} side_effect_content_unchanged(pm′`rw_addr, pm′`states, mem-

ory_write_side_effect(pm′`mem))

{1} (memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr) ⊆ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))
{2} (memory_write_side_effect_super_transformers (pm′‘mem, address_block(addr′, size′)) ⊆ ((pm′‘other_actions∪ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr))) ∪ (memory_read_side_effect_super_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)) ∪ memory_write_side_effect_super_transformers (pm′‘mem, pm′‘rw_addr))))

Hiding formulas: (-1 2), Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_transformer_invariant_write_side_effects.2.

Q.E.D.

C.183.14 Plain_Memory.plain_memory_transformer_invariant_read_list_block

Terse proof for plain_memory_transformer_invariant_read_list_block.
plain_memory_transformer_invariant_read_list_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ transformer_invariant?(pm`states,

(memory_read_transformers (pm‘mem, address_block(addr, size)) ∪ memory_read_side_effect_super_transformers (pm‘mem, address_block(addr, size))))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformer_invariant_read_side_effects, Using lemma plain_memory_invariant_read_block, Rewriting using transformer_invariant_union_transformers, matching in *,

This completes the proof of plain_memory_transformer_invariant_read_list_block.

Q.E.D.

C.183.15 Plain_Memory.plain_memory_transformer_invariant_write_list_block

Terse proof for plain_memory_transformer_invariant_write_list_block.
plain_memory_transformer_invariant_write_list_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ transformer_invariant?(pm`states,

(memory_write_transformers (pm‘mem, address_block(addr, size)) ∪ memory_write_side_effect_super_transformers (pm‘mem, address_block(addr, size))))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_invariant_write_block, Using lemma plain_memory_transformer_invariant_write_side_effects, Rewriting using transformer_invariant_union_transformers, matching in *,

This completes the proof of plain_memory_transformer_invariant_write_list_block.

Q.E.D.

C.183.16 Plain_Memory.plain_memory_transformers_ok_read_ro_rw

Terse proof for plain_memory_transformers_ok_read_ro_rw.
plain_memory_transformers_ok_read_ro_rw:

{1} ∀ (pm: Plain_Memory):

plain_memory?(pm) ⊃

transformers_ok?(pm`states, memory_read_transformers(pm`mem, (pm‘ro_addr∪ pm‘rw_addr)))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: memory_read_transformers_mono Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Keeping (-5 1) and hiding *, Using lemma transformers_ok_mono_transformers, Simplifying, rewriting, and recording with decision procedures, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_transformers_ok_read_ro_rw.

Q.E.D.

C.183.17 Plain_Memory.plain_memory_transformers_ok_read_block

Terse proof for plain_memory_transformers_ok_read_block.
plain_memory_transformers_ok_read_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ transformers_ok?(pm`states, memory_read_transformers(pm`mem, ad-

dress_block(addr, size)))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: memory_read_transformers_mono Rewriting using transformers_ok_mono_transformers, matching in * where transformers_1 gets

memory_read_transformers(pm!1‘mem, address_block(addr!1, size!1)), transformers_2 gets memory_read_transformers(pm!1‘mem, union(pm!1‘ro_addr, pm!1‘rw_addr)),

we get 2 subgoals:

plain_memory_transformers_ok_read_block.1:

{-1} size′ ≥ 0
{-2} plain_memory?(pm′)
{-3} (address_block(addr′, size′) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))
{1} (memory_read_transformers (pm′‘mem, address_block(addr′, size′)) ⊆ memory_read_transformers (pm′‘mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{2} transformers_ok?(pm′`states, memory_read_transformers(pm′`mem, address_block(addr′, size′)))

Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_transformers_ok_read_block.1.
plain_memory_transformers_ok_read_block.2:

{-1} size′ ≥ 0
{-2} plain_memory?(pm′)
{-3} (address_block(addr′, size′) ⊆ (pm′‘ro_addr∪ pm′‘rw_addr))

{1} transformers_ok?(pm′`states,

memory_read_transformers(pm′`mem, (pm′‘ro_addr∪ pm′‘rw_addr)))

{2} transformers_ok?(pm′`states, memory_read_transformers(pm′`mem, address_block(addr′, size′)))

Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Keeping (-6 1) and hiding *, Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_transformers_ok_read_block.2.

Q.E.D.

C.183.18 Plain_Memory.plain_memory_transformers_ok_write_rw

Terse proof for plain_memory_transformers_ok_write_rw.
plain_memory_transformers_ok_write_rw:

{1} ∀ (pm: Plain_Memory): plain_memory?(pm) ⊃ transformers_ok?(pm`states, memory_write_transformers(pm`mem, pm`rw_addr))

Installing automatic rewrites from: subset_equal union_subset1 union_subset3 union_left union_right subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right

Skolemizing and flattening, Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Rewriting using transformers_ok_mono_transformers, matching in * where transformers_1 gets mem-

ory_write_transformers(pm!1‘mem, pm!1‘rw_addr), transformers_2 gets union(union(memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_transformers(pm!1‘mem, pm!1‘rw_addr)), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr))),

This completes the proof of plain_memory_transformers_ok_write_rw.

Q.E.D.

C.183.19 Plain_Memory.plain_memory_transformers_ok_write_block

Terse proof for plain_memory_transformers_ok_write_block.
plain_memory_transformers_ok_write_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat):

plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ transformers_ok?(pm`states, memory_write_transformers(pm`mem, ad-

dress_block(addr, size)))

Skolemizing and flattening, Rewriting using transformers_ok_mono_transformers, matching in * where transformers_1 gets

memory_write_transformers(pm!1‘mem, address_block(addr!1, size!1)), transformers_2 gets memory_write_transformers(pm!1‘mem, pm!1‘rw_addr),

we get 2 subgoals:

plain_memory_transformers_ok_write_block.1:

{-1} plain_memory?(pm′)
{-2} (address_block(addr′, size′) ⊆ pm′‘rw_addr)
{1} (memory_write_transformers (pm′‘mem, address_block(addr′, size′)) ⊆ memory_write_transformers (pm′‘mem, pm′‘rw_addr))

{2} transformers_ok?(pm′`states,

memory_write_transformers(pm′`mem, ad-

dress_block(addr′, size′)))

Rewriting using memory_write_transformers_mono, matching in *,

This completes the proof of plain_memory_transformers_ok_write_block.1.

plain_memory_transformers_ok_write_block.2:

{-1} plain_memory?(pm′)
{-2} (address_block(addr′, size′) ⊆ pm′‘rw_addr)
{1} transformers_ok?(pm′`states, memory_write_transformers(pm′`mem, pm′`rw_addr))

{2} transformers_ok?(pm′`states,

memory_write_transformers(pm′`mem, ad-

dress_block(addr′, size′)))

Rewriting using plain_memory_transformers_ok_write_rw, matching in *,

This completes the proof of plain_memory_transformers_ok_write_block.2.

Q.E.D.

C.183.20 Plain_Memory.plain_memory_transformers_ok_read_side_effects_ro_rw

Terse proof for plain_memory_transformers_ok_read_side_effects_ro_rw.
plain_memory_transformers_ok_read_side_effects_ro_rw:

{1} ∀ (pm: Plain_Memory):

plain_memory?(pm) ⊃

transformers_ok?(pm`states,

memory_read_side_effect_super_transformers(pm`mem, (pm‘ro_addr∪ pm‘rw_addr)))

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Keeping (-5 1) and hiding *, Rewriting using transformers_ok_mono_transformers, matching in * where transformers_1 gets mem-

ory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), transformers_2 gets union(union(memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_transformers(pm!1‘mem, pm!1‘rw_addr)), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr))),

Keeping 1 and hiding *, Rewriting using subset_bigger_union_right, matching in *, Rewriting using union_subset1, matching in *,

This completes the proof of plain_memory_transformers_ok_read_side_effects_ro_rw.

Q.E.D.

C.183.21 Plain_Memory.plain_memory_transformers_ok_read_side_effects_block

Terse proof for plain_memory_transformers_ok_read_side_effects_block.
plain_memory_transformers_ok_read_side_effects_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ transformers_ok?(pm`states,

memory_read_side_effect_super_transformers(pm`mem,

ad-

dress_block(addr, size)))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformers_ok_read_side_effects_ro_rw, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: memory_read_side_effect_super_transformers_mono Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_transformers_ok_read_side_effects_block.

Q.E.D.

C.183.22 Plain_Memory.plain_memory_transformers_ok_write_side_effects_ro_rw

Terse proof for plain_memory_transformers_ok_write_side_effects_ro_rw.
plain_memory_transformers_ok_write_side_effects_ro_rw:

{1} ∀ (pm: Plain_Memory):

plain_memory?(pm) ⊃

transformers_ok?(pm`states, memory_write_side_effect_super_transformers(pm`mem, pm`rw_addr))

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Keeping (-5 1) and hiding *, Rewriting using transformers_ok_mono_transformers, matching in * where transformers_1

gets memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr), transformers_2 gets union(union(memory_read_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_transformers(pm!1‘mem, pm!1‘rw_addr)), union(memory_read_side_effect_super_transformers(pm!1‘mem, union (pm!1‘ro_addr, pm!1‘rw_addr)), memory_write_side_effect_super_transformers(pm!1‘mem, pm!1‘rw_addr))),

Keeping 1 and hiding *, Rewriting using subset_bigger_union_right, matching in *, Rewriting using union_subset3, matching in *,

This completes the proof of plain_memory_transformers_ok_write_side_effects_ro_rw.

Q.E.D.

C.183.23 Plain_Memory.plain_memory_transformers_ok_write_side_effects_block

Terse proof for plain_memory_transformers_ok_write_side_effects_block.
plain_memory_transformers_ok_write_side_effects_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ transformers_ok?(pm`states,

memory_write_side_effect_super_transformers(pm`mem,

ad-

dress_block(addr, size)))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformers_ok_write_side_effects_ro_rw, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: memory_write_side_effect_super_transformers_mono Using lemma transformers_ok_mono_transformers, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_transformers_ok_write_side_effects_block.

Q.E.D.

C.183.24 Plain_Memory.plain_memory_transformers_ok_read_list_block

Terse proof for plain_memory_transformers_ok_read_list_block.
plain_memory_transformers_ok_read_list_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ transformers_ok?(pm`states,

(memory_read_transformers (pm‘mem, address_block(addr, size)) ∪ memory_read_side_effect_super_transformers (pm‘mem, address_block(addr, size))))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformers_ok_read_block, Using lemma plain_memory_transformers_ok_read_side_effects_block, Rewriting using transformers_ok_union_transformers, matching in *,

This completes the proof of plain_memory_transformers_ok_read_list_block.

Q.E.D.

C.183.25 Plain_Memory.plain_memory_transformers_ok_write_list_block

Terse proof for plain_memory_transformers_ok_write_list_block.
plain_memory_transformers_ok_write_list_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ transformers_ok?(pm`states,

(memory_write_transformers (pm‘mem, address_block(addr, size)) ∪ memory_write_side_effect_super_transformers (pm‘mem, address_block(addr, size))))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformers_ok_write_block, Using lemma plain_memory_transformers_ok_write_side_effects_block, Rewriting using transformers_ok_union_transformers, matching in *,

This completes the proof of plain_memory_transformers_ok_write_list_block.

Q.E.D.

C.183.26 Plain_Memory.plain_memory_unchanged_read_block_rw_addr

Terse proof for plain_memory_unchanged_read_block_rw_addr.

plain_memory_unchanged_read_block_rw_addr:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

memory_read_transformers(pm`mem, ad-

dress_block(addr, size)), pm`rw_addr)

Repeatedly Skolemizing and flattening, Using lemma plain_memory_unchanged_invariant, Using lemma unchanged_memory_invariant_mono, Rewriting using union_commutative, matching in *, Rewriting using union_subset1, matching in *, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-4 1) and hiding *, Using lemma memory_read_transformers_mono, Rewriting using subset_bigger_union_left, matching in * where a gets address_block(addr!1, size!1),

b gets pm!1‘rw_addr, c gets pm!1‘ro_addr, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_unchanged_read_block_rw_addr.

Q.E.D.

C.183.27 Plain_Memory.plain_memory_unchanged_read_ro_rw_addr

Terse proof for plain_memory_unchanged_read_ro_rw_addr.
plain_memory_unchanged_read_ro_rw_addr:

{1} ∀ (pm: Plain_Memory):

plain_memory?(pm) ⊃

unchanged_memory_invariant?(pm`mem, pm`states, memory_read_transformers(pm`mem, (pm‘ro_addr∪ pm‘rw_addr)), (pm‘ro_addr∪ pm‘rw_addr))

Skolemizing and flattening, Installing automatic rewrites from: subset_equal union_subset1 union_subset3 union_left union_right

subset_singleton subset_bigger_union_right subset_bigger_union_left union_left union_right Using lemma plain_memory_unchanged_invariant, Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_read_ro_rw_addr.

Q.E.D.

C.183.28 Plain_Memory.plain_memory_unchanged_read_block_ro_rw_addr

Terse proof for plain_memory_unchanged_read_block_ro_rw_addr.

plain_memory_unchanged_read_block_ro_rw_addr:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

memory_read_transformers(pm`mem, ad-

dress_block(addr, size)), (pm‘ro_addr∪ pm‘rw_addr))

Skolemizing and flattening, Using lemma plain_memory_unchanged_read_ro_rw_addr, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_mono, Installing automatic rewrites from: subset_equal memory_read_transformers_mono Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_unchanged_read_block_ro_rw_addr.

Q.E.D.

C.183.29 Plain_Memory.plain_memory_unchanged_write_block_ro_addr

Terse proof for plain_memory_unchanged_write_block_ro_addr.
plain_memory_unchanged_write_block_ro_addr:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

memory_write_transformers(pm`mem, ad-

dress_block(addr, size)), pm`ro_addr)

Repeatedly Skolemizing and flattening, Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Using lemma unchanged_memory_invariant_mono, Rewriting using subset_reflexive, matching in *, Simplifying, rewriting, and recording with decision procedures, Rewriting using memory_write_transformers_mono[State], matching in *,

This completes the proof of plain_memory_unchanged_write_block_ro_addr.

Q.E.D.

C.183.30 Plain_Memory.plain_memory_unchanged_read_block

Terse proof for plain_memory_unchanged_read_block.

plain_memory_unchanged_read_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

memory_read_transformers(pm`mem, ad-

dress_block(addr, size)), address_block(addr, size))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_unchanged_read_block_ro_rw_addr, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_mono, Simplifying, rewriting, and recording with decision procedures, Rewriting using subset_reflexive, matching in *,

This completes the proof of plain_memory_unchanged_read_block.

Q.E.D.

C.183.31 Plain_Memory.plain_memory_unchanged_read_side_effect_block_ro_rw

Terse proof for plain_memory_unchanged_read_side_effect_block_ro_rw.
plain_memory_unchanged_read_side_effect_block_ro_rw:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

memory_read_side_effect_super_transformers(pm`mem,

ad-

dress_block

(addr, size)),

(pm‘ro_addr∪ pm‘rw_addr))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_unchanged_invariant, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_mono, Installing automatic rewrites from: subset_equal subset_bigger_union_right subset_bigger_union_left

memory_read_side_effect_super_transformers_mono Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_read_side_effect_block_ro_rw.

Q.E.D.

C.183.32 Plain_Memory.plain_memory_unchanged_read_side_effect_block

Terse proof for plain_memory_unchanged_read_side_effect_block.

plain_memory_unchanged_read_side_effect_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

memory_read_side_effect_super_transformers(pm`mem,

ad-

dress_block

(addr, size)),

address_block(addr, size))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_unchanged_read_side_effect_block_ro_rw, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_mono, Installing automatic rewrites from: subset_equal Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_read_side_effect_block.

Q.E.D.

C.183.33 Plain_Memory.plain_memory_unchanged_write_side_effect_block_ro_rw

Terse proof for plain_memory_unchanged_write_side_effect_block_ro_rw.
plain_memory_unchanged_write_side_effect_block_ro_rw:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

memory_write_side_effect_super_transformers(pm`mem,

ad-

dress_block

(addr, size)),

(pm‘ro_addr∪ pm‘rw_addr))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_unchanged_invariant, Simplifying, rewriting, and recording with decision procedures, Using lemma unchanged_memory_invariant_mono, Installing automatic rewrites from: subset_equal subset_bigger_union_right subset_bigger_union_left

memory_write_side_effect_super_transformers_mono Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_write_side_effect_block_ro_rw.

Q.E.D.

C.183.34 Plain_Memory.plain_memory_unchanged_write_side_effect_block

Terse proof for plain_memory_unchanged_write_side_effect_block.

plain_memory_unchanged_write_side_effect_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ unchanged_memory_invariant?(pm`mem, pm`states,

memory_write_side_effect_super_transformers(pm`mem,

ad-

dress_block

(addr, size)),

address_block(addr, size))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_unchanged_write_side_effect_block_ro_rw, Simplifying, rewriting, and recording with decision procedures, Installing automatic rewrites from: subset_equal union_subset1 union_subset3 union_left union_right

subset_singleton subset_bigger_union_right subset_bigger_union_left Using lemma unchanged_memory_invariant_mono, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_unchanged_write_side_effect_block.

Q.E.D.

C.183.35 Plain_Memory.plain_memory_unchanged_block

Terse proof for plain_memory_unchanged_block.
plain_memory_unchanged_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ unchanged_memory_write_invariant?(pm`mem, pm`states, ad-

dress_block(addr, size))

Repeatedly Skolemizing and flattening, Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent, Keeping (-4 -9 1) and hiding *, Rewriting using unchanged_memory_write_invariant_mono_addresses, matching in * where ad-

dresses_1 gets address_block(addr!1, size!1), addresses_2 gets pm!1‘rw_addr,

This completes the proof of plain_memory_unchanged_block.

Q.E.D.

C.183.36 Plain_Memory.plain_memory_changed_block

Terse proof for plain_memory_changed_block.
plain_memory_changed_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ changed_memory_invariant?(pm`mem, pm`states, address_block(addr, size))

Repeatedly Skolemizing and flattening, Expanding the definition of plain_memory?, Applying disjunctive simplification to flatten sequent,

Rewriting using changed_memory_invariant_mono, matching in * where addresses_1 gets address_block(addr!1, size!1), addresses_2 gets pm!1‘rw_addr,

This completes the proof of plain_memory_changed_block.

Q.E.D.

C.183.37 Plain_Memory.plain_memory_side_effect_content_unchanged_read_block

Terse proof for plain_memory_side_effect_content_unchanged_read_block.
plain_memory_side_effect_content_unchanged_read_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ (pm‘ro_addr∪ pm‘rw_addr)) ⊃ side_effect_content_unchanged(address_block(addr, size), pm`states,

memory_read_side_effect(pm`mem))

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Keeping (-7 -9 1) and hiding *, Rewriting using side_effect_content_unchanged_mono[State], matching in * where addresses_1 gets

address_block(addr!1, size!1), addresses_2 gets union(pm!1‘ro_addr, pm!1‘rw_addr),

This completes the proof of plain_memory_side_effect_content_unchanged_read_block.

Q.E.D.

C.183.38 Plain_Memory.plain_memory_side_effect_content_unchanged_write_block

Terse proof for plain_memory_side_effect_content_unchanged_write_block.
plain_memory_side_effect_content_unchanged_write_block:

{1} ∀ (addr: Address, pm: Plain_Memory, size: nat): plain_memory?(pm) ∧ (address_block(addr, size) ⊆ pm‘rw_addr) ⊃ side_effect_content_unchanged(address_block(addr, size), pm`states,

memory_write_side_effect(pm`mem))

Expanding the definition of plain_memory?, Repeatedly Skolemizing and flattening, Keeping (-8 -9 1) and hiding *, Rewriting using side_effect_content_unchanged_mono[State], matching in * where addresses_1 gets

address_block(addr!1, size!1), addresses_2 gets pm!1‘rw_addr,

This completes the proof of plain_memory_side_effect_content_unchanged_write_block.

Q.E.D.

C.183.39 Plain_Memory.plain_memory_memory_read_ok

Terse proof for plain_memory_memory_read_ok.
plain_memory_memory_read_ok:

{1} ∀ (addr: Address, pm: Plain_Memory, s: State): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?(memory_read(pm`mem)(addr)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformers_ok_read_ro_rw, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_transformers_ok_ok, Installing automatic rewrites from: memory_read_transformers_memory_read Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_memory_read_ok.

Q.E.D.

C.183.40 Plain_Memory.plain_memory_states_memory_read_TCC1

Terse proof for plain_memory_states_memory_read_TCC1.
plain_memory_states_memory_read_TCC1:

{1} ∀ (addr: Address, pm: Plain_Memory, s: State): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s)) ∨ Exception?[State, Byte](memory_read(pm`mem)(addr)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *,

This completes the proof of plain_memory_states_memory_read_TCC1.

Q.E.D.

C.183.41 Plain_Memory.plain_memory_states_memory_read

Terse proof for plain_memory_states_memory_read.
plain_memory_states_memory_read:

{1} ∀ (addr: Address, pm: Plain_Memory, s: State): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ pm`states(state(memory_read(pm`mem)(addr)(s)))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_invariant_read_transformers_ro_rw_addr, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_transformer_invariant_next_ok[State, Byte], Installing automatic rewrites from: memory_read_transformers_memory_read plain_memory_memory_read_ok

has_next_state!

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_states_memory_read.

Q.E.D.

C.183.42 Plain_Memory.plain_memory_memory_read_memory_read_TCC1

Terse proof for plain_memory_memory_read_memory_read_TCC1.

plain_memory_memory_read_memory_read_TCC1:

{1} ∀ (pm: Plain_Memory, s: State, addr1, addr2: Address): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr1) ∧ union(pm`ro_addr, pm`rw_addr)(addr2) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr2)(s)) ∨ Exception?[State, Byte](memory_read(pm`mem)(addr2)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *,

This completes the proof of plain_memory_memory_read_memory_read_TCC1.

Q.E.D.

C.183.43 Plain_Memory.plain_memory_memory_read_memory_read_TCC2

Terse proof for plain_memory_memory_read_memory_read_TCC2.
plain_memory_memory_read_memory_read_TCC2:

{1} ∀ (pm: Plain_Memory, s: State, addr1, addr2: Address): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr1) ∧ union(pm`ro_addr, pm`rw_addr)(addr2) ⊃ OK?[State, Byte]

(memory_read(pm`mem) (addr1)(state[State, Byte](memory_read(pm`mem)(addr2)(s))))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *, Rewriting using plain_memory_states_memory_read, matching in *,

This completes the proof of plain_memory_memory_read_memory_read_TCC2.

Q.E.D.

C.183.44 Plain_Memory.plain_memory_memory_read_memory_read_TCC3

Terse proof for plain_memory_memory_read_memory_read_TCC3.
plain_memory_memory_read_memory_read_TCC3:

{1} ∀ (pm: Plain_Memory, s: State, addr1, addr2: Address): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr1) ∧ union(pm`ro_addr, pm`rw_addr)(addr2) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr1)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *,

This completes the proof of plain_memory_memory_read_memory_read_TCC3.

Q.E.D.

C.183.45 Plain_Memory.plain_memory_memory_read_memory_read

Terse proof for plain_memory_memory_read_memory_read.
plain_memory_memory_read_memory_read:

{1} ∀ (pm: Plain_Memory, s: State, addr1, addr2: Address): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr1) ∧ union(pm`ro_addr, pm`rw_addr)(addr2) ⊃ data(memory_read(pm`mem)(addr1)(state(memory_read(pm`mem)(addr2)(s)))) = data(memory_read(pm`mem)(addr1)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_unchanged_read_ro_rw_addr, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_unchanged_memory_invariant_unchanged[State, Byte], Installing automatic rewrites from: plain_memory_memory_read_ok plain_memory_states_memory_read

memory_read_transformers_memory_read Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_memory_read_memory_read.

Q.E.D.

C.183.46 Plain_Memory.plain_memory_memory_write_ok

Terse proof for plain_memory_memory_write_ok.
plain_memory_memory_write_ok:

{1} ∀ (addr: Address, pm: Plain_Memory, s: State, byte: Byte): plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(addr) ⊃ OK?(memory_write(pm`mem)(addr, byte)(s))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_transformers_ok_write_rw, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_transformers_ok_ok, Installing automatic rewrites from: memory_write_transformers_memory_write Simplifying, rewriting, and recording with decision procedures,

This completes the proof of plain_memory_memory_write_ok.

Q.E.D.

C.183.47 Plain_Memory.plain_memory_states_memory_write_TCC1

Terse proof for plain_memory_states_memory_write_TCC1.

plain_memory_states_memory_write_TCC1:

{1} ∀ (addr: Address, pm: Plain_Memory, s: State, byte: Byte):

plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(addr) ⊃ OK?[State, Unit](memory_write(pm`mem)(addr, byte)(s)) ∨ Exception?[State, Unit](memory_write(pm`mem)(addr, byte)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_write_ok, matching in *,

This completes the proof of plain_memory_states_memory_write_TCC1.

Q.E.D.

C.183.48 Plain_Memory.plain_memory_states_memory_write

Terse proof for plain_memory_states_memory_write.
plain_memory_states_memory_write:

{1} ∀ (addr: Address, pm: Plain_Memory, s: State, byte: Byte):

plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(addr) ⊃ pm`states(state(memory_write(pm`mem)(addr, byte)(s)))

Repeatedly Skolemizing and flattening, Using lemma plain_memory_invariant_write_transformers_rw_addr, Using lemma expr_transformer_invariant_next_ok[State, Unit], Installing automatic rewrites from: memory_write_transformers_memory_write plain_memory_memory_write_ok

has_next_state!

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_states_memory_write.

Q.E.D.

C.183.49 Plain_Memory.plain_memory_memory_read_memory_write_other_TCC1

Terse proof for plain_memory_memory_read_memory_write_other_TCC1.
plain_memory_memory_read_memory_write_other_TCC1:

{1} ∀ (pm: Plain_Memory, s: State, ro_addr, rw_addr: Address, byte: Byte): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(ro_addr) ∧ pm`rw_addr(rw_addr) ∧ ¬ ro_addr = rw_addr ⊃ OK?[State, Unit](memory_write(pm`mem)(rw_addr, byte)(s)) ∨ Exception?[State, Unit](memory_write(pm`mem)(rw_addr, byte)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_write_ok, matching in *,

This completes the proof of plain_memory_memory_read_memory_write_other_TCC1.

Q.E.D.

C.183.50 Plain_Memory.plain_memory_memory_read_memory_write_other_TCC2

Terse proof for plain_memory_memory_read_memory_write_other_TCC2.
plain_memory_memory_read_memory_write_other_TCC2:

{1} ∀ (pm: Plain_Memory, s: State, ro_addr, rw_addr: Address, byte: Byte): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(ro_addr) ∧ pm`rw_addr(rw_addr) ∧ ¬ ro_addr = rw_addr ⊃ OK?[State, Byte]

(memory_read(pm`mem) (ro_addr)(state[State, Unit](memory_write(pm`mem)(rw_addr, byte)(s))))

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_memory_read_ok, matching in *,

Rewriting using plain_memory_states_memory_write, matching in *,

This completes the proof of plain_memory_memory_read_memory_write_other_TCC2.

Q.E.D.

C.183.51 Plain_Memory.plain_memory_memory_read_memory_write_other_TCC3

Terse proof for plain_memory_memory_read_memory_write_other_TCC3.
plain_memory_memory_read_memory_write_other_TCC3:

{1} ∀ (pm: Plain_Memory, s: State, ro_addr, rw_addr: Address):

plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(ro_addr) ∧ pm`rw_addr(rw_addr) ∧ ¬ ro_addr = rw_addr ⊃ OK?[State, Byte](memory_read(pm`mem)(ro_addr)(s))

Repeatedly Skolemizing and flattening,

Rewriting using plain_memory_memory_read_ok, matching in *,

This completes the proof of plain_memory_memory_read_memory_write_other_TCC3.

Q.E.D.

C.183.52 Plain_Memory.plain_memory_memory_read_memory_write_other

Terse proof for plain_memory_memory_read_memory_write_other.

plain_memory_memory_read_memory_write_other:

{1} ∀ (pm: Plain_Memory, s: State, ro_addr, rw_addr: Address, byte: Byte): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(ro_addr) ∧ pm`rw_addr(rw_addr) ∧ ¬ ro_addr = rw_addr ⊃ data(memory_read(pm`mem)

(ro_addr)(state(memory_write(pm`mem)(rw_addr, byte)(s))))

= data(memory_read(pm`mem)(ro_addr)(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: union member Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

plain_memory_memory_read_memory_write_other.1:

{-1} byte′ < max_byte
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} pm′`ro_addr(ro_addr′)
{-5} pm′`rw_addr(rw_addr′)
{1} ro_addr′ = rw_addr′

{2} data(memory_read(pm′`mem)

(ro_addr′)(state(memory_write(pm′`mem)(rw_addr′, byte′)(s′))))

= data(memory_read(pm′`mem)(ro_addr′)(s′))

Using lemma plain_memory_unchanged_memory_invariant_write, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_unchanged_memory_invariant_unchanged[State, Unit], Installing automatic rewrites from: plain_memory_memory_read_ok plain_memory_states_memory_write

plain_memory_memory_write_ok memory_write_transformers_memory_write Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of plain_memory_memory_read_memory_write_other.1.
plain_memory_memory_read_memory_write_other.2:

{-1} byte′ < max_byte
{-2} plain_memory?(pm′)
{-3} pm′`states(s′)
{-4} pm′`rw_addr(ro_addr′)
{-5} pm′`rw_addr(rw_addr′)
{1} ro_addr′ = rw_addr′

{2} data(memory_read(pm′`mem)

(ro_addr′)(state(memory_write(pm′`mem)(rw_addr′, byte′)(s′))))

= data(memory_read(pm′`mem)(ro_addr′)(s′))

Using lemma plain_memory_unchanged_memory_write_invariant, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of unchanged_memory_write_invariant?, Instantiating the top quantifier in -1 with the terms: rw_addr′, byte′, Simplifying, rewriting, and recording with decision procedures, Using lemma expr_unchanged_memory_invariant_unchanged[State, Unit], Installing automatic rewrites from: plain_memory_memory_read_ok plain_memory_states_memory_write

plain_memory_memory_write_ok memory_write_transformers_memory_write singleton Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_memory_memory_read_memory_write_other.2.

Q.E.D.

C.183.53 Plain_Memory.stays_unchanged_TCC1

Terse proof for stays_unchanged_TCC1.
stays_unchanged_TCC1:

{1} ∀ (pm: (plain_memory?), s_{1}, s_{2}: (pm`states), addresses: PRED[Address], addr: Ad- dress): union(pm`ro_addr, pm`rw_addr)(addr) ∧ addresses(addr) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s_{1}))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *, This completes the proof of stays_unchanged_TCC1. Q.E.D.

C.183.54 Plain_Memory.stays_unchanged_TCC2

Terse proof for stays_unchanged_TCC2.
stays_unchanged_TCC2:

{1} ∀ (pm: (plain_memory?), s_{1}, s_{2}: (pm`states), addresses: PRED[Address], addr: Ad- dress): union(pm`ro_addr, pm`rw_addr)(addr) ∧ addresses(addr) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s_{2}))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *, This completes the proof of stays_unchanged_TCC2. Q.E.D.

C.183.55 Plain_Memory.stays_unchanged_unchanged_TCC1

Terse proof for stays_unchanged_unchanged_TCC1.
stays_unchanged_unchanged_TCC1:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address], addr: Address): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ∧ stays_unchanged(pm)(s_{1}, s_{2}, addresses) ∧ addresses(addr) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s_{1}))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *,

This completes the proof of stays_unchanged_unchanged_TCC1.

Q.E.D.

C.183.56 Plain_Memory.stays_unchanged_unchanged_TCC2

Terse proof for stays_unchanged_unchanged_TCC2.
stays_unchanged_unchanged_TCC2:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address], addr: Address): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ∧ stays_unchanged(pm)(s_{1}, s_{2}, addresses) ∧ addresses(addr) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s_{2}))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *,

This completes the proof of stays_unchanged_unchanged_TCC2.

Q.E.D.

C.183.57 Plain_Memory.stays_unchanged_unchanged

Terse proof for stays_unchanged_unchanged.
stays_unchanged_unchanged:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address], addr: Address): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ∧ stays_unchanged(pm)(s_{1}, s_{2}, addresses) ∧ addresses(addr)

⊃ data(memory_read(pm`mem)(addr)(s_{1})) = data(memory_read(pm`mem)(addr)(s_{2}))

Repeatedly Skolemizing and flattening, Expanding the definition of stays_unchanged, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of stays_unchanged_unchanged.

Q.E.D.

C.183.58 Plain_Memory.stays_unchanged_symmetric

Terse proof for stays_unchanged_symmetric.
stays_unchanged_symmetric:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ stays_unchanged(pm)(s_{1}, s_{2}, addresses) = stays_unchanged(pm)(s_{2}, s_{1}, addresses)

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

stays_unchanged_symmetric.1:

{-1} plain_memory?(pm′)
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} stays_unchanged(pm′)(s′_{1}, s′_{2}, addresses′)
{1} stays_unchanged(pm′)(s′_{2}, s′_{1}, addresses′)

Expanding the definition of stays_unchanged, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of stays_unchanged_symmetric.1.
stays_unchanged_symmetric.2:

{-1} plain_memory?(pm′)
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} stays_unchanged(pm′)(s′_{2}, s′_{1}, addresses′)
{1} stays_unchanged(pm′)(s′_{1}, s′_{2}, addresses′)

Expanding the definition of stays_unchanged, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of stays_unchanged_symmetric.2.

Q.E.D.

C.183.59 Plain_Memory.stays_unchanged_mono

Terse proof for stays_unchanged_mono.
stays_unchanged_mono:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses_1, addresses_2: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ (addresses_1⊆ addresses_2) ∧ stays_unchanged(pm)(s_{1}, s_{2}, addresses_2) ⊃ stays_unchanged(pm)(s_{1}, s_{2}, addresses_1)

Repeatedly Skolemizing and flattening, Expanding the definition of stays_unchanged, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Hiding formulas: -1, 2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stays_unchanged_mono. Q.E.D.

C.183.60 Plain_Memory.stays_unchanged_only_changes

Terse proof for stays_unchanged_only_changes.

stays_unchanged_only_changes:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ (pm‘ro_addr⊆ addresses) ⊃ stays_unchanged(pm)(s_{1}, s_{2}, addresses) = only_changes(pm)(s_{1}, s_{2}, (pm‘rw_addr\ addresses))

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

stays_unchanged_only_changes.1:

{-1} plain_memory?(pm′)
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} (pm′‘ro_addr⊆ addresses′)
{-5} stays_unchanged(pm′)(s′_{1}, s′_{2}, addresses′)
{1} only_changes(pm′)(s′_{1}, s′_{2}, (pm′‘rw_addr\ addresses′))

Expanding the definition of only_changes, Expanding the definition of stays_unchanged, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Keeping (-4 -5 -6 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stays_unchanged_only_changes.1.
stays_unchanged_only_changes.2:

{-1} plain_memory?(pm′)
{-2} pm′`states(s′_{1})
{-3} pm′`states(s′_{2})
{-4} (pm′‘ro_addr⊆ addresses′)
{-5} only_changes(pm′)(s′_{1}, s′_{2}, (pm′‘rw_addr\ addresses′))
{1} stays_unchanged(pm′)(s′_{1}, s′_{2}, addresses′)

Expanding the definition of only_changes, Expanding the definition of stays_unchanged, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Keeping (-4 -5 -6 2) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stays_unchanged_only_changes.2.

Q.E.D.

C.183.61 Plain_Memory.stays_unchanged_only_changes_disjoint

Terse proof for stays_unchanged_only_changes_disjoint.

stays_unchanged_only_changes_disjoint:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses_1, addresses_2: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ (addresses_2⊆ (pm‘ro_addr∪ pm‘rw_addr)) ∧ disjoint?(addresses_1, addresses_2) ∧ only_changes(pm)(s_{1}, s_{2}, addresses_1) ⊃ stays_unchanged(pm)(s_{1}, s_{2}, addresses_2)

Repeatedly Skolemizing and flattening, Expanding the definition of only_changes, Using lemma stays_unchanged_mono, Simplifying, rewriting, and recording with decision procedures, Keeping (-4 -5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stays_unchanged_only_changes_disjoint.

Q.E.D.

C.183.62 Plain_Memory.only_changes_symmetric

Terse proof for only_changes_symmetric.
only_changes_symmetric:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ⊃ only_changes(pm)(s_{1}, s_{2}, addresses) = only_changes(pm)(s_{2}, s_{1}, addresses)

Repeatedly Skolemizing and flattening, Expanding the definition of only_changes, Rewriting using stays_unchanged_symmetric, matching in *, This completes the proof of only_changes_symmetric. Q.E.D.

C.183.63 Plain_Memory.only_changes_mono

Terse proof for only_changes_mono.
only_changes_mono:

{1} ∀ (pm: Plain_Memory, s_{1}, s_{2}: State, addresses_1, addresses_2: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ (addresses_1⊆ addresses_2) ∧ only_changes(pm)(s_{1}, s_{2}, addresses_1) ⊃ only_changes(pm)(s_{1}, s_{2}, addresses_2)

Repeatedly Skolemizing and flattening, Expanding the definition of only_changes, Using lemma stays_unchanged_mono, Simplifying, rewriting, and recording with decision procedures, Keeping (-4 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of only_changes_mono. Q.E.D.

C.183.64 Plain_Memory.only_changes_unchanged_TCC1

Terse proof for only_changes_unchanged_TCC1.
only_changes_unchanged_TCC1:

{1} ∀ (addr: Address, pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ only_changes(pm)(s_{1}, s_{2}, addresses) ∧ (pm`ro_addr(addr) ∨ pm`rw_addr(addr) ∧ ¬ addresses(addr)) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s_{1}))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *, Keeping (-5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of only_changes_unchanged_TCC1.

Q.E.D.

C.183.65 Plain_Memory.only_changes_unchanged_TCC2

Terse proof for only_changes_unchanged_TCC2.
only_changes_unchanged_TCC2:

{1} ∀ (addr: Address, pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ only_changes(pm)(s_{1}, s_{2}, addresses) ∧ (pm`ro_addr(addr) ∨ pm`rw_addr(addr) ∧ ¬ addresses(addr)) ⊃ OK?[State, Byte](memory_read(pm`mem)(addr)(s_{2}))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_ok, matching in *, Keeping (-5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of only_changes_unchanged_TCC2.

Q.E.D.

C.183.66 Plain_Memory.only_changes_unchanged

Terse proof for only_changes_unchanged.

only_changes_unchanged:

{1} ∀ (addr: Address, pm: Plain_Memory, s_{1}, s_{2}: State, addresses: PRED[Address]): plain_memory?(pm) ∧ pm`states(s_{1}) ∧ pm`states(s_{2}) ∧ only_changes(pm)(s_{1}, s_{2}, addresses) ∧ (pm`ro_addr(addr) ∨ pm`rw_addr(addr) ∧ ¬ addresses(addr))

⊃ data(memory_read(pm`mem)(addr)(s_{1})) = data(memory_read(pm`mem)(addr)(s_{2}))

Repeatedly Skolemizing and flattening, Expanding the definition of only_changes, Using lemma stays_unchanged_unchanged, Simplifying, rewriting, and recording with decision procedures, Keeping (-5 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of only_changes_unchanged. Q.E.D.

C.183.67 Plain_Memory.plain_memory_stays_unchanged_memory_read_TCC1

Terse proof for plain_memory_stays_unchanged_memory_read_TCC1.
plain_memory_stays_unchanged_memory_read_TCC1:

{1} ∀ (pm: Plain_Memory, s: State, addr: Address): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ pm`states(state[State, Byte](memory_read(pm`mem)(addr)(s)))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_states_memory_read, matching in *,

This completes the proof of plain_memory_stays_unchanged_memory_read_TCC1.

Q.E.D.

C.183.68 Plain_Memory.plain_memory_stays_unchanged_memory_read

Terse proof for plain_memory_stays_unchanged_memory_read.
plain_memory_stays_unchanged_memory_read:

{1} ∀ (pm: Plain_Memory, s: State, addr: Address): plain_memory?(pm) ∧ pm`states(s) ∧ union(pm`ro_addr, pm`rw_addr)(addr) ⊃ stays_unchanged(pm) (s, state(memory_read(pm`mem)(addr)(s)), (pm‘ro_addr∪ pm‘rw_addr))

Repeatedly Skolemizing and flattening, Expanding the definition of stays_unchanged, Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_memory_read, matching in *,

This completes the proof of plain_memory_stays_unchanged_memory_read.

Q.E.D.

C.183.69 Plain_Memory.plain_memory_stays_unchanged_memory_write_TCC1

Terse proof for plain_memory_stays_unchanged_memory_write_TCC1.
plain_memory_stays_unchanged_memory_write_TCC1:

{1} ∀ (pm: Plain_Memory, s: State, addr: Address, byte: Byte):

plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(addr) ⊃ pm`states(state[State, Unit](memory_write(pm`mem)(addr, byte)(s)))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_states_memory_write, matching in *,

This completes the proof of plain_memory_stays_unchanged_memory_write_TCC1.

Q.E.D.

C.183.70 Plain_Memory.plain_memory_stays_unchanged_memory_write

Terse proof for plain_memory_stays_unchanged_memory_write.
plain_memory_stays_unchanged_memory_write:

{1} ∀ (pm: Plain_Memory, s: State, addr: Address, byte: Byte):

plain_memory?(pm) ∧ pm`states(s) ∧ pm`rw_addr(addr) ⊃ stays_unchanged(pm)

(s, state(memory_write(pm`mem)(addr, byte)(s)), ((pm‘ro_addr∪ pm‘rw_addr) \ {addr}))

Repeatedly Skolemizing and flattening, Expanding the definition of stays_unchanged, Repeatedly Skolemizing and flattening, Rewriting using plain_memory_memory_read_memory_write_other, matching in *, Expanding the definition of remove, which is trivially true.

This completes the proof of plain_memory_stays_unchanged_memory_write.

Q.E.D.

C.184 Proofs for PointerToMemberExpressions (expressions.pvs)

C.184.1 PointerToMemberExpressions.ptm_member_TCC1

Terse proof for ptm_member_TCC1.
ptm_member_TCC1:

{1} ∀ (typ: Cpp_Subtype(cv(pointer_to_member?))): pointer_to_member?(cv_base(typ))

C.184 Proofs for PointerToMemberExpressions (expressions.pvs)

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ptm_member_TCC1. Q.E.D.

C.184.2 PointerToMemberExpressions.ptm_arrow_TCC1

Terse proof for ptm_arrow_TCC1.
ptm_arrow_TCC1:

{1} ∀ ((ptm_typ: Cpp_Subtype(cv(pointer_to_member?))), ofs: (range_ptm(cv_base(ptm_typ)))): Cpp_Type?(pointer(typ(cv_base(ptm_typ)))) ∧ cv(extend[Cpp_Type_, Cpp_Type, bool, false]

(λ (t: Cpp_Type):

pointer?(t) ∧ (class?(typ(t)) ∨ union?(typ(t)))))

(pointer(typ(cv_base(ptm_typ))))

Repeatedly Skolemizing and flattening, Using lemma cv_base_result, we get 2 subgoals:

ptm_arrow_TCC1.1:

{-1} pointer_to_member?(cv_base(ptm_typ′))
{-2} Cpp_Type?(ptm_typ′)
{-3} cv(pointer_to_member?)(ptm_typ′)
{-4} range_ptm(cv_base(ptm_typ′))(ofs′)

{1} Cpp_Type?(pointer(typ(cv_base(ptm_typ′)))) ∧

cv(extend[Cpp_Type_, Cpp_Type, bool, false]

(λ (t: Cpp_Type): pointer?(t) ∧ (class?(typ(t)) ∨ union?(typ(t))))) (pointer(typ(cv_base(ptm_typ′))))

Case splitting on Cpp_Type?(pointer(typ(cv_base(ptm_typ!1)))), we get 3 subgoals:

ptm_arrow_TCC1.1.1:

{-1} Cpp_Type?(pointer(typ(cv_base(ptm_typ′))))
{-2} pointer_to_member?(cv_base(ptm_typ′))
{-3} Cpp_Type?(ptm_typ′)
{-4} cv(pointer_to_member?)(ptm_typ′)
{-5} range_ptm(cv_base(ptm_typ′))(ofs′)

{1} Cpp_Type?(pointer(typ(cv_base(ptm_typ′)))) ∧

cv(extend[Cpp_Type_, Cpp_Type, bool, false]

(λ (t: Cpp_Type): pointer?(t) ∧ (class?(typ(t)) ∨ union?(typ(t))))) (pointer(typ(cv_base(ptm_typ′))))

Simplifying, rewriting, and recording with decision procedures, Expanding the definition of extend, Keeping (-1 -2 -4 1) and hiding *, Adding type constraints for typ(cv_base(ptm_typ!1)), Simplifying, rewriting, and recording with decision procedures, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ptm_arrow_TCC1.1.1.

C Proof scripts

ptm_arrow_TCC1.1.2:

{-1} pointer_to_member?(cv_base(ptm_typ′))
{-2} Cpp_Type?(ptm_typ′)
{-3} cv(pointer_to_member?)(ptm_typ′)
{-4} range_ptm(cv_base(ptm_typ′))(ofs′)
{1} Cpp_Type?(pointer(typ(cv_base(ptm_typ′))))

{2} Cpp_Type?(pointer(typ(cv_base(ptm_typ′)))) ∧

cv(extend[Cpp_Type_, Cpp_Type, bool, false]

(λ (t: Cpp_Type): pointer?(t) ∧ (class?(typ(t)) ∨ union?(typ(t))))) (pointer(typ(cv_base(ptm_typ′))))

Hiding formulas: 2, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Splitting conjunctions, we get 2 subgoals:

ptm_arrow_TCC1.1.2.1:

{-1} t′ = pointer(typ(cv_base(ptm_typ′)))
{-2} pointer_to_member?(cv_base(ptm_typ′))

{-3} ∀ (t: Cpp_Type_):

subterm(t, ptm_typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-4} cv(pointer_to_member?)(ptm_typ′)
{-5} range_ptm(cv_base(ptm_typ′))(ofs′)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

2849 C Proof scripts

Hiding formulas: -3, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Adding type constraints for typ(cv_base(ptm_typ!1)), Simplifying, rewriting, and recording with decision procedures, Keeping (-1 -3) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ptm_arrow_TCC1.1.2.1.

ptm_arrow_TCC1.1.2.2:

{-1} subterm(t′, typ(cv_base(ptm_typ′)))
{-2} pointer_to_member?(cv_base(ptm_typ′))

{-3} ∀ (t: Cpp_Type_):

subterm(t, ptm_typ′) ⊃ no_pointers_to_bitfield?(t) ∧ no_pointers_to_references?(t) ∧ no_cv_references?(t) ∧ no_reference_to_reference?(t) ∧ no_reference_to_bitfields?(t) ∧ no_pointer_to_member_to_reference?(t) ∧ no_pointer_to_member_to_cv_void?(t) ∧ no_cv_void_parameter?(t) ∧ no_array_of_references?(t) ∧ no_array_of_cv_void?(t) ∧ no_array_of_function?(t) ∧ no_array_of_abstract_class?(t) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t) ∧ no_array_return_type?(t) ∧ no_function_return_type?(t) ∧ bitfield_underlying_integral_or_enum_type?(t) ∧ cv_array?(t) ∧ enum_underlying_integral?(t) ∧ enum_constants?(t) ∧ const_volatile?(t) ∧ const_stutter?(t) ∧ volatile_stutter?(t) ∧ no_cv_class?(t) ∧ no_cv_union?(t) ∧ no_cv_function?(t) ∧ no_reference_to_void?(t) ∧ no_cv_void?(t) ∧ no_array_of_bitfields?(t)

{-4} cv(pointer_to_member?)(ptm_typ′)
{-5} range_ptm(cv_base(ptm_typ′))(ofs′)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

2851 C Proof scripts

Instantiating the top quantifier in -3 with the terms: (t!1), Splitting conjunctions, we get 2 subgoals:

ptm_arrow_TCC1.1.2.2.1:

{-1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

{-2} subterm(t′, typ(cv_base(ptm_typ′)))
{-3} pointer_to_member?(cv_base(ptm_typ′))
{-4} cv(pointer_to_member?)(ptm_typ′)
{-5} range_ptm(cv_base(ptm_typ′))(ofs′)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

2853

which is trivially true.

This completes the proof of ptm_arrow_TCC1.1.2.2.1.

ptm_arrow_TCC1.1.2.2.2:

{-1} subterm(t′, typ(cv_base(ptm_typ′)))
{-2} pointer_to_member?(cv_base(ptm_typ′))
{-3} cv(pointer_to_member?)(ptm_typ′)
{-4} range_ptm(cv_base(ptm_typ′))(ofs′)
{1} subterm(t′, ptm_typ′)

{2} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Hiding formulas: 2,

Using lemma subterm_cv_base,

Adding type constraints for typ(cv_base(ptm_typ!1)),

Simplifying, rewriting, and recording with decision procedures,

Expanding the definition of subterm,

Replacing using formula -3,

Using lemma subterm_transitive,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Expanding the definition of subterm,

which is trivially true.

This completes the proof of ptm_arrow_TCC1.1.2.2.2.

C.185 Proofs for Posnat_induction (vfiasco-prelude.pvs)

ptm_arrow_TCC1.1.3:

{-1} pointer_to_member?(cv_base(ptm_typ′))
{-2} Cpp_Type?(ptm_typ′)
{-3} cv(pointer_to_member?)(ptm_typ′)
{-4} range_ptm(cv_base(ptm_typ′))(ofs′)

{1} array?(cv_base(ptm_typ′)) ∨ pointer?(cv_base(ptm_typ′)) ∨ reference?(cv_base(ptm_typ′)) ∨ bitfield?(cv_base(ptm_typ′)) ∨ enum?(cv_base(ptm_typ′)) ∨ pointer_to_member?(cv_base(ptm_typ′)) ∨ const?(cv_base(ptm_typ′)) ∨ volatile?(cv_base(ptm_typ′))

{2} Cpp_Type?(pointer(typ(cv_base(ptm_typ′)))) ∧

cv(extend[Cpp_Type_, Cpp_Type, bool, false]

(λ (t: Cpp_Type): pointer?(t) ∧ (class?(typ(t)) ∨ union?(typ(t))))) (pointer(typ(cv_base(ptm_typ′))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of ptm_arrow_TCC1.1.3.

ptm_arrow_TCC1.2:

{-1} Cpp_Type?(ptm_typ′)
{-2} cv(pointer_to_member?)(ptm_typ′)
{-3} range_ptm(cv_base(ptm_typ′))(ofs′)
{1} (pointer_to_member?⊆ interpreted?)

{2} Cpp_Type?(pointer(typ(cv_base(ptm_typ′)))) ∧

cv(extend[Cpp_Type_, Cpp_Type, bool, false]

(λ (t: Cpp_Type): pointer?(t) ∧ (class?(typ(t)) ∨ union?(typ(t))))) (pointer(typ(cv_base(ptm_typ′))))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ptm_arrow_TCC1.2. Q.E.D.

C.185 Proofs for Posnat_induction (vfiasco-prelude.pvs)

C.185.1 Posnat_induction.posnat_induction

Terse proof for posnat_induction.
posnat_induction:

{1} ∀ (p: pred[posnat]):
(p(1) ∧ (∀ j: p(j) ⊃ p(j + 1))) ⊃ (∀ i: p(i))

For the top quantifier in 1, we introduce Skolem constants: (p′), Applying disjunctive simplification to flatten sequent, Inducting on i on formula 1, we get 3 subgoals:

posnat_induction.1:

\begin{matrix}\{-1\} & p′(1) \\ \{-2\} & ∀ j: p′(j) ⊃ p′(j + 1) \\ \{1\} & i′ > 0 \\ \{2\} & p′(i′) \end{matrix}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of posnat_induction.1.

posnat_induction.2:

\begin{matrix}\{-1\} & p′(1) \\ \{-2\} & ∀ j: p′(j) ⊃ p′(j + 1) \\ \{1\} & 0 > 0 ⊃ p′(0) \end{matrix}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of posnat_induction.2.

posnat_induction.3:

\begin{matrix}\{-1\} & p′(1) \\ \{-2\} & ∀ j: p′(j) ⊃ p′(j + 1) \\ \{1\} & ∀ j: (j > 0 ⊃ p′(j)) ⊃ j + 1 > 0 ⊃ p′(j + 1) \end{matrix}

Repeatedly Skolemizing and flattening, Instantiating quantified variables, we get 2 subgoals:

posnat_induction.3.1:

\begin{matrix}\{-1\} & j′ ≥ 0 \\ \{-2\} & j′ > 0 ⊃ p′(j′) \\ \{-3\} & j′ + 1 > 0 \\ \{-4\} & p′(1) \\ \{-5\} & p′(j′) ⊃ p′(j′ + 1) \\ \{1\} & p′(j′ + 1) \end{matrix}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of posnat_induction.3.1.

posnat_induction.3.2:

\begin{matrix}\{-1\} & j′ ≥ 0 \\ \{-2\} & j′ > 0 ⊃ p′(j′) \\ \{-3\} & j′ + 1 > 0 \\ \{-4\} & p′(1) \\ \{1\} & j′ > 0 \\ \{2\} & p′(j′ + 1) \end{matrix}

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of posnat_induction.3.2. Q.E.D.

C.186 Proofs for PostfixExpressions (expressions.pvs)

C.186.1 PostfixExpressions.postinc_TCC1

Terse proof for postinc_TCC1.

C.186 Proofs for PostfixExpressions (expressions.pvs)

postinc_TCC1:

{1} ∀ ((typ: Cpp_Subtype(v(non_bool_integral?)))): cv(non_bool_integral_enum?)(typ)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of postinc_TCC1. Q.E.D.

C.186.2 PostfixExpressions.postinc_float_TCC1

Terse proof for postinc_float_TCC1.
postinc_float_TCC1:

{1} ∀ ((typ: Cpp_Subtype(v(floating_point?)))): cv(floating_point?)(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of postinc_float_TCC1. Q.E.D.

C.186.3 PostfixExpressions.postinc_float_TCC2

Terse proof for postinc_float_TCC2.
postinc_float_TCC2:

{1} ∀ ((typ: Cpp_Subtype(v(floating_point?)))): floating_point?(cv_base(typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

postinc_float_TCC2.1:

{-1} Cpp_Type?(typ′)
{-2} v(floating_point?)(typ′)
{1} cv(floating_point?)(typ′)
{2} floating_point?(cv_base(typ′))

Using lemma postinc_float_TCC1, This completes the proof of postinc_float_TCC2.1.

postinc_float_TCC2.2:

{-1} Cpp_Type?(typ′)
{-2} v(floating_point?)(typ′)
{1} (floating_point?⊆ interpreted?)
{2} floating_point?(cv_base(typ′))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of postinc_float_TCC2.2. Q.E.D.

C.186.4 PostfixExpressions.postinc_float_TCC3

Terse proof for postinc_float_TCC3.
postinc_float_TCC3:

{1} ∀ ((typ: Cpp_Subtype(v(floating_point?))),

n: (range_floating_point(cv_base(typ)))): cv(floating_point?)(cv_base(typ))

Repeatedly Skolemizing and flattening, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of postinc_float_TCC3. Q.E.D.

C.187 Proofs for PrimaryExpressions (expressions.pvs)

This theory contains no provable formal statements.

C.188 Proofs for Pte_type (paging-data.pvs)

This theory contains no provable formal statements.

C.189 Proofs for Pte_type_adt (Pte_type_adt.pvs)

C.189.1 Pte_type_adt.Pte_TCC1

Terse proof for Pte_TCC1.

Pte_TCC1:

{1} ∀ (a: Memory_Address_4G): offset(a) ≥ 0

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Pte_TCC1. Q.E.D.

C.190 Proofs for Pte_type_adt_reduce (Pte_type_adt.pvs)

This theory contains no provable formal statements.

C.191 Proofs for Random_Device (random_device.pvs)

C.191.1 Random_Device.base_TCC1

Terse proof for base_TCC1.

C.191 Proofs for Random_Device (random_device.pvs)

base_TCC1:

{1} ∃ (x: ({m: Memory_Address_4G | m + size ≤ max_linear})): true

Instantiating the top quantifier in 1 with the terms: (Mem(0)), we get 2 subgoals:

base_TCC1.1:

{1} true

which is trivially true. This completes the proof of base_TCC1.1.

base_TCC1.2:

{1} Mem?(Mem(0)`type_of) ∧ (0 ≤ Mem(0)`offset ∧ Mem(0)`offset < max_linear_offset) ∧ Mem(0) + size ≤ max_linear

Using lemma dt_uint_size, Expanding the definition of max_linear, Expanding the definition of Mem, Expanding the definition of +, Expanding the definition of size, Expanding the definition of <=, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of base_TCC1.2. Q.E.D.

C.191.2 Random_Device.rnd_seed_TCC1

Terse proof for rnd_seed_TCC1.

rnd_seed_TCC1:

{1} 0 ≤ (base + 0 × size(uidt(dt_uint)))`offset ∧ (base + 0 × size(uidt(dt_uint)))`offset < max_linear_offset

Installing automatic rewrites from: + < ertimes_ax Adding type constraints for base, Expanding the definition of size, Using lemma dt_uint_size, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of rnd_seed_TCC1. Q.E.D.

C.191.3 Random_Device.mem_cnt_TCC1

Terse proof for mem_cnt_TCC1.

mem_cnt_TCC1:

{1} 0 ≤ (base + 1 × size(uidt(dt_uint)))`offset ∧ (base + 1 × size(uidt(dt_uint)))`offset < max_linear_offset Using lemma dt_uint_size, Adding type constraints for base, Installing automatic rewrites from: + <= < max_linear size Mem ertimes_ax Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of mem_cnt_TCC1. Q.E.D.

C.191.4 Random_Device.rnd_val_TCC1

Terse proof for rnd_val_TCC1.

rnd_val_TCC1:

{1} 0 ≤ (base + 2 × size(uidt(dt_uint)))`offset ∧ (base + 2 × size(uidt(dt_uint)))`offset < max_linear_offset

Using lemma dt_uint_size, Adding type constraints for base, Installing automatic rewrites from: + <= < max_linear size Mem ertimes_ax Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of rnd_val_TCC1. Q.E.D.

C.191.5 Random_Device.increase_access_count_TCC1

Terse proof for increase_access_count_TCC1.
increase_access_count_TCC1:

{1} ∀ (s: Random_device_memory, n: nat):

s`expansion`counter_offset ≤ n + access_count(s)

Repeatedly Skolemizing and flattening, Expanding the definition of access_count, Adding type constraints for s!1‘expansion‘counter_offset, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of increase_access_count_TCC1.

Q.E.D.

C.191.6 Random_Device.clear_counter_TCC1

Terse proof for clear_counter_TCC1.
clear_counter_TCC1:

{1} ∀ (s: Random_device_memory): access_count(s) ≤ s`expansion`memory_access_count

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of clear_counter_TCC1. Q.E.D.

C.191.7 Random_Device.random_TCC1

Terse proof for random_TCC1.

random_TCC1:

{1} ∃ (x_{1}:
[[nat, nat] →

{l: list[Byte] | length[Byte](l) = size(uidt(dt_uint))}]):

true

Instantiating the top quantifier in 1 with the terms: (λ (n_{1}, n_{2}: nat): choose(λ (l: list[Byte]): length(l) = size(uidt(dt_uint)))),

we get 2 subgoals:

random_TCC1.1:

{1} true

which is trivially true. This completes the proof of random_TCC1.1.

random_TCC1.2:

{1} nonempty?[list[Byte]] (λ (l: list[Byte]): length[Byte](l) = size(uidt(dt_uint)))

Expanding the definition of nonempty?, Expanding the definition of empty?, Expanding the definition of member, Rewriting using forall_not, matching in *, Using lemma list_all_length[Byte], This completes the proof of random_TCC1.2. Q.E.D.

C.191.8 Random_Device.read_mem_cnt_TCC1

Terse proof for read_mem_cnt_TCC1.
read_mem_cnt_TCC1:

{1} ∀ (a: Address, bl: list[Byte]): cons?(bl) ∧ a = mem_cnt ⊃ (∀ (s: Random_device_memory): non_bool_integral?(uint))

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_mem_cnt_TCC1. Q.E.D.

C.191.9 Random_Device.read_mem_cnt_TCC2

Terse proof for read_mem_cnt_TCC2.

read_mem_cnt_TCC2:

{1} ∀ (a: Address, bl: list[Byte]): cons?(bl) ∧ a = mem_cnt ⊃ (∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Expanding the definition of max_value, Expanding the definition of range_integral, Using lemma max_uint, Using lemma max_uint_bits, Using lemma pos_expt_gt, Case splitting on extend[real, int, bool, FALSE] (extend[int, nat, bool, FALSE](range_uint)) = ex-

tend[real, nat, bool, FALSE](range_uint), we get 2 subgoals:

read_mem_cnt_TCC2.1:

{-1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint)

{-2} max_value_bits_uint < 2 ˆ max_value_bits_uint
{-3} max_value_bits_uint ≥ 16
{-4} max(range_uint) ≥ (2 ˆ max_value_bits_uint ) − 1

{1} max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧ max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0

Replacing using formula -1, Using lemma max_stable_under_extension[real, nat, ≤], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_mem_cnt_TCC2.1.

read_mem_cnt_TCC2.2:

{-1} max_value_bits_uint < 2 ˆ max_value_bits_uint
{-2} max_value_bits_uint ≥ 16
{-3} max(range_uint) ≥ (2 ˆ max_value_bits_uint ) − 1

{1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {2} max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧

max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_mem_cnt_TCC2.2. Q.E.D.

C.191.10 Random_Device.read_mem_cnt_TCC3

Terse proof for read_mem_cnt_TCC3.

read_mem_cnt_TCC3:

{1} ∀ (a: Address, bl: list[Byte]):

cons?(bl) ∧ a = mem_cnt ⊃ (∀ (s: Random_device_memory):

(range_uint)(rem(max_value(uint)) (access_count(s) − counter_offset(s))))

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Adding type constraints for rem(max_value(uint))(access_count(s!1) - counter_offset(s!1)), we get 2 subgoals:

read_mem_cnt_TCC3.1:

{-1} rem(max_value(uint))(access_count(s′) − counter_offset(s′)) < max_value(uint)
{-2} ∃ q:

access_count(s′) − counter_offset(s′) = rem(max_value(uint))(access_count(s′) − counter_offset(s′)) + max_value(uint) × q

{1} (range_uint)(rem(max_value(uint))(access_count(s′) − counter_offset(s′)))

Using lemma binary_range_uint, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Keeping (-1 2) and hiding *, Expanding the definition of max_value, Expanding the definition of range_integral, Case splitting on extend[real, int, bool, FALSE] (extend[int, nat, bool, FALSE](range_uint)) = ex-

tend[real, nat, bool, FALSE](range_uint), we get 2 subgoals:

read_mem_cnt_TCC3.1.1:

{-1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {-2} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(access_count(s′) − counter_offset(s′)) < max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)))

{1} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(access_count(s′) − counter_offset(s′)) ≤ max(range_uint)

Replacing using formula -1, Using lemma max_stable_under_extension[real, nat, ≤], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_mem_cnt_TCC3.1.1.

read_mem_cnt_TCC3.1.2:

{-1} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(access_count(s′) − counter_offset(s′)) < max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)))

{1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {2} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(access_count(s′) − counter_offset(s′)) ≤ max(range_uint)

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_mem_cnt_TCC3.1.2.

read_mem_cnt_TCC3.2:

{1} max_value(uint) ≥ 0
{2} (range_uint)(rem(max_value(uint))(access_count(s′) − counter_offset(s′)))

Using lemma read_mem_cnt_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_mem_cnt_TCC3.2. Q.E.D.

C.191.11 Random_Device.read_seed_TCC1

Terse proof for read_seed_TCC1.
read_seed_TCC1:

{1} ∀ (a: Address, bl: list[Byte]):

cons?(bl) ∧ a = rnd_seed ⊃ (∀ (s: Random_device_memory): non_bool_integral?(uint))

Repeatedly Skolemizing and flattening, Expanding the definition of non_bool_integral?, Expanding the definition of unsigned_integer?, which is trivially true. This completes the proof of read_seed_TCC1. Q.E.D.

C.191.12 Random_Device.read_seed_TCC2

Terse proof for read_seed_TCC2.
read_seed_TCC2:

{1} ∀ (a: Address, bl: list[Byte]): cons?(bl) ∧ a = rnd_seed ⊃ (∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0)

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Using lemma max_uint, Using lemma max_uint_bits, Using lemma pos_expt_gt, Expanding the definition of max_value, Expanding the definition of range_integral, Case splitting on extend[real, int, bool, FALSE] (extend[int, nat, bool, FALSE](range_uint)) = ex-

tend[real, nat, bool, FALSE](range_uint), we get 2 subgoals:

read_seed_TCC2.1:

{-1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint)

{-2} max_value_bits_uint < 2 ˆ max_value_bits_uint
{-3} max_value_bits_uint ≥ 16
{-4} max(range_uint) ≥ (2 ˆ max_value_bits_uint ) − 1

{1} max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧ max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0

Replacing using formula -1, Using lemma max_stable_under_extension[real, nat, ≤], Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_seed_TCC2.1.

read_seed_TCC2.2:

{-1} max_value_bits_uint < 2 ˆ max_value_bits_uint
{-2} max_value_bits_uint ≥ 16
{-3} max(range_uint) ≥ (2 ˆ max_value_bits_uint ) − 1

{1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {2} max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧

max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_seed_TCC2.2. Q.E.D.

C.191.13 Random_Device.read_seed_TCC3

Terse proof for read_seed_TCC3.
read_seed_TCC3:

{1} ∀ (a: Address, bl: list[Byte]):

cons?(bl) ∧ a = rnd_seed ⊃ (∀ (s: Random_device_memory): (range_uint)(rem(max_value(uint))(seed(s))))

Repeatedly Skolemizing and flattening, Using lemma read_seed_TCC2, Using lemma binary_range_uint, we get 2 subgoals:

read_seed_TCC3.1:

{-1} range_uint(rem(max_value(uint))(seed(s′))) ≡

rem(max_value(uint))(seed(s′)) ≤ max(range_uint) {-2} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0) {-3} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-4} cons?(bl′)
{-5} a′ = rnd_seed
{1} (range_uint)(rem(max_value(uint))(seed(s′)))

Adding type constraints for rem(max_value(uint))(seed(s!1)),

we get 2 subgoals:

read_seed_TCC3.1.1:

{-1} rem(max_value(uint))(seed(s′)) < max_value(uint)
{-2} ∃ q: seed(s′) = rem(max_value(uint))(seed(s′)) + max_value(uint) × q

{-3} range_uint(rem(max_value(uint))(seed(s′))) ≡

rem(max_value(uint))(seed(s′)) ≤ max(range_uint) {-4} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0) {-5} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-6} cons?(bl′)
{-7} a′ = rnd_seed
{1} (range_uint)(rem(max_value(uint))(seed(s′)))

Expanding the definition of max_value,

Expanding the definition of range_integral,

Case splitting on extend[real, int, bool, FALSE] (extend[int, nat, bool, FALSE](range_uint)) = extend[real, nat, bool, FALSE](range_uint),

we get 2 subgoals:

read_seed_TCC3.1.1.1:

{-1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {-2} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(seed(s′)) < max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)))

{-3} ∃ q:

seed(s′) =

rem(max(extend [real, int, bool, false](extend [int, nat, bool, false](range_uint))))(seed(s′)) + max(extend [real, int, bool, false](extend [int, nat, bool, false](range_uint))) × q

{-4} range_uint(rem(max(extend[real, int, bool, false]

(extend[int, nat, bool, false](range_uint))))

(seed(s′)))

≡

rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(seed(s′)) ≤ max(range_uint)

{-5} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory):

max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧ max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0)

{-6} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-7} cons?(bl′)
{-8} a′ = rnd_seed

{1} (range_uint)(rem(max(extend[real, int, bool, false]

(extend[int, nat, bool, false](range_uint))))

(seed(s′)))

Using lemma max_stable_under_extension[real, nat, ≤],

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of read_seed_TCC3.1.1.1.

read_seed_TCC3.1.1.2:

{-1} rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(seed(s′)) < max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)))

{-2} ∃ q:

seed(s′) =

rem(max(extend [real, int, bool, false](extend [int, nat, bool, false](range_uint))))(seed(s′)) + max(extend [real, int, bool, false](extend [int, nat, bool, false](range_uint))) × q

{-3} range_uint(rem(max(extend[real, int, bool, false]

(extend[int, nat, bool, false](range_uint))))

(seed(s′)))

≡

rem(max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))))

(seed(s′)) ≤ max(range_uint)

{-4} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory):

max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) ≥ 0 ∧ max(extend[real, int, bool, false](extend[int, nat, bool, false](range_uint))) > 0)

{-5} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-6} cons?(bl′)
{-7} a′ = rnd_seed

{1} extend[real, int, bool, false](extend[int, nat, bool, false](range_uint)) =

extend[real, nat, bool, false](range_uint) {2} (range_uint)(rem(max(extend[real, int, bool, false]

(extend[int, nat, bool, false](range_uint))))

(seed(s′)))

Keeping (1) and hiding *, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of read_seed_TCC3.1.1.2.

read_seed_TCC3.1.2:

{-1} range_uint(rem(max_value(uint))(seed(s′))) ≡

rem(max_value(uint))(seed(s′)) ≤ max(range_uint) {-2} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0) {-3} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-4} cons?(bl′)
{-5} a′ = rnd_seed
{1} max_value(uint) ≥ 0
{2} (range_uint)(rem(max_value(uint))(seed(s′)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

C.192 Proofs for Read_After_Write_Fails (datatype_model.pvs)

This completes the proof of read_seed_TCC3.1.2.

read_seed_TCC3.2:

{-1} cons?(bl′) ∧ a′ = rnd_seed ⊃

(∀ (s: Random_device_memory): max_value(uint) ≥ 0 ∧ max_value(uint) > 0) {-2} every(λ (x: number):

number_field_pred(x) ∧ real_pred(x) ∧ rational_pred(x) ∧ integer_pred(x) ∧ x ≥ 0 ∧ x < max_byte)

(bl′)

{-3} cons?(bl′)
{-4} a′ = rnd_seed
{1} max_value(uint) ≥ 0
{2} (range_uint)(rem(max_value(uint))(seed(s′)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_seed_TCC3.2. Q.E.D.

C.192 Proofs for Read_After_Write_Fails (datatype_model.pvs)

C.192.1 Read_After_Write_Fails.plain_mem_write_list_states_TCC1

Terse proof for plain_mem_write_list_states_TCC1.
plain_mem_write_list_states_TCC1:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃

OK?[State, Unit](memory_write_list[State](pm`mem)(a, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm`mem)(a, bl)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states_TCC1.

Q.E.D.

C.192.2 Read_After_Write_Fails.plain_mem_write_list_states

Terse proof for plain_mem_write_list_states.

plain_mem_write_list_states:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃ pm`states(state(memory_write_list(pm`mem)(a, bl)(s)))

Repeatedly Skolemizing and flattening, Using lemma transformer_invariant_write_list[State], Replacing using formula -4, Using lemma plain_memory_side_effect_content_unchanged_write_block, Replacing using formula -4, Replacing using formula -3, Replacing using formula -6, Replacing using formula -1, Rewriting using add_as_union, matching in *, Rewriting using transformer_invariant_union_transformers, matching in *, we get 3 subgoals:

plain_mem_write_list_states.1:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))
{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))
{1} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states.1.
plain_mem_write_list_states.2:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(a′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′‘mem)(a′, bl′, false)))))

⊃ result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))

{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))

{1} transformer_invariant?(pm′`states,

memory_write_transformers(pm′`mem,

ad-

dress_block(a′, length(bl′))))

{2} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Using lemma plain_memory_invariant_write_block,

C.192 Proofs for Read_After_Write_Fails (datatype_model.pvs)

Replacing using formula -5, Replacing using formula -7, which is trivially true.

This completes the proof of plain_mem_write_list_states.2.
plain_mem_write_list_states.3:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(a′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′‘mem)(a′, bl′, false)))))

⊃ result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))

{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))

{1} transformer_invariant?(pm′`states,

singleton(expr_2_super(memory_write_side_effect(pm′`mem)

(a′, bl′, false))))

{2} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Using lemma plain_memory_transformer_invariant_write_side_effects, Replacing using formula -5, Replacing using formula -7, Applying transformer_invariant_mono_transformers where transformers_1 gets singleton(expr_2_super(memory_write_side_effect(pm!1‘mem)

(a!1, bl!1, FALSE))), transformers_2 gets memory_write_side_effect_super_transformers(pm!1‘mem, address_block (a!1, length(bl!1))),

Instantiating quantified variables, Replacing using formula -2, Hiding formulas: -2, -3, -4, 2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Expanding the definition of subset?, Expanding the definition of memory_write_side_effect_super_transformers, Expanding the definition of expr_2_super, Expanding the definition of singleton, Expanding the definition of member, Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states.3.

Q.E.D.

C.192.3 Read_After_Write_Fails.plain_mem_write_list_read_list_ok

Terse proof for plain_mem_write_list_read_list_ok.

plain_mem_write_list_read_list_ok:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃

OK?(memory_read_list(pm`mem)(a, size)

(state(memory_write_list(pm`mem)(a, bl)(s))))

Repeatedly Skolemizing and flattening, Using lemma memory_read_list_ok[State], Using lemma plain_memory_transformer_invariant_read_list_block, Replacing using formula -4, Applying subset_bigger_union_right where a gets address_block(a!1, size!1), b gets pm!1‘ro_addr, c

gets pm!1‘rw_addr, Replacing using formula -7, Replacing using formula -1, Replacing using formula -2, Using lemma plain_memory_transformers_ok_read_list_block, Replacing using formula -6, Replacing using formula -2, Replacing using formula -1, Using lemma plain_mem_write_list_states, Replacing using formula -6, Replacing using formula -7, Replacing using formula -8, Replacing using formula -9, Replacing using formula -10, Replacing using formula -1, which is trivially true.

This completes the proof of plain_mem_write_list_read_list_ok.

Q.E.D.

C.192.4 Read_After_Write_Fails.Fatal_Result

Terse proof for Fatal_Result.

Fatal_Result:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(pod_1, a, pm`rw_addr) ⊃ Fatal?((write_data(pm, pod_1)(a, unit) ## read_data(pm, pod_2)(a))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: write_data in_blessed_memory? pod_1 pod_2 length read_data

uidt_1 uidt_2 ## Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma memory_write_list_ok[State], Using lemma plain_memory_transformer_invariant_write_list_block, Using lemma plain_memory_transformers_ok_write_list_block,

C.193 Proofs for Read_After_Write_Fails_2 (datatype_model.pvs)

Using lemma plain_memory_side_effect_content_unchanged_write_block, Replacing using formula -5, Replacing using formula -6, Expanding the definition of length, Expanding the definition of length, Replacing using formula -1, Replacing using formula -2, Replacing using formula -3, Using lemma plain_mem_write_list_read_list_ok, Using lemma plain_mem_write_list_read_list, Expanding the definition of ok_lift, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -6, Keeping (-10) and hiding *, Using lemma list_cons_eta, Using lemma list_cons_eta, Replacing using formula -2, Replacing using formula -1, Keeping (-3) and hiding *, Applying decompose-equality, This completes the proof of Fatal_Result. Q.E.D.

C.193 Proofs for Read_After_Write_Fails_2 (datatype_model.pvs)

C.193.1 Read_After_Write_Fails_2.plain_mem_write_list_states_TCC1

Terse proof for plain_mem_write_list_states_TCC1.
plain_mem_write_list_states_TCC1:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃

OK?[State, Unit](memory_write_list[State](pm`mem)(a, bl)(s)) ∨ Exception?[State, Unit](memory_write_list[State](pm`mem)(a, bl)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states_TCC1.

Q.E.D.

C.193.2 Read_After_Write_Fails_2.plain_mem_write_list_states

Terse proof for plain_mem_write_list_states.

plain_mem_write_list_states:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃ pm`states(state(memory_write_list(pm`mem)(a, bl)(s)))

Repeatedly Skolemizing and flattening, Using lemma transformer_invariant_write_list[State], Replacing using formula -4, Using lemma plain_memory_side_effect_content_unchanged_write_block, Replacing using formula -4, Replacing using formula -3, Replacing using formula -6, Replacing using formula -1, Rewriting using add_as_union, matching in *, Rewriting using transformer_invariant_union_transformers, matching in *, we get 3 subgoals:

plain_mem_write_list_states.1:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))
{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))
{1} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states.1.
plain_mem_write_list_states.2:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(a′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′‘mem)(a′, bl′, false)))))

⊃ result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))

{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))

{1} transformer_invariant?(pm′`states,

memory_write_transformers(pm′`mem,

ad-

dress_block(a′, length(bl′))))

{2} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Using lemma plain_memory_invariant_write_block,

C.193 Proofs for Read_After_Write_Fails_2 (datatype_model.pvs)

Replacing using formula -5, Replacing using formula -7, which is trivially true.

This completes the proof of plain_mem_write_list_states.2.
plain_mem_write_list_states.3:

{-1} side_effect_content_unchanged(address_block(a′, length(bl′)), pm′`states,

memory_write_side_effect(pm′`mem))

{-2} transformer_invariant?(pm′`states,

(memory_write_transformers (pm′‘mem, address_block(a′, length(bl′))) ∪ singleton(expr_2_super (memory_write_side_effect (pm′‘mem)(a′, bl′, false)))))

⊃ result_pred(pm′`states)(expr_2_super(memory_write_list(pm′`mem)(a′, bl′))(s′))

{-3} size′ = length(bl′)
{-4} plain_memory?(pm′)
{-5} pm′`states(s′)
{-6} (address_block(a′, length(bl′)) ⊆ pm′‘rw_addr)
{-7} OK?(memory_write_list(pm′`mem)(a′, bl′)(s′))

{1} transformer_invariant?(pm′`states,

singleton(expr_2_super(memory_write_side_effect(pm′`mem)

(a′, bl′, false))))

{2} pm′`states(state(memory_write_list(pm′`mem)(a′, bl′)(s′)))

Using lemma plain_memory_transformer_invariant_write_side_effects, Replacing using formula -5, Replacing using formula -7, Applying transformer_invariant_mono_transformers where transformers_1 gets singleton(expr_2_super(memory_write_side_effect(pm!1‘mem)

(a!1, bl!1, FALSE))), transformers_2 gets memory_write_side_effect_super_transformers(pm!1‘mem, address_block (a!1, length(bl!1))),

Instantiating quantified variables, Replacing using formula -2, Hiding formulas: -2, -3, -4, 2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Hiding formulas: 2, Expanding the definition of subset?, Expanding the definition of memory_write_side_effect_super_transformers, Expanding the definition of expr_2_super, Expanding the definition of singleton, Expanding the definition of member, Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of plain_mem_write_list_states.3.

Q.E.D.

C.193.3 Read_After_Write_Fails_2.plain_mem_write_list_read_list_ok

Terse proof for plain_mem_write_list_read_list_ok.

plain_mem_write_list_read_list_ok:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State, size: nat, bl: list[Byte]): size = length(bl) ∧ plain_memory?(pm) ∧ pm`states(s) ∧ (address_block(a, size) ⊆ pm‘rw_addr) ∧ OK?(memory_write_list(pm`mem)(a, bl)(s))

⊃

OK?(memory_read_list(pm`mem)(a, size)

(state(memory_write_list(pm`mem)(a, bl)(s))))

Repeatedly Skolemizing and flattening, Using lemma memory_read_list_ok[State], Using lemma plain_memory_transformer_invariant_read_list_block, Replacing using formula -4, Applying subset_bigger_union_right where a gets address_block(a!1, size!1), b gets pm!1‘ro_addr, c

gets pm!1‘rw_addr, Replacing using formula -7, Replacing using formula -1, Replacing using formula -2, Using lemma plain_memory_transformers_ok_read_list_block, Replacing using formula -6, Replacing using formula -2, Replacing using formula -1, Using lemma plain_mem_write_list_states, Replacing using formula -6, Replacing using formula -7, Replacing using formula -8, Replacing using formula -9, Replacing using formula -10, Replacing using formula -1, which is trivially true.

This completes the proof of plain_mem_write_list_read_list_ok.

Q.E.D.

C.193.4 Read_After_Write_Fails_2.Fatal_Result

Terse proof for Fatal_Result.

Fatal_Result:

{1} ∀ (a: Address, pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ pm`states(s) ∧ in_blessed_memory?(pod_bool, a, pm`rw_addr) ⊃ Fatal?((write_data(pm, pod_bool)(a, true) ## read_data(pm, pod_Byte)(a))(s))

Repeatedly Skolemizing and flattening, Expanding the definition of write_data, Expanding the definition of write_data, Expanding the definition of in_blessed_memory?, Expanding the definition of pod_bool, Expanding the definition of ##, Expanding the definition of ##,

C.194 Proofs for Register_Id (constants.pvs)

Using lemma memory_write_list_ok[State], Using lemma plain_memory_transformer_invariant_write_list_block, Expanding the definition of uidt_bool, Expanding the definition of length, Expanding the definition of length, Expanding the definition of length, Replacing using formula -3, Replacing using formula -5, Replacing using formula -1, Using lemma plain_memory_transformers_ok_write_list_block, Replacing using formula -4, Replacing using formula -6, Replacing using formula -1, Using lemma plain_memory_side_effect_content_unchanged_write_block, Replacing using formula -5, Replacing using formula -7, Replacing using formula -1, Replacing using formula -6, Simplifying, rewriting, and recording with decision procedures, Expanding the definition of read_data, Expanding the definition of read_data, Expanding the definition of pod_Byte, Expanding the definition of uidt_Byte, Expanding the definition of ##, Using lemma plain_mem_write_list_read_list_ok, Expanding the definition of length, Expanding the definition of length, Expanding the definition of length, Simplifying, rewriting, and recording with decision procedures, Using lemma plain_mem_write_list_read_list, Expanding the definition of length, Expanding the definition of length, Expanding the definition of length, Replacing using formula -1, Expanding the definition of ok_lift, which is trivially true. This completes the proof of Fatal_Result. Q.E.D.

C.194 Proofs for Register_Id (constants.pvs)

This theory contains no provable formal statements.

C.195 Proofs for Register_Id_adt (Register_Id_adt.pvs)

This theory contains no provable formal statements.

C.196 Proofs for Register_Id_adt_reduce (Register_Id_adt.pvs)

This theory contains no provable formal statements.

C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs)

C.197.1 Rewrite_Test.rewrite_test

Terse proof for rewrite_test.

  rewrite_test:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃

OK?((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1)) (s))

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test.

Q.E.D.

C.197.2 Rewrite_Test.rewrite_test_data_TCC1

Terse proof for rewrite_test_data_TCC1.

C.197 Proofs for Rewrite_Test (plain_memory_rewrites.pvs)

rewrite_test_data_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

pm`states(s) ∧

blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ plain_memory?(pm)

⊃

OK?[State, Data1]

((##[State, Data2, Data1]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Unit, Unit]

(write_data[State, Data1](pm, dt1)(addr1, data1), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data1](pm, dt1)(addr1)), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data2](pm, dt2)(addr2)), read_data[State, Data1](pm, dt1)(addr1)))

(s))

Repeatedly Skolemizing and flattening, Rewriting using rewrite_test, matching in *, This completes the proof of rewrite_test_data_TCC1. Q.E.D.

C.197.3 Rewrite_Test.rewrite_test_data

Terse proof for rewrite_test_data.
rewrite_test_data:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃

data((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1)) (s))

= data1

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data.

Q.E.D.

C.197.4 Rewrite_Test.rewrite_test_data_long_TCC1

Terse proof for rewrite_test_data_long_TCC1.

rewrite_test_data_long_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): pm`states(s) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ plain_memory?(pm)

⊃ OK?[State, Data1]

((##[State, Data2, Data1]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Data2, Unit]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Data2, Unit]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Data2, Unit]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(## [State, Unit, Data1] (##

[State, Data2, Unit]

(##

[State, Unit, Data2]

(##

[State, Data1, Unit]

(##

[State, Unit, Data1]

(##

[State, Data2, Unit]

(##

[State, Unit, Data2]

(##

[State, Data1, Unit]

(##

[State, Unit, Data1]

(##

[State, Data2, Unit]

(##

[State, Unit, Data2]

(##

[State, Data1, Unit]

(##

[State, Unit, Data1]

(##

[State, Data2, Unit]

(##

[State, Unit, Data2]

(##

[State, Data1, Unit]

(##

[State, Unit, Data1]

(##

[State, Unit, Unit] (write_data [State, Data1]

(pm, dt1) (addr1, data1), write_data [State, Data2]

(pm, dt2) (addr2,

data2)), read_data [State, Data1]

(pm, dt1) (addr1)), write_data [State, Data2]

(pm, dt2) (addr2,

data2)), read_data [State, Data2]

(pm, dt2) (addr2)), write_data [State, Data2]

(pm, dt2) (addr2,

data2)), read_data [State, Data1]

(pm, dt1) (addr1)), write_data [State, Data2]

(pm, dt2) (addr2,

data2)), read_data [State, Data2]

(pm, dt2) (addr2)),

write_data [State,

Data2] (pm,

dt2) (addr2,

data2)), read_data [State,

Data1] (pm,

dt1) (addr1)),

write_data [State,

Data2] (pm,

dt2) (addr2,

data2)), read_data [State,

Data2] (pm,

dt2) (addr2)),

write_data [State,

Data2] (pm, dt2) (addr2,

data2)), read_data [State,

Data1] (pm, dt1) (addr1)),

write_data [State,

Data2] (pm, dt2) (addr2,

data2)), read_data [State, Data2] (pm, dt2) (addr2)),

write_data [State, Data2] (pm, dt2) (addr2,

data2)), read_data [State, Data1] (pm, dt1) (addr1)),

write_data [State, Data2] (pm, dt2) (addr2, data2)),

read_data[State, Data2] (pm, dt2)(addr2)),

write_data[State, Data2] (pm, dt2) (addr2, data2)),

read_data[State, Data1] (pm, dt1)(addr1)),

write_data[State, Data2] (pm, dt2)(addr2, data2)),

read_data[State, Data2] (pm, dt2)(addr2)),

write_data[State, Data2] (pm, dt2)(addr2, data2)),

read_data[State, Data1]

(pm, dt1)(addr1)),

write_data[State, Data2]

(pm, dt2)(addr2, data2)),

read_data[State, Data2](pm, dt2)(addr2)), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data1](pm, dt1)(addr1)), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data2](pm, dt2)(addr2)), read_data[State, Data1](pm, dt1)(addr1)))

(s))

2881

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

  This completes the proof of rewrite_test_data_long_TCC1.

Q.E.D.

C.197.5 Rewrite_Test.rewrite_test_data_long

Terse proof for rewrite_test_data_long.

rewrite_test_data_long:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]),

dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State): plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃ data((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ##

read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## read_data(pm, dt1)(addr1)) (s))

= data1

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data_long.

Q.E.D.

C.197.6 Rewrite_Test.rewrite_test_data_eval_if_ok_ok

Terse proof for rewrite_test_data_eval_if_ok_ok.
  rewrite_test_data_eval_if_ok_ok:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃

OK?((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## (λ (d: Data2): read_data(pm, dt1)(addr1))) (s))

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: comp_eval_if_ok_fexpr ok_result_q_ok ok_result_ok ok_result_q_data different_registers_blocks_disjoint

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

  This completes the proof of rewrite_test_data_eval_if_ok_ok.

Q.E.D.

C.197.7 Rewrite_Test.rewrite_test_data_eval_if_ok_TCC1

Terse proof for rewrite_test_data_eval_if_ok_TCC1.
rewrite_test_data_eval_if_ok_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

pm`states(s) ∧

blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ plain_memory?(pm)

⊃

OK?[State, Data1]

((##[State, Data2, Data1]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Unit, Unit]

(write_data[State, Data1](pm, dt1)(addr1, data1), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data1](pm, dt1)(addr1)), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data2](pm, dt2)(addr2)), λ (d: Data2): read_data[State, Data1](pm, dt1)(addr1)))

(s))

Repeatedly Skolemizing and flattening, Rewriting using rewrite_test_data_eval_if_ok_ok, matching in *,

This completes the proof of rewrite_test_data_eval_if_ok_TCC1.

Q.E.D.

C.197.8 Rewrite_Test.rewrite_test_data_eval_if_ok

Terse proof for rewrite_test_data_eval_if_ok.
rewrite_test_data_eval_if_ok:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃

data((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## (λ (d: Data2): read_data(pm, dt1)(addr1))) (s))

= data1

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: comp_eval_if_ok_fexpr ok_result_q_ok ok_result_ok ok_result_q_data different_registers_blocks_disjoint

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

  This completes the proof of rewrite_test_data_eval_if_ok.

Q.E.D.

C.197.9 Rewrite_Test.rewrite_test_data_eval_if_ok_ok_result_ok

Terse proof for rewrite_test_data_eval_if_ok_ok_result_ok.
  rewrite_test_data_eval_if_ok_ok_result_ok:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃

OK?[State, Data2]

((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## (λ (d: Data2): ok_result(d))) (s))

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s Repeatedly Skolemizing and flattening, Installing automatic rewrites from: comp_eval_if_ok_fexpr ok_result_q_ok ok_result_ok

ok_result_q_data different_registers_blocks_disjoint Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of rewrite_test_data_eval_if_ok_ok_result_ok.

Q.E.D.

C.197.10 Rewrite_Test.rewrite_test_data_eval_if_ok_ok_result_TCC1

Terse proof for rewrite_test_data_eval_if_ok_ok_result_TCC1.
rewrite_test_data_eval_if_ok_ok_result_TCC1:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

pm`states(s) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ plain_memory?(pm)

⊃

OK?[State, Data2]

((##[State, Data2, Data2]

(##[State, Unit, Data2]

(##[State, Data1, Unit]

(##[State, Unit, Data1]

(##[State, Unit, Unit]

(write_data[State, Data1](pm, dt1)(addr1, data1), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data1](pm, dt1)(addr1)), write_data[State, Data2](pm, dt2)(addr2, data2)),

read_data[State, Data2](pm, dt2)(addr2)), λ (d: Data2): ok_result[State, Data2](d)))

(s))

Repeatedly Skolemizing and flattening, Rewriting using rewrite_test_data_eval_if_ok_ok_result_ok, matching in *,

This completes the proof of rewrite_test_data_eval_if_ok_ok_result_TCC1.

Q.E.D.

C.197.11 Rewrite_Test.rewrite_test_data_eval_if_ok_ok_result

Terse proof for rewrite_test_data_eval_if_ok_ok_result.

  rewrite_test_data_eval_if_ok_ok_result:

{1} ∀ (addr1, addr2: Address, data1: Data1, data2: Data2, dt1: (interpreted_data_type?[Data1]), dt2: (interpreted_data_type?[Data2]), pm: Plain_Memory[State], s: State):

plain_memory?(pm) ∧ in_blessed_memory?(dt1, addr1, pm`rw_addr) ∧ in_blessed_memory?(dt2, addr2, pm`rw_addr) ∧ blocks_disjoint?(addr1, size(uidt(dt1)), addr2, size(uidt(dt2))) ∧ blocks_disjoint?(addr2, size(uidt(dt2)), addr1, size(uidt(dt1))) ∧ pm`states(s)

⊃

data((write_data(pm, dt1)(addr1, data1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt1)(addr1) ## write_data(pm, dt2)(addr2, data2) ## read_data(pm, dt2)(addr2) ## (λ (d: Data2): ok_result(d))) (s))

= data2

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: comp_eval_if_ok_fexpr ok_result_q_ok ok_result_ok ok_result_q_data different_registers_blocks_disjoint

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

  This completes the proof of rewrite_test_data_eval_if_ok_ok_result.

Q.E.D.

C.198 Proofs for Search_Example (search-example.pvs)

C.198.1 Search_Example.value_TCC1

Terse proof for value_TCC1.

  value_TCC1:

{1} ∃ (x: (range(uint))): true

Instantiating the top quantifier in 1 with the terms: (0),

we get 2 subgoals:

  value_TCC1.1:

{1} true

C.198 Proofs for Search_Example (search-example.pvs)

which is trivially true. This completes the proof of value_TCC1.1.

value_TCC1.2:

{1} range(uint)(0)

Trying repeated skolemization, instantiation, and if-lifting, Rewriting using binary_range_uint, matching in *, Using lemma max_uint, Using lemma max_uint_bits, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of value_TCC1.2. Q.E.D.

C.198.2 Search_Example.Search_Pre_TCC1

Terse proof for Search_Pre_TCC1.
Search_Pre_TCC1:

{1} Cpp_Type?(uint) ∧ cv(non_bool_integral_enum?)(uint)

Applying propositional simplification, we get 2 subgoals:

Search_Pre_TCC1.1:

{1} Cpp_Type?(uint)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC1.1.

Search_Pre_TCC1.2:

{1} cv(non_bool_integral_enum?)(uint)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Search_Pre_TCC1.2. Q.E.D.

C.198.3 Search_Example.Search_Pre_TCC2

Terse proof for Search_Pre_TCC2.

C Proof scripts

Search_Pre_TCC2:

{1} ∀ (s: State):

pm`states(s) ∧ plain_memory?(pm) ⊃ Cpp_Type?(pointer(uint)) ∧ cv(pointer?)(pointer(uint))

Repeatedly Skolemizing and flattening, Keeping (1) and hiding *, Applying propositional simplification, we get 2 subgoals:

Search_Pre_TCC2.1:

{1} Cpp_Type?(pointer(uint))

Expanding the definition of Cpp_Type?, Expanding the definition of subterm, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Splitting conjunctions, we get 2 subgoals:

Search_Pre_TCC2.1.1:

{-1} t′ = pointer(uint)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of Search_Pre_TCC2.1.1.

Search_Pre_TCC2.1.2:

{-1} t′ = uint

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC2.1.2.

Search_Pre_TCC2.2:

{1} cv(pointer?)(pointer(uint))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Search_Pre_TCC2.2. Q.E.D.

C.198.4 Search_Example.Search_Pre_TCC3

Terse proof for Search_Pre_TCC3.
Search_Pre_TCC3:

{1} ∀ (s: State): pm`states(s) ∧ plain_memory?(pm) ⊃ Cpp_Type?(pointer(uint))

Repeatedly Skolemizing and flattening, Using lemma Search_Pre_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC3.

Q.E.D.

C.198.5 Search_Example.Search_Pre_TCC4

Terse proof for Search_Pre_TCC4.
Search_Pre_TCC4:

{1} ∀ (s: State): pm`states(s) ∧ plain_memory?(pm) ⊃ pointer?(cv_base(pointer(uint)))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, we get 2 subgoals:

Search_Pre_TCC4.1:

{-1} pm`states(s′)
{-2} plain_memory?(pm)
{1} cv(pointer?)(pointer(uint))
{2} pointer?(cv_base(pointer(uint)))

Using lemma Search_Pre_TCC2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC4.1.

Search_Pre_TCC4.2:

{-1} pm`states(s′)
{-2} plain_memory?(pm)
{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(pointer(uint)))

Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of Search_Pre_TCC4.2. Q.E.D.

C.198.6 Search_Example.Search_Pre_TCC5

Terse proof for Search_Pre_TCC5.

Search_Pre_TCC5:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))] (read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(first)(s))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_read_data_ok, matching in *, This completes the proof of Search_Pre_TCC5. Q.E.D.

C.198.7 Search_Example.Search_Pre_TCC6

Terse proof for Search_Pre_TCC6.
Search_Pre_TCC6:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))] (read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(last)(s)))

Repeatedly Skolemizing and flattening, Rewriting using plain_memory_read_data_ok, matching in *, This completes the proof of Search_Pre_TCC6. Q.E.D.

C.198.8 Search_Example.Search_Pre_TCC7

Terse proof for Search_Pre_TCC7.
Search_Pre_TCC7:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (last_value: ((range_pointer(cv_base(pointer(uint)))))): not_null?(pointer(uint))(last_value) ∧ not_null?(pointer(uint))(first_value) ∧ last_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ⊃ (∀ (i: below[N]): Cpp_Type?(uint))))

Repeatedly Skolemizing and flattening, Using lemma Search_Pre_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC7. Q.E.D.

C.198.9 Search_Example.Search_Pre_TCC8

Terse proof for Search_Pre_TCC8.

Search_Pre_TCC8:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (last_value: ((range_pointer(cv_base(pointer(uint)))))): not_null?(pointer(uint))(last_value) ∧ not_null?(pointer(uint))(first_value) ∧ last_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ⊃ (∀ (i: below[N]): up?[Memory_Address] (address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint)))))))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *, Keeping (-17 1) and hiding *, Using lemma add_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC8. Q.E.D.

C.198.10 Search_Example.Search_Pre_TCC9

Terse proof for Search_Pre_TCC9.

C.198 Proofs for Search_Example (search-example.pvs)

Search_Pre_TCC9:

{1} ∀ (s: State): blocks_disjoint?(current, size_of(pointer(uint)), last, size_of(pointer(uint))) ∧ blocks_disjoint?(last, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ blocks_disjoint?(current, size_of(pointer(uint)), first, size_of(pointer(uint))) ∧ blocks_disjoint?(first, size_of(pointer(uint)), current, size_of(pointer(uint))) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), current, pm`rw_addr) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(last)(s) ∧ valid_in_mem(pm, dt_cv_pointer(pointer(uint)))(first)(s) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), last, (pm‘ro_addr∪ pm‘rw_addr)) ∧ in_blessed_memory?(dt_cv_pointer(pointer(uint)), first, (pm‘ro_addr∪ pm‘rw_addr)) ∧ pm`states(s) ∧ plain_memory?(pm) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (last_value: ((range_pointer(cv_base(pointer(uint)))))): (∀ (i: below[N]): valid_in_mem(pm, dt(uint)) (down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint))))) (s)) ∧ (∀ (i: below[N]): blocks_disjoint?(current, size_of(pointer(uint)), down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint)))), size_of(uint))) ∧ (∀ (i: below[N]): blocks_disjoint?(down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint)))), size_of(uint), current, size_of(pointer(uint)))) ∧ (∀ (i: below[N]): in_blessed_memory?[(range(uint))] (dt(uint), down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint)))), (pm‘ro_addr∪ pm‘rw_addr))) ∧ not_null?(pointer(uint))(last_value) ∧ not_null?(pointer(uint))(first_value) ∧ last_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ⊃ Cpp_Type?(uint)))

Repeatedly Skolemizing and flattening, Using lemma Search_Pre_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of Search_Pre_TCC9. Q.E.D.

C.198.11 Search_Example.search_TCC1

Terse proof for search_TCC1.

search_TCC1:

{1} Cpp_Type?(pointer(uint)) ∧ cv(pointer?)(pointer(uint))

Applying propositional simplification, we get 2 subgoals:

search_TCC1.1:

{1} Cpp_Type?(pointer(uint))

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Expanding the definition of subterm, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Splitting conjunctions, we get 2 subgoals:

search_TCC1.1.1:

{-1} t′ = pointer(uint)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Keeping (-2) and hiding *,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of search_TCC1.1.1.

search_TCC1.1.2:

{-1} t′ = uint

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_TCC1.1.2.

search_TCC1.2:

{1} cv(pointer?)(pointer(uint))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of search_TCC1.2. Q.E.D.

C.198.12 Search_Example.search_TCC2

Terse proof for search_TCC2.

search_TCC2:

{1} Cpp_Type?(pointer(uint))

Using lemma search_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_TCC2. Q.E.D.

C.198.13 Search_Example.search_TCC3

Terse proof for search_TCC3.

search_TCC3:

{1} pointer?(cv_base(pointer(uint)))

Rewriting using cv_base_result, matching in *, we get 2 subgoals:

search_TCC3.1:

{1} cv(pointer?)(pointer(uint))
{2} pointer?(cv_base(pointer(uint)))

Using lemma search_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_TCC3.1.

search_TCC3.2:

{1} (pointer? ⊆ interpreted?)
{2} pointer?(cv_base(pointer(uint)))

Hiding formulas: 2, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of search_TCC3.2. Q.E.D.

C.198.14 Search_Example.search_TCC4

Terse proof for search_TCC4.

search_TCC4:

{1} Cpp_Type?(pointer(uint)) ∧ v(pointer?)(pointer(uint))

Applying propositional simplification, we get 2 subgoals:

search_TCC4.1:

{1} Cpp_Type?(pointer(uint))

Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references? no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Expanding the definition of subterm, Splitting conjunctions, we get 2 subgoals:

search_TCC4.1.1:

{-1} t′ = pointer(uint)

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of search_TCC4.1.1.

search_TCC4.1.2:

{-1} t′ = uint

{1} no_pointers_to_bitfield?(t′) ∧ no_pointers_to_references?(t′) ∧ no_cv_references?(t′) ∧ no_reference_to_reference?(t′) ∧ no_reference_to_bitfields?(t′) ∧ no_pointer_to_member_to_reference?(t′) ∧ no_pointer_to_member_to_cv_void?(t′) ∧ no_cv_void_parameter?(t′) ∧ no_array_of_references?(t′) ∧ no_array_of_cv_void?(t′) ∧ no_array_of_function?(t′) ∧ no_array_of_abstract_class?(t′) ∧ no_pointer_or_ref_to_incomplete_array_parameter?(t′) ∧ no_array_return_type?(t′) ∧ no_function_return_type?(t′) ∧ bitfield_underlying_integral_or_enum_type?(t′) ∧ cv_array?(t′) ∧ enum_underlying_integral?(t′) ∧ enum_constants?(t′) ∧ const_volatile?(t′) ∧ const_stutter?(t′) ∧ volatile_stutter?(t′) ∧ no_cv_class?(t′) ∧ no_cv_union?(t′) ∧ no_cv_function?(t′) ∧ no_reference_to_void?(t′) ∧ no_cv_void?(t′) ∧ no_array_of_bitfields?(t′)

Replacing using formula -1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_TCC4.1.2.

search_TCC4.2:

{1} v(pointer?)(pointer(uint))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of search_TCC4.2. Q.E.D.

C.198.15 Search_Example.deref_current_TCC1

Terse proof for deref_current_TCC1.
deref_current_TCC1:

{1} ∀ (s: State):

read_current(s) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))]

(read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(current)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of deref_current_TCC1. Q.E.D.

C.198.16 Search_Example.deref_current_TCC2

Terse proof for deref_current_TCC2.
deref_current_TCC2:

{1} ∀ (s: State): read_current(s) ⊃ (∀ (current_value: ((range_pointer(cv_base(pointer(uint)))))): not_null?(pointer(uint))(current_value) ∧ current_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(current)(s)) ⊃ up?[Memory_Address](address_of(pointer(uint))(current_value)))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *, This completes the proof of deref_current_TCC2. Q.E.D.

C.198.17 Search_Example.read_array_TCC1

Terse proof for read_array_TCC1.
read_array_TCC1:

{1} ∀ (s: State):

read_first(s) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))]

(read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(first)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of read_first, which is trivially true. This completes the proof of read_array_TCC1. Q.E.D.

C.198.18 Search_Example.read_array_TCC2

Terse proof for read_array_TCC2.
read_array_TCC2:

{1} ∀ (s: State):

read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

not_null?(pointer(uint))(first_value) ∧

first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]): Cpp_Type?(uint)))

Repeatedly Skolemizing and flattening, Using lemma Search_Pre_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_array_TCC2. Q.E.D.

C.198.19 Search_Example.read_array_TCC3

Terse proof for read_array_TCC3.
read_array_TCC3:

{1} ∀ (s: State):

read_first(s) ⊃

(∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))): not_null?(pointer(uint))(first_value) ∧ first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]):

up?[Memory_Address]

(address_of(pointer(uint))

(add(pointer(uint)) (first_value, i × size_of(uint))))))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *, Using lemma add_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of read_array_TCC3. Q.E.D.

C.198.20 Search_Example.not_found_TCC1

Terse proof for not_found_TCC1.
not_found_TCC1:

{1} ∀ (s: State):

read_array(s) ∧ read_last(s) ∧ read_current(s) ∧ read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]): Cpp_Type?(uint)))

Repeatedly Skolemizing and flattening, Using lemma Search_Pre_TCC1, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of not_found_TCC1. Q.E.D.

C.198.21 Search_Example.not_found_TCC2

Terse proof for not_found_TCC2.

not_found_TCC2:

{1} ∀ (s: State):

read_array(s) ∧ read_last(s) ∧ read_current(s) ∧ read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]):

up?[Memory_Address]

(address_of(pointer(uint))

(add(pointer(uint))

(first_value, i × size_of(uint))))))

Repeatedly Skolemizing and flattening, Rewriting using address_of_spec, matching in *, Using lemma add_spec, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of read_array, which is trivially true. This completes the proof of not_found_TCC2. Q.E.D.

C.198.22 Search_Example.not_found_TCC3

Terse proof for not_found_TCC3.
not_found_TCC3:

{1} ∀ (s: State):

read_array(s) ∧ read_last(s) ∧ read_current(s) ∧ read_first(s) ⊃ (∀ (first_value: ((range_pointer(cv_base(pointer(uint)))))):

first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) ⊃ (∀ (i: below[N]):

OK?[State, ((range(uint)))]

(read_data[State, ((range(uint)))] (pm[State], dt(uint)) (down[Memory_Address]

(address_of(pointer(uint))

(add(pointer(uint))

(first_value, i × size_of(uint)))))

(s))))

Repeatedly Skolemizing and flattening, Expanding the definition of read_array, Replacing using formula -7, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, This completes the proof of not_found_TCC3. Q.E.D.

C.198.23 Search_Example.not_found_TCC4

Terse proof for not_found_TCC4.

not_found_TCC4:

{1} ∀ (s: State): read_first(s) ∧ read_current(s) ∧ read_last(s) ∧ read_array(s) ∧ (let first_value = data(read_data(pm, dt_cv_pointer(pointer(uint)))(first)(s)) in ∀ (i: below[N]): (data(read_data(pm, dt(uint)) (down(address_of(pointer(uint)) (add(pointer(uint)) (first_value, i × size_of(uint))))) (s)) ≠ value)) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))] (read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(last)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of read_last, which is trivially true. This completes the proof of not_found_TCC4. Q.E.D.

C.198.24 Search_Example.found_TCC1

Terse proof for found_TCC1.

found_TCC1:

{1} ∀ (s: State):

deref_current(s) ∧ read_array(s) ∧ read_last(s) ∧ read_current(s) ∧ read_first(s) ⊃ OK?[State, ((range_pointer(cv_base(pointer(uint)))))]

(read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(last)(s))

Repeatedly Skolemizing and flattening, Expanding the definition of read_last, which is trivially true. This completes the proof of found_TCC1. Q.E.D.

C.198.25 Search_Example.found_TCC2

Terse proof for found_TCC2.

C Proof scripts

found_TCC2:

{1} ∀ (s: State): read_first(s) ∧ read_current(s) ∧ read_last(s) ∧ read_array(s) ∧ deref_current(s) ∧ data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ≠ data(read_data(pm, dt_cv_pointer(pointer(uint)))(current)(s)) ⊃ up?[Memory_Address] (address_of(pointer(uint)) (data[State, ((range_pointer(cv_base(pointer(uint)))))] (read_data[State, ((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint)))(current) (s))))

Repeatedly Skolemizing and flattening, Expanding the definition of deref_current, Applying disjunctive simplification to flatten sequent, Rewriting using address_of_spec, matching in *, Expanding the definition of cv_base, which is trivially true. This completes the proof of found_TCC2. Q.E.D.

C.198.26 Search_Example.found_TCC3

Terse proof for found_TCC3.

found_TCC3:

{1} ∀ (s: State):

read_first(s) ∧ read_current(s) ∧ read_last(s) ∧ read_array(s) ∧ deref_current(s) ∧ data(read_data(pm, dt_cv_pointer(pointer(uint)))(last)(s)) ≠ data(read_data(pm, dt_cv_pointer(pointer(uint)))(current)(s))

⊃

OK?[State, ((range(uint)))]

(read_data[State, ((range(uint)))] (pm[State], dt(uint)) (down[Memory_Address]

(address_of(pointer(uint))

(data[State, ((range_pointer(cv_base(pointer(uint)))))]

(read_data

[State,

((range_pointer(cv_base(pointer(uint)))))] (pm[State], dt_cv_pointer(pointer(uint))) (current)(s)))))

(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of found_TCC3. Q.E.D.

C.198.27 Search_Example.uchar_range_values_TCC1

Terse proof for uchar_range_values_TCC1.
uchar_range_values_TCC1:

{1} ∀ (n: nat): n ≤ 255 ⊃ Cpp_Type?(uchar) ∧ cv(non_bool_integral_enum?)(uchar)

Repeatedly Skolemizing and flattening, Applying propositional simplification, we get 2 subgoals:

uchar_range_values_TCC1.1:

{-1} n′ ≥ 0
{-2} n′ ≤ 255
{1} Cpp_Type?(uchar)

Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void? no_array_of_bitfields?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of uchar_range_values_TCC1.1.
uchar_range_values_TCC1.2:

{-1} n′ ≥ 0
{-2} n′ ≤ 255
{1} cv(non_bool_integral_enum?)(uchar)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of uchar_range_values_TCC1.2.

Q.E.D.

C.198.28 Search_Example.uchar_range_values

Terse proof for uchar_range_values.
uchar_range_values:

{1} ∀ (n: nat): n ≤ 255 ⊃ range(uchar)(n)

Repeatedly Skolemizing and flattening, Expanding the definition of range, Expanding the definition of range_integral, Expanding the definition of extend, Using lemma binary_range_uchar, Using lemma max_uchar, Using lemma min_max_value_bits_uchar, Trying repeated skolemization, instantiation, and if-lifting, Using lemma expt_ge1, Expanding the definition of ^, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of uchar_range_values. Q.E.D.

C.198.29 Search_Example.search_terminates

Terse proof for search_terminates.
search_terminates:

{1} Valid(Search_Pre, search, λ (s: State): true)

Installing automatic rewrites from: valid Valid Search_Pre search Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax

er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of search_terminates.

Q.E.D.

C.198.30 Search_Example.search_read_first

Terse proof for search_read_first.
  search_read_first:

{1} valid(Search_Pre, search, read_first)

Installing automatic rewrites from: valid Valid Search_Pre search read_first search_terminates

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of search_read_first. Q.E.D.

C.198.31 Search_Example.search_read_current

Terse proof for search_read_current.
  search_read_current:

{1} valid(Search_Pre, search, read_current)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first search_terminates

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of search_read_current.

Q.E.D.

C.198.32 Search_Example.search_deref_current

Terse proof for search_deref_current.
  search_deref_current:

{1} valid(Search_Pre, search, deref_current)

Installing automatic rewrites from: valid Valid Search_Pre N search read_first deref_current search_read_current read_current search_terminates search_read_first

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 address_add_zero address_add_sum same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Instantiating the top quantifier in -14 with the terms: (0),

Instantiating the top quantifier in -15 with the terms: (0),

Instantiating the top quantifier in -16 with the terms: (0),

Instantiating the top quantifier in -17 with the terms: (0),

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of search_deref_current.

Q.E.D.

C.198.33 Search_Example.search_read_last

Terse proof for search_read_last.
  search_read_last:

{1} valid(Search_Pre, search, read_last)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first deref_current read_last search_current search_deref_current search_terminates N

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of search_read_last.

Q.E.D.

C.198.34 Search_Example.search_read_array

Terse proof for search_read_array.
  search_read_array:

{1} valid(Search_Pre, search, read_array)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first deref_current read_last search_current search_deref_current search_read_last read_array search_terminates N

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement,

This completes the proof of search_read_array.

Q.E.D.

C.198.35 Search_Example.search_not_found

Terse proof for search_not_found.
  search_not_found:

{1} valid(Search_Pre, search, not_found)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first deref_current read_last search_current search_deref_current search_read_last read_array search_read_array not_found search_terminates N

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok! stmt_while_inv_rewrite_data_break! stmt_while_inv_rewrite_data_return! pm_q_prop_while! pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement,

This completes the proof of search_not_found.

Q.E.D.

C.198.36 Search_Example.search_found

Terse proof for search_found.

  search_found:

{1} valid(Search_Pre, search, found)

Installing automatic rewrites from: valid Valid Search_Pre search read_first read_current search_read_first deref_current read_last search_current search_deref_current search_read_last read_array search_read_array not_found search_not_found found search_terminates N

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Repeatedly Skolemizing and flattening,

Installing automatic rewrites from: mod_range size_of uidt er_plus_ax er_minus_ax er_div_ax er_times_ax er_neg_ax address_of_spec address_of_spec2 add_spec add_spec2 same_array_spec same_array_spec2 check_bounds_spec extended_real_superset_of_number_fields

Installing automatic rewrites from: literal id member postinc postdec deref arrow unary_minus unary_minus_unsigned unary_not unary_bitnot preinc predec UnaryExpressions.sizeof ptm_member ptm_arrow arrow times div div_float mod plus plus_ptr postinc_ptr preinc_ptr subscript minus minus_ptr postdec_ptr predec_ptr minus_ptr_ptr cmp lt gt le ge lt_ptr gt_ptr le_ptr ge_ptr cmp_pointer eq_bool eq not_equal not_equal_bool eq_ptr not_equal_ptr bitand bitxor bitor and_exp or_exp conditional_expr assign assign_times assign_div assign_mod assign_div_float assign_plus assign_plus_ptr assign_minus assign_minus_ptr assign_bitand assign_bitxor assign_bitor comma

Installing automatic rewrites from: plain_memory_write_ok_single plain_memory_read_data_ok plain_memory_write_ok_q_expr plain_memory_write_ok_q_stmt in_blessed_memory_rw_ro pm_q_prop_ok pm_q_prop_single_read pm_q_prop_single_write pm_q_prop_read_write_single pm_q_prop_read_write_other_single pm_q_prop_read_read_single plain_memory_read_write_other_single_data plain_memory_read_read plain_memory_read_write_res pm_q_prop_read_ok_expr pm_q_prop_read_ok_stmt pm_q_prop_read_pm_q_prop_expr pm_q_prop_read_pm_q_prop_stmt pm_q_prop_read_write_q_expr pm_q_prop_read_write_q_stmt plain_memory_read_write_q_data_expr plain_memory_read_write_q_data_stmt pm_q_prop_read_write_other_q_expr pm_q_prop_read_write_other_q_stmt pm_q_prop_read_read_q_expr pm_q_prop_read_read_q_stmt plain_memory_read_write_other_q_data_expr plain_memory_read_write_other_q_data_stmt plain_memory_read_read_q_data_expr plain_memory_read_read_q_data_stmt pm_q_prop_ok_result_single pm_q_prop_ok_result_q_expr pm_q_prop_ok_result_q_stmt pm_q_prop_read_ok_result_single pm_q_prop_read_ok_result_q_expr pm_q_prop_read_ok_result_q_stmt pm_q_prop_e2s pm_q_prop_stmt_e2s pm_q_prop_read_e2s pm_q_prop_read_stmt_e2s pm_q_prop_read_ok__pm_q_prop_read_expr pm_q_prop_read_ok__pm_q_prop_read_stmt

Installing automatic rewrites from: if_else switch member break_catch_break break_break_stmt break_break_catch_continue break_break_catch_default break_break_lift_stmt break_break_case break_break_default break_break stmt_break_break break_stmt_break break_stmt_catch_continue break_stmt_catch_default break_stmt_lift break_stmt_case break_stmt_default continue_catch_continue continue_break_stmt continue_break_catch_continue continue_break_catch_default continue_break_lift_stmt continue_break_case continue_break_default continue_continue stmt_continue_continue continue_stmt_continue continue_stmt_catch_continue continue_stmt_catch_default continue_stmt_lift continue_stmt_case continue_stmt_default switch_stmt stmt_switch_stmt switch_case_taken stmt_switch_case_taken switch_case_not_taken stmt_switch_case_not_taken switch_default stmt_switch_default switch_catch_break stmt_switch_catch_break switch_catch_continue stmt_switch_catch_continue switch_catch_default stmt_switch_catch_default default_stmt stmt_default_stmt default_case stmt_default_case default_default stmt_default_default default_catch_break stmt_default_catch_break default_catch_continue stmt_default_catch_continue default_catch_default stmt_default_catch_default return_void_result return_ex_result stmt_remove_catch_default stmt_remove_case stmt_remove_default stmt_remove_catch_continue stmt_remove_catch_break break_break_stmt_expr break_break_catch_continue_expr break_break_catch_default_expr break_break_lift_stmt_expr break_break_case_expr break_break_default_expr continue_break_stmt_expr continue_break_catch_continue_expr continue_break_catch_default_expr continue_break_lift_stmt_expr continue_break_case_expr continue_break_default_expr

Installing automatic rewrites from: skip_ok skip_state skip_elemination stmt_skip_elemination stmt_ok_lift stmt_ok_lift_expr e2s_ok stmt_e2s_ok e2s_state stmt_e2s_state ok_result_fexpr ok_result_fstmt e2s_merge stmt_e2s_merge e2s_expr stmt_e2s_expr

Installing automatic rewrites from: while_unroll stmt_while_unroll iterate_while_ok while_hang while_unroll_expr while_unroll_lexpr stmt_while_unroll_expr stmt_while_unroll_lexpr while_unroll_0 do_while_unroll do_while_inv_unroll for_unroll for_inv_unroll while_to_while_no_cb while_invariant?! while_variant?! while_inv_rewrite_termination_result! while_inv_rewrite_data_ok! while_inv_rewrite_data_break! while_inv_rewrite_data_return! stmt_while_inv_rewrite_termination_result! stmt_while_inv_rewrite_data_ok!

stmt_while_inv_rewrite_data_break!  stmt_while_inv_rewrite_data_return!  pm_q_prop_while!

pm_q_prop_stmt_while!

Installing automatic rewrites from: composition_assoc_rewrite_stmt_ok forward_s_c_s_of_s_expr comp_eval_if_ok_fstmt stmt_eval_if_ok_fstmt comp_eval_if_ok_fstmt_cstmt stmt_eval_if_ok_fstmt_cstmt composition_assoc_rewrite_1 composition_assoc_rewrite_2 composition_assoc_rewrite_3 composition_assoc_rewrite_4 composition_assoc_rewrite_5 composition_assoc_rewrite_6 composition_assoc_rewrite_7 composition_assoc_rewrite_8 composition_assoc_rewrite_expr_1 composition_assoc_rewrite_expr_2 composition_assoc_rewrite_expr_3 composition_assoc_rewrite_expr_4 composition_assoc_rewrite_expr_5 composition_assoc_rewrite_expr_6 composition_assoc_rewrite_stmt_ok composition_assoc_rewrite_stmt_ok_expr composition_assoc_rewrite_stmt_ok_expr_lexpr comp_eval_if_ok_fstmt comp_eval_if_ok_fstmt_expr comp_eval_if_ok_fstmt_cstmt_expr stmt_eval_if_ok_fstmt_expr stmt_eval_if_ok_fstmt_cstmt_expr comp_eval_if_ok_fexpr_expr comp_eval_if_ok_fexpr stmt_eval_if_ok_fexpr expr_eval_if_ok_fexpr composition_assoc_expression_rewrite composition_assoc_expression_rewrite_stmt stmt_eval_if_ok_fexpr_expr expr_eval_if_ok_fexpr_expr ok_result_fexpr ok_result_fstmt composition_assoc_rewrite_stmt_ok_cstmt

Installing automatic rewrites from: allocate_stack deallocate_stack with_new_stackvar

Installing automatic rewrites from: ok_result_ok ok_result_data ok_result_q_ok ok_result_q_state ok_result_q_data ok_result_elemination_1 ok_result_elemination_2 ok_result_state

Installing automatic rewrites from: l2r integral_to_bool pointer_to_bool bool2int

Installing automatic rewrites from: comp_simple_expr_simple_expr_ok comp_simple_expr_simple_expr_data comp_simple_expr_simple_expr_state comp_simple_stmt_simple_expr_ok comp_simple_stmt_simple_expr_data comp_simple_stmt_simple_expr_state

Installing automatic rewrites from: floating_point?

Installing automatic rewrites from: cv_base_result2 cv_base_result_c cv_base_result_v cv_base_result_cv cv c v

Installing automatic rewrites from: uchar_range_values

Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier instantiation, skolemization, if-lifting and equality replacement,

This completes the proof of search_found.

Q.E.D.

C.199 Proofs for Segment_Reg_Datatype (paging-data.pvs)

C.199.1 Segment_Reg_Datatype.segment_selector_data_type_TCC1

Terse proof for segment_selector_data_type_TCC1.
  segment_selector_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[Segment_Selector_type])): true

Rewriting using segment_selector_type_exists, matching in *,

  This completes the proof of segment_selector_data_type_TCC1.

Q.E.D.

C.199.2 Segment_Reg_Datatype.segment_reg_data_type_TCC1

Terse proof for segment_reg_data_type_TCC1.
  segment_reg_data_type_TCC1:

{1} ∃ (x: (pod_data_type?[Segment_Reg_type])): true

C.200 Proofs for Segment_Types (paging-data.pvs)

Using lemma segment_reg_data_type_exists,

This completes the proof of segment_reg_data_type_TCC1.

Q.E.D.

C.200 Proofs for Segment_Types (paging-data.pvs)

This theory contains no provable formal statements.

C.201 Proofs for SelectionStatements (statements.pvs)

This theory contains no provable formal statements.

C.202 Proofs for Set_Lift (vfiasco-prelude.pvs)

This theory contains no provable formal statements.

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.1 Single_Statement_Rewrites0.break_catch_break

Terse proof for break_catch_break.
break_catch_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## break ## catch_break)(s) = stmt(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of break_catch_break. Q.E.D.

C.203.2 Single_Statement_Rewrites0.break_break_stmt

Terse proof for break_break_stmt.
break_break_stmt:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## stmt1 ## catch_break)(s) = (stmt ## catch_break)(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of break_break_stmt. Q.E.D.

C.203.3 Single_Statement_Rewrites0.break_break_catch_continue

Terse proof for break_break_catch_continue.
break_break_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## catch_continue ## catch_break)(s) = (stmt ## catch_break)(s)

,

This completes the proof of break_break_catch_continue.

Q.E.D.

C.203.4 Single_Statement_Rewrites0.break_break_catch_default

Terse proof for break_break_catch_default.
break_break_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## catch_default ## catch_break)(s) = (stmt ## catch_break)(s)

,

This completes the proof of break_break_catch_default.

Q.E.D.

C.203.5 Single_Statement_Rewrites0.break_break_lift_stmt

Terse proof for break_break_lift_stmt.
break_break_lift_stmt:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## lift(stmt1) ## catch_break)(s) = (stmt ## catch_break)(s)

, This completes the proof of break_break_lift_stmt. Q.E.D.

C.203.6 Single_Statement_Rewrites0.break_break_case

Terse proof for break_break_case.
break_break_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## case(n) ## catch_break)(s) = (stmt ## catch_break)(s)

, This completes the proof of break_break_case. Q.E.D.

C.203 Proofs for Single_Statement_Rewrites0 (statement-rewrites.pvs)

C.203.7 Single_Statement_Rewrites0.break_break_default

Terse proof for break_break_default.
break_break_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## default ## catch_break)(s) = (stmt ## catch_break)(s)

, This completes the proof of break_break_default. Q.E.D.

C.203.8 Single_Statement_Rewrites0.break_break

Terse proof for break_break.

break_break:

{1} ∀ (s: State): Break?(break(s))

, This completes the proof of break_break. Q.E.D.

C.203.9 Single_Statement_Rewrites0.stmt_break_break

Terse proof for stmt_break_break.
stmt_break_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ Break?((stmt ## break)(s))

, This completes the proof of stmt_break_break. Q.E.D.

C.203.10 Single_Statement_Rewrites0.break_stmt_break

Terse proof for break_stmt_break.
break_stmt_break:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ Break?((stmt ## stmt1)(s))

, This completes the proof of break_stmt_break. Q.E.D.

C.203.11 Single_Statement_Rewrites0.break_stmt_catch_continue

Terse proof for break_stmt_catch_continue.
break_stmt_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ Break?((stmt ## catch_continue)(s))

,

This completes the proof of break_stmt_catch_continue.

Q.E.D.

C.203.12 Single_Statement_Rewrites0.break_stmt_catch_default

Terse proof for break_stmt_catch_default.
break_stmt_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ Break?((stmt ## catch_default)(s))

,

This completes the proof of break_stmt_catch_default.

Q.E.D.

C.203.13 Single_Statement_Rewrites0.break_stmt_lift

Terse proof for break_stmt_lift.
break_stmt_lift:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ Break?((stmt ## lift(stmt1))(s))

, This completes the proof of break_stmt_lift. Q.E.D.

C.203.14 Single_Statement_Rewrites0.break_stmt_case

Terse proof for break_stmt_case.
break_stmt_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ Break?((stmt ## case(n))(s))

, This completes the proof of break_stmt_case. Q.E.D.

C.203.15 Single_Statement_Rewrites0.break_stmt_default

Terse proof for break_stmt_default.
break_stmt_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ Break?((stmt ## default)(s))

, This completes the proof of break_stmt_default. Q.E.D.

C.203.16 Single_Statement_Rewrites0.continue_catch_continue

Terse proof for continue_catch_continue.
continue_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## continue ## catch_continue)(s) = stmt(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of continue_catch_continue. Q.E.D.

C.203.17 Single_Statement_Rewrites0.continue_break_stmt

Terse proof for continue_break_stmt.
continue_break_stmt:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃

(stmt ## stmt1 ## catch_continue)(s) = (stmt ## catch_continue)(s)

, This completes the proof of continue_break_stmt. Q.E.D.

C.203.18 Single_Statement_Rewrites0.continue_break_catch_continue

Terse proof for continue_break_catch_continue.
continue_break_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃

(stmt ## catch_break ## catch_continue)(s) = (stmt ## catch_continue)(s)

,

This completes the proof of continue_break_catch_continue.

Q.E.D.

C.203.19 Single_Statement_Rewrites0.continue_break_catch_default

Terse proof for continue_break_catch_default.
continue_break_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## catch_default ## catch_continue)(s) = (stmt ## catch_continue)(s)

,

This completes the proof of continue_break_catch_default.

Q.E.D.

C.203.20 Single_Statement_Rewrites0.continue_break_lift_stmt

Terse proof for continue_break_lift_stmt.
continue_break_lift_stmt:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## lift(stmt1) ## catch_continue)(s) = (stmt ## catch_continue)(s)

,

This completes the proof of continue_break_lift_stmt.

Q.E.D.

C.203.21 Single_Statement_Rewrites0.continue_break_case

Terse proof for continue_break_case.
continue_break_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## case(n) ## catch_continue)(s) = (stmt ## catch_continue)(s)

, This completes the proof of continue_break_case. Q.E.D.

C.203.22 Single_Statement_Rewrites0.continue_break_default

Terse proof for continue_break_default.
continue_break_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## default ## catch_continue)(s) = (stmt ## catch_continue)(s)

, This completes the proof of continue_break_default. Q.E.D.

C.203.23 Single_Statement_Rewrites0.continue_continue

Terse proof for continue_continue.
continue_continue:

{1} ∀ (s: State): Continue?(continue(s))

, This completes the proof of continue_continue. Q.E.D.

C.203.24 Single_Statement_Rewrites0.stmt_continue_continue

Terse proof for stmt_continue_continue.

stmt_continue_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ Continue?((stmt ## continue)(s))

, This completes the proof of stmt_continue_continue. Q.E.D.

C.203.25 Single_Statement_Rewrites0.continue_stmt_continue

Terse proof for continue_stmt_continue.
continue_stmt_continue:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## stmt1)(s))

, This completes the proof of continue_stmt_continue. Q.E.D.

C.203.26 Single_Statement_Rewrites0.continue_stmt_catch_break

Terse proof for continue_stmt_catch_break.
continue_stmt_catch_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## catch_break)(s))

,

This completes the proof of continue_stmt_catch_break.

Q.E.D.

C.203.27 Single_Statement_Rewrites0.continue_stmt_catch_default

Terse proof for continue_stmt_catch_default.
continue_stmt_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## catch_default)(s))

,

This completes the proof of continue_stmt_catch_default.

Q.E.D.

C.203.28 Single_Statement_Rewrites0.continue_stmt_lift

Terse proof for continue_stmt_lift.
continue_stmt_lift:

{1} ∀ (s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## lift(stmt1))(s))

, This completes the proof of continue_stmt_lift. Q.E.D.

C.203.29 Single_Statement_Rewrites0.continue_stmt_case

Terse proof for continue_stmt_case.
continue_stmt_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## case(n))(s))

, This completes the proof of continue_stmt_case. Q.E.D.

C.203.30 Single_Statement_Rewrites0.continue_stmt_default

Terse proof for continue_stmt_default.
continue_stmt_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ Continue?((stmt ## default)(s))

, This completes the proof of continue_stmt_default. Q.E.D.

C.203.31 Single_Statement_Rewrites0.switch_stmt

Terse proof for switch_stmt.

switch_stmt:

{1} ∀ (n: int, stmt: [State → StmtResult[State]]):

switch_result(n) ## stmt = switch_result(n)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of switch_stmt. Q.E.D.

C.203.32 Single_Statement_Rewrites0.stmt_switch_stmt

Terse proof for stmt_switch_stmt.
stmt_switch_stmt:

{1} ∀ (n: int, stmt, stmt1: [State → StmtResult[State]]): stmt ## switch_result(n) ## stmt1 = stmt ## switch_result(n)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_switch_stmt. Q.E.D.

C.203.33 Single_Statement_Rewrites0.switch_case_taken

Terse proof for switch_case_taken.
switch_case_taken:

{1} ∀ (n: int): (switch_result[State](n) ## case(n)) = skip

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of switch_case_taken. Q.E.D.

C.203.34 Single_Statement_Rewrites0.stmt_switch_case_taken

Terse proof for stmt_switch_case_taken.
stmt_switch_case_taken:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## switch_result(n) ## case(n))(s) = stmt(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of stmt_switch_case_taken. Q.E.D.

C.203.35 Single_Statement_Rewrites0.switch_case_not_taken

Terse proof for switch_case_not_taken.
switch_case_not_taken:

{1} ∀ (n_{1}, n_{2}: int): n_{1} ≠ n_{2} ⊃ switch_result[State](n_{1}) ## case(n_{2}) = switch_result(n_{1})

Expanding the definition of ##, Expanding the definition of case, Expanding the definition of switch_result, Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of switch_case_not_taken. Q.E.D.

C.203.36 Single_Statement_Rewrites0.stmt_switch_case_not_taken

Terse proof for stmt_switch_case_not_taken.

stmt_switch_case_not_taken:

{1} ∀ (s: State, stmt: [State → StmtResult[State]], n_{1}, n_{2}: int):

OK?(stmt(s)) ∧ n_{1} ≠ n_{2} ⊃ (stmt ## switch_result(n_{1}) ## case(n_{2}))(s) = (stmt ## switch_result(n_{1}))(s)

,

This completes the proof of stmt_switch_case_not_taken.

Q.E.D.

C.203.37 Single_Statement_Rewrites0.switch_default

Terse proof for switch_default.
switch_default:

{1} ∀ (n: int): switch_result[State](n) ## default = switch_result(n)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of switch_default. Q.E.D.

C.203.38 Single_Statement_Rewrites0.stmt_switch_default

Terse proof for stmt_switch_default.
stmt_switch_default:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## switch_result(n) ## default)(s) = (stmt ## switch_result(n))(s)

, This completes the proof of stmt_switch_default. Q.E.D.

C.203.39 Single_Statement_Rewrites0.switch_catch_break

Terse proof for switch_catch_break.
switch_catch_break:

{1} ∀ (n: int): switch_result[State](n) ## catch_break = switch_result(n)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of switch_catch_break. Q.E.D.

C.203.40 Single_Statement_Rewrites0.stmt_switch_catch_break

Terse proof for stmt_switch_catch_break.
stmt_switch_catch_break:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## switch_result(n) ## catch_break)(s) = (stmt ## switch_result(n))(s)

, This completes the proof of stmt_switch_catch_break. Q.E.D.

C.203.41 Single_Statement_Rewrites0.switch_catch_continue

Terse proof for switch_catch_continue.
switch_catch_continue:

{1} ∀ (n: int): switch_result[State](n) ## catch_continue = switch_result(n)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of switch_catch_continue. Q.E.D.

C.203.42 Single_Statement_Rewrites0.stmt_switch_catch_continue

Terse proof for stmt_switch_catch_continue.
stmt_switch_catch_continue:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## switch_result(n) ## catch_continue)(s) = (stmt ## switch_result(n))(s)

,

This completes the proof of stmt_switch_catch_continue.

Q.E.D.

C.203.43 Single_Statement_Rewrites0.switch_catch_default

Terse proof for switch_catch_default.
switch_catch_default:

{1} ∀ (n: int): switch_result[State](n) ## catch_default = switch_result(n)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of switch_catch_default. Q.E.D.

C.203.44 Single_Statement_Rewrites0.stmt_switch_catch_default

Terse proof for stmt_switch_catch_default.
stmt_switch_catch_default:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## switch_result(n) ## catch_default)(s) = (stmt ## switch_result(n))(s)

,

This completes the proof of stmt_switch_catch_default.

Q.E.D.

C.203.45 Single_Statement_Rewrites0.default_stmt

Terse proof for default_stmt.

default_stmt:

{1} ∀ (stmt: [State → StmtResult[State]]): default_result ## stmt = default_result

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of default_stmt. Q.E.D.

C.203.46 Single_Statement_Rewrites0.stmt_default_stmt

Terse proof for stmt_default_stmt.
stmt_default_stmt:

{1} ∀ (stmt, stmt1: [State → StmtResult[State]]):

stmt ## default_result ## stmt1 = stmt ## default_result

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_default_stmt. Q.E.D.

C.203.47 Single_Statement_Rewrites0.default_case

Terse proof for default_case.

default_case:

{1} ∀ (n: int): default_result[State] ## case(n) = default_result

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of default_case. Q.E.D.

C.203.48 Single_Statement_Rewrites0.stmt_default_case

Terse proof for stmt_default_case.
stmt_default_case:

{1} ∀ (n: int, s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## default_result ## case(n))(s) = (stmt ## default_result)(s)

, This completes the proof of stmt_default_case. Q.E.D.

C.203.49 Single_Statement_Rewrites0.default_default

Terse proof for default_default.
default_default:

{1} default_result[State] ## default = skip

Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of default_default. Q.E.D.

C.203.50 Single_Statement_Rewrites0.stmt_default_default

Terse proof for stmt_default_default.
stmt_default_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## default_result ## default)(s) = stmt(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of stmt_default_default. Q.E.D.

C.203.51 Single_Statement_Rewrites0.default_catch_break

Terse proof for default_catch_break.
default_catch_break:

{1} default_result[State] ## catch_break = default_result

Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of default_catch_break. Q.E.D.

C.203.52 Single_Statement_Rewrites0.stmt_default_catch_break

Terse proof for stmt_default_catch_break.
stmt_default_catch_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## default_result ## catch_break)(s) = (stmt ## default_result)(s)

,

This completes the proof of stmt_default_catch_break.

Q.E.D.

C.203.53 Single_Statement_Rewrites0.default_catch_continue

Terse proof for default_catch_continue.
default_catch_continue:

{1} default_result[State] ## catch_continue = default_result

Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of default_catch_continue. Q.E.D.

C.203.54 Single_Statement_Rewrites0.stmt_default_catch_continue

Terse proof for stmt_default_catch_continue.
stmt_default_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## default_result ## catch_continue)(s) = (stmt ## default_result)(s)

,

This completes the proof of stmt_default_catch_continue.

Q.E.D.

C.203.55 Single_Statement_Rewrites0.default_catch_default

Terse proof for default_catch_default.
default_catch_default:

{1} default_result[State] ## catch_default = skip

Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of default_catch_default. Q.E.D.

C.203.56 Single_Statement_Rewrites0.stmt_default_catch_default

Terse proof for stmt_default_catch_default.
stmt_default_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## default_result ## catch_default)(s) = stmt(s)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality,

This completes the proof of stmt_default_catch_default.

Q.E.D.

C.203.57 Single_Statement_Rewrites0.return_void_result

Terse proof for return_void_result.
return_void_result:

{1} return_void[State] = return_result

, This completes the proof of return_void_result. Q.E.D.

C.203.58 Single_Statement_Rewrites0.skip_ok

Terse proof for skip_ok.

skip_ok:

{1} ∀ (s: State): OK?(skip(s))

, This completes the proof of skip_ok. Q.E.D.

C.203.59 Single_Statement_Rewrites0.skip_state_TCC1

Terse proof for skip_state_TCC1.
skip_state_TCC1:

{1} ∀ (s: State):

OK?[State](skip[State](s)) ∨ Break?[State](skip[State](s)) ∨ Continue?[State](skip[State](s)) ∨ Return?[State](skip[State](s)) ∨ Switch?[State](skip[State](s)) ∨ Default?[State](skip[State](s)) ∨ Exception?[State](skip[State](s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of skip_state_TCC1. Q.E.D.

C.203.60 Single_Statement_Rewrites0.skip_state

Terse proof for skip_state.

skip_state:

{1} ∀ (s: State): state(skip(s)) = s

, This completes the proof of skip_state. Q.E.D.

C.203.61 Single_Statement_Rewrites0.skip_elemination

Terse proof for skip_elemination.
skip_elemination:

{1} ∀ (stmt: [State → StmtResult[State]]): (stmt ## skip) = stmt

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, Applying extensionality, This completes the proof of skip_elemination. Q.E.D.

C.203.62 Single_Statement_Rewrites0.stmt_skip_elemination

Terse proof for stmt_skip_elemination.
stmt_skip_elemination:

{1} ∀ (stmt: [State → StmtResult[State]]): (skip ## stmt) = stmt

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_skip_elemination. Q.E.D.

C.203.63 Single_Statement_Rewrites0.stmt_remove_catch_default

Terse proof for stmt_remove_catch_default.
stmt_remove_catch_default:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## catch_default)(s) = stmt(s)

,

This completes the proof of stmt_remove_catch_default.

Q.E.D.

C.203.64 Single_Statement_Rewrites0.stmt_remove_case

Terse proof for stmt_remove_case.
stmt_remove_case:

{1} ∀ (n: int, s: State, stmt1: [State → StmtResult[State]]): OK?(stmt1(s)) ⊃ (stmt1 ## case(n))(s) = stmt1(s)

, This completes the proof of stmt_remove_case. Q.E.D.

C.203.65 Single_Statement_Rewrites0.stmt_remove_default

Terse proof for stmt_remove_default.
stmt_remove_default:

{1} ∀ (s: State, stmt1: [State → StmtResult[State]]):

OK?(stmt1(s)) ⊃ (stmt1 ## default)(s) = stmt1(s)

, This completes the proof of stmt_remove_default. Q.E.D.

C.203.66 Single_Statement_Rewrites0.stmt_remove_catch_continue

Terse proof for stmt_remove_catch_continue.
stmt_remove_catch_continue:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## catch_continue)(s) = stmt(s)

,

This completes the proof of stmt_remove_catch_continue.

Q.E.D.

C.203.67 Single_Statement_Rewrites0.stmt_remove_catch_break

Terse proof for stmt_remove_catch_break.
stmt_remove_catch_break:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ (stmt ## catch_break)(s) = stmt(s)

, This completes the proof of stmt_remove_catch_break. Q.E.D.

C.203.68 Single_Statement_Rewrites0.stmt_ok_lift

Terse proof for stmt_ok_lift.

stmt_ok_lift:

{1} ∀ (s: State, stmt1, stmt2: [State → StmtResult[State]]):

OK?(stmt1(s)) ⊃ (stmt1 ## lift(stmt2))(s) = (stmt1 ## stmt2)(s)

, This completes the proof of stmt_ok_lift. Q.E.D.

C.203.69 Single_Statement_Rewrites0.while_unroll_TCC1

Terse proof for while_unroll_TCC1.
while_unroll_TCC1:

{1} ∀ (max: nat): max > 0 ⊃ max − 1 ≥ 0

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of while_unroll_TCC1. Q.E.D.

C.203.70 Single_Statement_Rewrites0.while_unroll

Terse proof for while_unroll.

while_unroll:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], max: nat, s: State,

stmt: [State → StmtResult[State]]): max > 0 ⊃ while(max, b_ex, stmt)(s) = if_else(b_ex, stmt ## catch_continue ## while(max − 1, b_ex, stmt) ## catch_break,

skip) (s)

Repeatedly Skolemizing and flattening, Expanding the definition of while, Using lemma while_as_if_while, Simplifying, rewriting, and recording with decision procedures, This completes the proof of while_unroll. Q.E.D.

C.203.71 Single_Statement_Rewrites0.stmt_while_unroll

Terse proof for stmt_while_unroll.

stmt_while_unroll:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], max: nat, s: State,

stmt1, stmt2: [State → StmtResult[State]]): max > 0 ⊃ (stmt1 ## while(max, b_ex, stmt2))(s) = (stmt1 ##

if_else(b_ex, stmt2 ## catch_continue ## while(max − 1, b_ex, stmt2) ## catch_break, skip))

(s)

Repeatedly Skolemizing and flattening,

Expanding the definition of ##,

Expanding the definition of lift,

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

Rewriting using while_unroll, matching in *,

This completes the proof of stmt_while_unroll.

Q.E.D.

C.203.72 Single_Statement_Rewrites0.iterate_while_ok

Terse proof for iterate_while_ok.
iterate_while_ok:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], s_{1}: State,

stmt: [State → StmtResult[State]], n: nat): (∀ (s: State): OK?((e2s(b_ex) ## stmt)(s))) ⊃ OK?(iterate_while(n, b_ex, stmt)(s_{1}))

Inducting on n on formula 1,

we get 2 subgoals:

iterate_while_ok.1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], s_{1}: State, stmt: [State → StmtResult[State]]):

(∀ (s: State): OK?((e2s(b_ex) ## stmt)(s))) ⊃ OK?(iterate_while(0, b_ex, stmt)(s_{1}))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of iterate_while_ok.1.

iterate_while_ok.2:

{1} ∀ j:

(∀ (b_ex: [State → ExprResult[State, bool]], s_{1}: State,

stmt: [State → StmtResult[State]]): (∀ (s: State): OK?((e2s(b_ex) ## stmt)(s))) ⊃ OK?(iterate_while(j, b_ex, stmt)(s_{1})))

⊃

(∀ (b_ex: [State → ExprResult[State, bool]], s_{1}: State,

stmt: [State → StmtResult[State]]): (∀ (s: State): OK?((e2s(b_ex) ## stmt)(s))) ⊃ OK?(iterate_while(j + 1, b_ex, stmt)(s_{1})))

Repeatedly Skolemizing and flattening, Expanding the definition of iterate_while, Instantiating quantified variables, Expanding the definition of ##, Expanding the definition of lift, Case splitting on OK?(catch_continue((e2s(b_ex!1) ## stmt!1)(s1!1))), we get 2 subgoals:

iterate_while_ok.2.1:

{-1} OK?(catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})))
{-2} j′ ≥ 0
{-3} ∀ (s_{1}: State):

(∀ (s: State): OK?((e2s(b_ex′) ## stmt′)(s))) ⊃ OK?(iterate_while(j′, b_ex′, stmt′)(s_{1}))

{-4} ∀ (s: State): OK?((e2s(b_ex′) ## stmt′)(s))

{1} OK?(cases catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})) of OK(state): iterate_while(j′, b_ex′, stmt′)(state) else catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})) endcases)

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: (state(catch_continue((e2s(b_ex!1) ##

stmt!1)(s1!1)))), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of iterate_while_ok.2.1.

iterate_while_ok.2.2:

{-1} j′ ≥ 0
{-2} ∀ (s_{1}: State):

(∀ (s: State): OK?((e2s(b_ex′) ## stmt′)(s))) ⊃ OK?(iterate_while(j′, b_ex′, stmt′)(s_{1}))

{-3} ∀ (s: State): OK?((e2s(b_ex′) ## stmt′)(s))
{1} OK?(catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})))

{2} OK?(cases catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})) of OK(state): iterate_while(j′, b_ex′, stmt′)(state) else catch_continue((e2s(b_ex′) ## stmt′)(s′_{1})) endcases)

Hiding formulas: 2, Expanding the definition of catch_continue, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of iterate_while_ok.2.2. Q.E.D.

C.203.73 Single_Statement_Rewrites0.while_hang

Terse proof for while_hang.

while_hang:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], stmt: [State → StmtResult[State]]): (∀ (s: State): OK?(b_ex(s)) ∧ data(b_ex(s)) ∧ OK?((e2s(b_ex) ## stmt)(s))) ⊃ while(b_ex, stmt) = hang_result

Repeatedly Skolemizing and flattening, Applying decompose-equality, Expanding the definition of while, Expanding the definition of hang_result, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Repeatedly Skolemizing and flattening, Expanding the definition of while_termination_point?, Hiding formulas: 1, Case splitting on OK?(iterate_while(n!1, b_ex!1, stmt!1)(x!1)), we get 2 subgoals:

while_hang.1:

{-1} OK?(iterate_while(n′, b_ex′, stmt′)(x′))
{-2} n′ ≥ 0

{-3} ¬ OK?(iterate_while(n′, b_ex′, stmt′)(x′)) ∨ ¬ OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∨ ¬ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′))))

{-4} ∀ (s: State):

OK?(b_ex′(s)) ∧ data(b_ex′(s)) ∧ OK?((e2s(b_ex′) ## stmt′)(s))

Instantiating the top quantifier in -4 with the terms: (state(iterate_while(n!1, b_ex!1, stmt!1)(x!1))), we get 2 subgoals:

while_hang.1.1:

{-1} OK?(iterate_while(n′, b_ex′, stmt′)(x′))
{-2} n′ ≥ 0

{-3} ¬ OK?(iterate_while(n′, b_ex′, stmt′)(x′)) ∨ ¬ OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∨ ¬ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′))))

{-4} OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∧ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∧ OK?((e2s(b_ex′) ## stmt′)(state(iterate_while(n′, b_ex′, stmt′)(x′))))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of while_hang.1.1.

while_hang.1.2:

{-1} OK?(iterate_while(n′, b_ex′, stmt′)(x′))
{-2} n′ ≥ 0

{-3} ¬ OK?(iterate_while(n′, b_ex′, stmt′)(x′)) ∨ ¬ OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∨ ¬ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′))))

{1} OK?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Break?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Continue?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Return?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Switch?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Default?[State](iterate_while[State](n′, b_ex′, stmt′)(x′)) ∨ Exception?[State](iterate_while[State](n′, b_ex′, stmt′)(x′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of while_hang.1.2.

while_hang.2:

{-1} n′ ≥ 0

{-2} ¬ OK?(iterate_while(n′, b_ex′, stmt′)(x′)) ∨ ¬ OK?(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′)))) ∨ ¬ data(b_ex′(state(iterate_while(n′, b_ex′, stmt′)(x′))))

{-3} ∀ (s: State):

OK?(b_ex′(s)) ∧ data(b_ex′(s)) ∧ OK?((e2s(b_ex′) ## stmt′)(s))

{1} OK?(iterate_while(n′, b_ex′, stmt′)(x′))

Rewriting using iterate_while_ok, matching in *, Keeping (-3 1) and hiding *, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of while_hang.2. Q.E.D.

C.203.74 Single_Statement_Rewrites0.composition_assoc_rewrite_stmt_ok

Terse proof for composition_assoc_rewrite_stmt_ok.
composition_assoc_rewrite_stmt_ok:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], s: State, stmt, stmt1: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## (stmt1 ## cstmt))(s) = ((stmt ## stmt1) ## cstmt)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_stmt_ok.

Q.E.D.

C.203.75 Single_Statement_Rewrites0.composition_assoc_rewrite_stmt_ok_cstmt

Terse proof for composition_assoc_rewrite_stmt_ok_cstmt.
composition_assoc_rewrite_stmt_ok_cstmt:

{1} ∀ (cstmt, cstmt1: [StmtResult[State] → StmtResult[State]], s: State,

stmt, stmt1: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ ((stmt ## (stmt1 ## cstmt)) ## cstmt1)(s) = (((stmt ## stmt1) ## cstmt) ## cstmt1)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_stmt_ok_cstmt.

Q.E.D.

C.204 Proofs for Single_Statement_Rewrites1 (statement-rewrites.pvs)

C.204.1 Single_Statement_Rewrites1.forward_s_c_s_of_s_expr

Terse proof for forward_s_c_s_of_s_expr.
forward_s_c_s_of_s_expr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

(stmt ## cstmt)(s) = stmt(s) ⊃ (stmt ## cstmt ## expr)(s) = (stmt ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of forward_s_c_s_of_s_expr. Q.E.D.

C.204.2 Single_Statement_Rewrites1.stmt_ok_lift_expr

Terse proof for stmt_ok_lift_expr.
stmt_ok_lift_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State,

stmt1, stmt2: [State → StmtResult[State]]): OK?(stmt1(s)) ⊃ (stmt1 ## lift(stmt2) ## expr)(s) = (stmt1 ## stmt2 ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_ok_lift_expr. Q.E.D.

C.204.3 Single_Statement_Rewrites1.break_break_stmt_expr

Terse proof for break_break_stmt_expr.

break_break_stmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt, stmt1: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## stmt1 ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of break_break_stmt_expr. Q.E.D.

C.204.4 Single_Statement_Rewrites1.break_break_catch_continue_expr

Terse proof for break_break_catch_continue_expr.
break_break_catch_continue_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## catch_continue ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of break_break_catch_continue_expr.

Q.E.D.

C.204.5 Single_Statement_Rewrites1.break_break_catch_default_expr

Terse proof for break_break_catch_default_expr.
break_break_catch_default_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## catch_default ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of break_break_catch_default_expr.

Q.E.D.

C.204.6 Single_Statement_Rewrites1.break_break_lift_stmt_expr

Terse proof for break_break_lift_stmt_expr.
break_break_lift_stmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt, stmt1: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## lift(stmt1) ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of break_break_lift_stmt_expr.

Q.E.D.

C.204.7 Single_Statement_Rewrites1.break_break_case_expr

Terse proof for break_break_case_expr.
break_break_case_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], n: int, s: State,

stmt: [State → StmtResult[State]]): Break?(stmt(s)) ⊃ (stmt ## case(n) ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of break_break_case_expr. Q.E.D.

C.204.8 Single_Statement_Rewrites1.break_break_default_expr

Terse proof for break_break_default_expr.
break_break_default_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

Break?(stmt(s)) ⊃ (stmt ## default ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of break_break_default_expr.

Q.E.D.

C.204.9 Single_Statement_Rewrites1.continue_break_stmt_expr

Terse proof for continue_break_stmt_expr.
continue_break_stmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## stmt1 ## catch_break ## expr)(s) = (stmt ## catch_break ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_stmt_expr.

Q.E.D.

C.204.10 Single_Statement_Rewrites1.continue_break_catch_continue_expr

Terse proof for continue_break_catch_continue_expr.

continue_break_catch_continue_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## catch_break ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_catch_continue_expr.

Q.E.D.

C.204.11 Single_Statement_Rewrites1.continue_break_catch_default_expr

Terse proof for continue_break_catch_default_expr.
continue_break_catch_default_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## catch_default ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_catch_default_expr.

Q.E.D.

C.204.12 Single_Statement_Rewrites1.continue_break_lift_stmt_expr

Terse proof for continue_break_lift_stmt_expr.
continue_break_lift_stmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt, stmt1: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## lift(stmt1) ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_lift_stmt_expr.

Q.E.D.

C.204.13 Single_Statement_Rewrites1.continue_break_case_expr

Terse proof for continue_break_case_expr.

continue_break_case_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], n: int, s: State,

stmt: [State → StmtResult[State]]): Continue?(stmt(s)) ⊃ (stmt ## case(n) ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_case_expr.

Q.E.D.

C.204.14 Single_Statement_Rewrites1.continue_break_default_expr

Terse proof for continue_break_default_expr.
continue_break_default_expr:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

Continue?(stmt(s)) ⊃ (stmt ## default ## catch_continue ## expr)(s) = (stmt ## catch_continue ## expr)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of continue_break_default_expr.

Q.E.D.

C.204.15 Single_Statement_Rewrites1.while_unroll_expr_TCC1

Terse proof for while_unroll_expr_TCC1.
while_unroll_expr_TCC1:

{1} ∀ (max: nat): max > 0 ⊃ max − 1 ≥ 0

Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, This completes the proof of while_unroll_expr_TCC1. Q.E.D.

C.204.16 Single_Statement_Rewrites1.while_unroll_expr

Terse proof for while_unroll_expr.

while_unroll_expr:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], expr: [State → ExprRe-

sult[State, Data]],

max: nat, s: State, stmt: [State → StmtResult[State]]): max > 0 ⊃ (while(max, b_ex, stmt) ## expr)(s) = (if_else(b_ex, stmt ## catch_continue ## while(max − 1, b_ex, stmt) ## catch_break,

skip)

## expr) (s)

Repeatedly Skolemizing and flattening,

Expanding the definition of ##,

Rewriting using while_unroll, matching in *,

This completes the proof of while_unroll_expr.

Q.E.D.

C.204.17 Single_Statement_Rewrites1.while_unroll_lexpr

Terse proof for while_unroll_lexpr.
while_unroll_lexpr:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], lexpr: [StmtResult[State] → ExprResult[State, Data]], max: nat, s: State, stmt: [State → StmtResult[State]]):

max > 0 ⊃ (while(max, b_ex, stmt) ## lexpr)(s) = (if_else(b_ex, stmt ## catch_continue ## while(max − 1, b_ex, stmt) ## catch_break,

skip)

## lexpr)

(s)

Repeatedly Skolemizing and flattening,

Expanding the definition of ##,

Rewriting using while_unroll, matching in *,

This completes the proof of while_unroll_lexpr.

Q.E.D.

C.204.18 Single_Statement_Rewrites1.stmt_while_unroll_expr

Terse proof for stmt_while_unroll_expr.

stmt_while_unroll_expr:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], expr: [State → ExprRe-

sult[State, Data]],

max: nat, s: State, stmt1, stmt2: [State → StmtResult[State]]): max > 0 ⊃ (stmt1 ## while(max, b_ex, stmt2) ## expr)(s) = (stmt1 ##

if_else(b_ex, stmt2 ## catch_continue ## while(max − 1, b_ex, stmt2) ## catch_break, skip)

## expr) (s)

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of while, Using lemma while_as_if_while, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of stmt_while_unroll_expr. Q.E.D.

C.204.19 Single_Statement_Rewrites1.stmt_while_unroll_lexpr

Terse proof for stmt_while_unroll_lexpr.
stmt_while_unroll_lexpr:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], lexpr: [StmtResult[State] → ExprResult[State, Data]], max: nat, s: State, stmt1, stmt2: [State → StmtResult[State]]):

max > 0 ⊃ (stmt1 ## while(max, b_ex, stmt2) ## lexpr)(s) = (stmt1 ##

if_else(b_ex, stmt2 ## catch_continue ## while(max − 1, b_ex, stmt2) ## catch_break, skip)

## lexpr)

(s)

Repeatedly Skolemizing and flattening, Expanding the definition of ##, Expanding the definition of while, Using lemma while_as_if_while, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of stmt_while_unroll_lexpr. Q.E.D.

C.204.20 Single_Statement_Rewrites1.e2s_ok

Terse proof for e2s_ok.

e2s_ok:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State): OK?(expr(s)) ⊃ OK?(e2s(expr)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of e2s_ok. Q.E.D.

C.204.21 Single_Statement_Rewrites1.stmt_e2s_ok

Terse proof for stmt_e2s_ok.

stmt_e2s_ok:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ OK?((stmt ## e2s(expr))(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_e2s_ok. Q.E.D.

C.204.22 Single_Statement_Rewrites1.e2s_state_TCC1

Terse proof for e2s_state_TCC1.
e2s_state_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State): OK?(expr(s)) ⊃ OK?[State](e2s[State, Data](expr)(s)) ∨ Break?[State](e2s[State, Data](expr)(s)) ∨ Continue?[State](e2s[State, Data](expr)(s)) ∨ Return?[State](e2s[State, Data](expr)(s)) ∨ Switch?[State](e2s[State, Data](expr)(s)) ∨ Default?[State](e2s[State, Data](expr)(s)) ∨ Exception?[State](e2s[State, Data](expr)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of e2s_state_TCC1. Q.E.D.

C.204.23 Single_Statement_Rewrites1.e2s_state_TCC2

Terse proof for e2s_state_TCC2.
e2s_state_TCC2:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State): OK?(expr(s)) ⊃ OK?[State, Data](expr(s)) ∨ Exception?[State, Data](expr(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of e2s_state_TCC2.

Q.E.D.

C.204.24 Single_Statement_Rewrites1.e2s_state

Terse proof for e2s_state.

e2s_state:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State): OK?(expr(s)) ⊃ state(e2s(expr)(s)) = state(expr(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of e2s_state. Q.E.D.

C.204.25 Single_Statement_Rewrites1.stmt_e2s_state_TCC1

Terse proof for stmt_e2s_state_TCC1.
stmt_e2s_state_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃

OK?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Break?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Continue?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Return?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Switch?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Default?[State]((##[State](stmt, e2s[State, Data](expr)))(s)) ∨ Exception?[State]((##[State](stmt, e2s[State, Data](expr)))(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_e2s_state_TCC1. Q.E.D.

C.204.26 Single_Statement_Rewrites1.stmt_e2s_state_TCC2

Terse proof for stmt_e2s_state_TCC2.
stmt_e2s_state_TCC2:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃

OK?[State, Data]((##[State, Data](stmt, expr))(s)) ∨ Exception?[State, Data]((##[State, Data](stmt, expr))(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_e2s_state_TCC2. Q.E.D.

C.204.27 Single_Statement_Rewrites1.stmt_e2s_state

Terse proof for stmt_e2s_state.
stmt_e2s_state:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ state((stmt ## e2s(expr))(s)) = state((stmt ## expr)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_e2s_state. Q.E.D.

C.204.28 Single_Statement_Rewrites1.comp_eval_if_ok_fstmt

Terse proof for comp_eval_if_ok_fstmt.
comp_eval_if_ok_fstmt:

{1} ∀ (expr: [State → ExprResult[State, Data]],

fstmt: [Data → [State → StmtResult[State]]], s: State): OK?(expr(s)) ⊃ (expr ## fstmt)(s) = (e2s(expr) ## fstmt(data(expr(s))))(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of comp_eval_if_ok_fstmt. Q.E.D.

C.204.29 Single_Statement_Rewrites1.stmt_eval_if_ok_fstmt

Terse proof for stmt_eval_if_ok_fstmt.
stmt_eval_if_ok_fstmt:

{1} ∀ (expr: [State → ExprResult[State, Data]], fstmt: [Data → [State → StmtResult[State]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ (stmt ## (expr ## fstmt))(s) = (stmt ## (e2s(expr) ## fstmt(data((stmt ## expr)(s)))))(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_eval_if_ok_fstmt. Q.E.D.

C.204.30 Single_Statement_Rewrites1.comp_eval_if_ok_fstmt_cstmt

Terse proof for comp_eval_if_ok_fstmt_cstmt.

comp_eval_if_ok_fstmt_cstmt:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]], fstmt: [Data → [State → StmtResult[State]]], s: State):

OK?(expr(s)) ⊃

((expr ## fstmt) ## cstmt)(s) =

(e2s(expr) ## fstmt(data(expr(s))) ## cstmt)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_eval_if_ok_fstmt_cstmt.

Q.E.D.

C.204.31 Single_Statement_Rewrites1.stmt_eval_if_ok_fstmt_cstmt

Terse proof for stmt_eval_if_ok_fstmt_cstmt.
stmt_eval_if_ok_fstmt_cstmt:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]], fstmt: [Data → [State → StmtResult[State]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃

(stmt ## (expr ## fstmt) ## cstmt)(s) = (stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## cstmt)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stmt_eval_if_ok_fstmt_cstmt.

Q.E.D.

C.204.32 Single_Statement_Rewrites1.composition_assoc_rewrite_expr_1

Terse proof for composition_assoc_rewrite_expr_1.
composition_assoc_rewrite_expr_1:

{1} ∀ (expr: [State → ExprResult[State, Data]], stmt, stmt1: [State → StmtRe-

sult[State]]): (stmt ## (stmt1 ## expr)) = ((stmt ## stmt1) ## expr)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_expr_1.

Q.E.D.

C.204.33 Single_Statement_Rewrites1.composition_assoc_rewrite_expr_2

Terse proof for composition_assoc_rewrite_expr_2.

composition_assoc_rewrite_expr_2:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]],

expr: [State → ExprResult[State, Data]], stmt: [State → StmtResult[State]]):

(stmt ## (cstmt ## expr)) = ((stmt ## cstmt) ## expr)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_expr_2.

Q.E.D.

C.204.34 Single_Statement_Rewrites1.composition_assoc_rewrite_expr_3

Terse proof for composition_assoc_rewrite_expr_3.
composition_assoc_rewrite_expr_3:

{1} ∀ (cstmt, cstmt1: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]]):

(cstmt ## (cstmt1 ## expr)) = ((cstmt ## cstmt1) ## expr)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_expr_3.

Q.E.D.

C.204.35 Single_Statement_Rewrites1.composition_assoc_rewrite_expr_4

Terse proof for composition_assoc_rewrite_expr_4.
composition_assoc_rewrite_expr_4:

{1} ∀ (lexpr: [StmtResult[State] → ExprResult[State, Data]], stmt, stmt1: [State → StmtResult[State]]):

(stmt ## (lift(stmt1) ## lexpr)) = ((stmt ## stmt1) ## lexpr)

, Applying decompose-equality,

This completes the proof of composition_assoc_rewrite_expr_4.

Q.E.D.

C.204.36 Single_Statement_Rewrites1.composition_assoc_rewrite_expr_5

Terse proof for composition_assoc_rewrite_expr_5.

composition_assoc_rewrite_expr_5:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], lexpr: [StmtResult[State] → ExprResult[State, Data]], stmt: [State → StmtResult[State]]):

(stmt ## (cstmt ## lexpr)) = ((stmt ## cstmt) ## lexpr)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_expr_5.

Q.E.D.

C.204.37 Single_Statement_Rewrites1.composition_assoc_rewrite_expr_6

Terse proof for composition_assoc_rewrite_expr_6.
composition_assoc_rewrite_expr_6:

{1} ∀ (cstmt, cstmt1: [StmtResult[State] → StmtResult[State]],

lexpr: [StmtResult[State] → ExprResult[State, Data]]): (cstmt ## (cstmt1 ## lexpr)) = ((cstmt ## cstmt1) ## lexpr)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_expr_6.

Q.E.D.

C.204.38 Single_Statement_Rewrites1.composition_assoc_rewrite_stmt_ok

Terse proof for composition_assoc_rewrite_stmt_ok.
composition_assoc_rewrite_stmt_ok:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], s: State, stmt, stmt1: [State → StmtResult[State]]): OK?(stmt(s)) ⊃ (stmt ## (stmt1 ## cstmt))(s) = ((stmt ## stmt1) ## cstmt)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_stmt_ok.

Q.E.D.

C.204.39 Single_Statement_Rewrites1.composition_assoc_rewrite_stmt_ok_expr

Terse proof for composition_assoc_rewrite_stmt_ok_expr.

composition_assoc_rewrite_stmt_ok_expr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data]], s: State, stmt, stmt1: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## (stmt1 ## cstmt) ## expr)(s) = ((stmt ## stmt1) ## cstmt ## expr)(s)

,

This completes the proof of composition_assoc_rewrite_stmt_ok_expr.

Q.E.D.

C.204.40 Single_Statement_Rewrites1.composition_assoc_rewrite_stmt_ok_expr_lexpr

Terse proof for composition_assoc_rewrite_stmt_ok_expr_lexpr.
composition_assoc_rewrite_stmt_ok_expr_lexpr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], lexpr: [StmtResult[State] → ExprResult[State, Data]], s: State, stmt, stmt1: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃

(stmt ## (stmt1 ## cstmt) ## lexpr)(s) = ((stmt ## stmt1) ## cstmt ## lexpr)(s)

,

This completes the proof of composition_assoc_rewrite_stmt_ok_expr_lexpr.

Q.E.D.

C.204.41 Single_Statement_Rewrites1.ok_result_fstmt

Terse proof for ok_result_fstmt.
ok_result_fstmt:

{1} ∀ (fstmt: [Data → [State → StmtResult[State]]], data: Data):

ok_result(data) ## fstmt = fstmt(data)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_fstmt. Q.E.D.

C.204.42 Single_Statement_Rewrites1.pm_q_prop_read_ok_s_read_ok

Terse proof for pm_q_prop_read_ok_s_read_ok.
pm_q_prop_read_ok_s_read_ok:

{1} ∀ (addr: Address, dt: (interpreted_data_type?[Data]), pm: Plain_Memory[State], s: State): pm_q_prop_read(pm, dt, addr)(skip(s)) ⊃ OK?(read_data(pm, dt)(addr)(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_read_ok_s_read_ok.

Q.E.D.

C.205 Proofs for Single_Statement_Rewrites2 (statement-rewrites.pvs)

C.205.1 Single_Statement_Rewrites2.ok_result_fexpr

Terse proof for ok_result_fexpr.
ok_result_fexpr:

{1} ∀ (fexpr: [Data2 → [State → ExprResult[State, Data1]]], data: Data2): ok_result(data) ## fexpr = fexpr(data)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_fexpr. Q.E.D.

C.205.2 Single_Statement_Rewrites2.e2s_merge

Terse proof for e2s_merge.

e2s_merge:

{1} ∀ (expr: [State → ExprResult[State, Data1]],

expr1: [State → ExprResult[State, Data2]]): (e2s(expr) ## e2s(expr1)) = e2s(expr ## expr1)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of e2s_merge. Q.E.D.

C.205.3 Single_Statement_Rewrites2.stmt_e2s_merge

Terse proof for stmt_e2s_merge.
stmt_e2s_merge:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

stmt: [State → StmtResult[State]]): (stmt ## e2s(expr) ## e2s(expr1)) = (stmt ## e2s(expr ## expr1))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_e2s_merge. Q.E.D.

C.205.4 Single_Statement_Rewrites2.e2s_expr

Terse proof for e2s_expr.

e2s_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]], s: State):

(e2s(expr1) ## expr)(s) = (expr1 ## expr)(s)

, This completes the proof of e2s_expr. Q.E.D.

C.205.5 Single_Statement_Rewrites2.stmt_e2s_expr

Terse proof for stmt_e2s_expr.

stmt_e2s_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

s: State, stmt: [State → StmtResult[State]]): (stmt ## e2s(expr1) ## expr)(s) = (stmt ## expr1 ## expr)(s)

, This completes the proof of stmt_e2s_expr. Q.E.D.

C.205.6 Single_Statement_Rewrites2.composition_assoc_expression_rewrite_stmt

Terse proof for composition_assoc_expression_rewrite_stmt.
composition_assoc_expression_rewrite_stmt:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

stmt: [State → StmtResult[State]]): (stmt ## (expr ## expr1)) = ((stmt ## expr) ## expr1)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_expression_rewrite_stmt.

Q.E.D.

C.205.7 Single_Statement_Rewrites2.comp_eval_if_ok_fstmt_expr

Terse proof for comp_eval_if_ok_fstmt_expr.

comp_eval_if_ok_fstmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

fstmt: [Data1 → [State → StmtResult[State]]], s: State): OK?(expr(s)) ⊃ ((expr ## fstmt) ## expr1)(s) = (e2s(expr) ## fstmt(data(expr(s))) ## expr1)(s)

,

This completes the proof of comp_eval_if_ok_fstmt_expr.

Q.E.D.

C.205.8 Single_Statement_Rewrites2.stmt_eval_if_ok_fstmt_expr

Terse proof for stmt_eval_if_ok_fstmt_expr.
stmt_eval_if_ok_fstmt_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]], fstmt: [Data1 → [State → StmtResult[State]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ (stmt ## (expr ## fstmt) ## expr1)(s) = (stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## expr1)(s)

,

This completes the proof of stmt_eval_if_ok_fstmt_expr.

Q.E.D.

C.205.9 Single_Statement_Rewrites2.stmt_eval_if_ok_fexpr

Terse proof for stmt_eval_if_ok_fexpr.
stmt_eval_if_ok_fexpr:

{1} ∀ (expr1: [State → ExprResult[State, Data2]], fexpr: [Data2 → [State → ExprResult[State, Data1]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr1)(s)) ⊃ (stmt ## (expr1 ## fexpr))(s) = (stmt ## expr1 ## fexpr(data((stmt ## expr1)(s))))(s)

, This completes the proof of stmt_eval_if_ok_fexpr. Q.E.D.

C.205.10 Single_Statement_Rewrites2.comp_eval_if_ok_fstmt_cstmt_expr

Terse proof for comp_eval_if_ok_fstmt_cstmt_expr.

comp_eval_if_ok_fstmt_cstmt_expr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]],

expr: [State → ExprResult[State, Data1]], expr1: [State → ExprResult[State, Data2]],

fstmt: [Data1 → [State → StmtResult[State]]], s: State): OK?(expr(s)) ⊃ (((expr ## fstmt) ## cstmt) ## expr1)(s) = (((e2s(expr) ## fstmt(data(expr(s)))) ## cstmt) ## expr1)(s)

,

This completes the proof of comp_eval_if_ok_fstmt_cstmt_expr.

Q.E.D.

C.205.11 Single_Statement_Rewrites2.stmt_eval_if_ok_fstmt_cstmt_expr

Terse proof for stmt_eval_if_ok_fstmt_cstmt_expr.
stmt_eval_if_ok_fstmt_cstmt_expr:

{1} ∀ (cstmt: [StmtResult[State] → StmtResult[State]], expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe- sult[State, Data2]], fstmt: [Data1 → [State → StmtResult[State]]], s: State, stmt: [State → StmtResult[State]]): OK?((stmt ## expr)(s)) ⊃ (stmt ## (expr ## fstmt) ## cstmt ## expr1)(s) = (stmt ## e2s(expr) ## fstmt(data((stmt ## expr)(s))) ## cstmt ## expr1)(s)

,

This completes the proof of stmt_eval_if_ok_fstmt_cstmt_expr.

Q.E.D.

C.206 Proofs for Single_Statement_Rewrites3 (statement-rewrites.pvs)

C.206.1 Single_Statement_Rewrites3.ok_result_elemination_2

Terse proof for ok_result_elemination_2.
ok_result_elemination_2:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

data: Data3): ((expr ## ok_result[State, Data3](data)) ## expr1) = (expr ## expr1)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_elemination_2.

Q.E.D.

C.206.2 Single_Statement_Rewrites3.comp_eval_if_ok_fexpr_expr

Terse proof for comp_eval_if_ok_fexpr_expr.
comp_eval_if_ok_fexpr_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

fexpr: [Data1 → [State → ExprResult[State, Data3]]], s: State): OK?(expr(s)) ⊃ ((expr ## fexpr) ## expr1)(s) = (expr ## fexpr(data(expr(s))) ## expr1)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of comp_eval_if_ok_fexpr_expr.

Q.E.D.

C.206.3 Single_Statement_Rewrites3.expr_eval_if_ok_fexpr

Terse proof for expr_eval_if_ok_fexpr.
expr_eval_if_ok_fexpr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

fexpr: [Data1 → [State → ExprResult[State, Data3]]], s: State): OK?((expr1 ## expr)(s)) ⊃ (expr1 ## (expr ## fexpr))(s) = (expr1 ## expr ## fexpr(data((expr1 ## expr)(s))))(s)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of expr_eval_if_ok_fexpr. Q.E.D.

C.206.4 Single_Statement_Rewrites3.composition_assoc_expression_rewrite

Terse proof for composition_assoc_expression_rewrite.
composition_assoc_expression_rewrite:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]],

expr2: [State → ExprResult[State, Data3]]): (expr ## (expr1 ## expr2)) = ((expr ## expr1) ## expr2)

Trying repeated skolemization, instantiation, and if-lifting, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_expression_rewrite.

Q.E.D.

C.206.5 Single_Statement_Rewrites3.stmt_eval_if_ok_fexpr_expr

Terse proof for stmt_eval_if_ok_fexpr_expr.
stmt_eval_if_ok_fexpr_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]], fexpr: [Data1 → [State → ExprResult[State, Data3]]], s: State, stmt: [State → StmtResult[State]]):

OK?((stmt ## expr)(s)) ⊃ (stmt ## (expr ## fexpr) ## expr1)(s) = (stmt ## expr ## fexpr(data((stmt ## expr)(s))) ## expr1)(s)

,

This completes the proof of stmt_eval_if_ok_fexpr_expr.

Q.E.D.

C.207 Proofs for Single_Statement_Rewrites4 (statement-rewrites.pvs)

C.207.1 Single_Statement_Rewrites4.expr_eval_if_ok_fexpr_expr

Terse proof for expr_eval_if_ok_fexpr_expr.
expr_eval_if_ok_fexpr_expr:

{1} ∀ (expr: [State → ExprResult[State, Data1]], expr1: [State → ExprRe-

sult[State, Data2]], expr2: [State → ExprResult[State, Data4]], fexpr: [Data2 → [State → ExprResult[State, Data3]]], s: State):

OK?((expr ## expr1)(s)) ⊃ (expr ## (expr1 ## fexpr) ## expr2)(s) = (expr ## expr1 ## fexpr(data((expr ## expr1)(s))) ## expr2)(s)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_eval_if_ok_fexpr_expr.

Q.E.D.

C.208 Proofs for SkipStatements (statements.pvs)

This theory contains no provable formal statements.

C.209 Proofs for State_Transformer (state-transformer.pvs)

This theory contains no provable formal statements.

C.210 Proofs for State_Transformer_Lift (state-transformer.pvs)

C.210 Proofs for State_Transformer_Lift (state-transformer.pvs)

This theory contains no provable formal statements.

C.211 Proofs for State_Transformer_Lift_Expr (state-transformer.pvs)

C.211.1 State_Transformer_Lift_Expr.ok_result_ok

Terse proof for ok_result_ok.

ok_result_ok:

{1} ∀ (s: State, data: Data): OK?(ok_result(data)(s))

, This completes the proof of ok_result_ok. Q.E.D.

C.211.2 State_Transformer_Lift_Expr.ok_result_data_TCC1

Terse proof for ok_result_data_TCC1.
ok_result_data_TCC1:

{1} ∀ (s: State, data: Data): OK?[State, Data](ok_result(data)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of ok_result_data_TCC1. Q.E.D.

C.211.3 State_Transformer_Lift_Expr.ok_result_data

Terse proof for ok_result_data.
ok_result_data:

{1} ∀ (s: State, data: Data): data(ok_result(data)(s)) = data

, This completes the proof of ok_result_data. Q.E.D.

C.211.4 State_Transformer_Lift_Expr.ok_result_state

Terse proof for ok_result_state.
ok_result_state:

{1} ∀ (s: State, data: Data): state(ok_result(data)(s)) = s

, This completes the proof of ok_result_state. Q.E.D.

C.211.5 State_Transformer_Lift_Expr.expr_2_super_ok_result

Terse proof for expr_2_super_ok_result.
expr_2_super_ok_result:

{1} ∀ (s: State, data: Data): OK?(expr_2_super(ok_result(data))(s))

, This completes the proof of expr_2_super_ok_result. Q.E.D.

C.211.6 State_Transformer_Lift_Expr.ok_lift_ok

Terse proof for ok_lift_ok.

ok_lift_ok:

{1} ∀ (s: State, d: lift[Data]): up?(d) ⊃ ok_lift(d)(s) = OK(s, down(d))

, This completes the proof of ok_lift_ok. Q.E.D.

C.211.7 State_Transformer_Lift_Expr.has_next_state_ok_result

Terse proof for has_next_state_ok_result.
has_next_state_ok_result:

{1} ∀ (s: State, data: Data): has_next_state(ok_result(data)(s))

,

This completes the proof of has_next_state_ok_result.

Q.E.D.

C.211.8 State_Transformer_Lift_Expr.has_next_state_fatal_result

Terse proof for has_next_state_fatal_result.
has_next_state_fatal_result:

{1} ∀ (s: State): ¬ has_next_state(fatal_result(s))

,

This completes the proof of has_next_state_fatal_result.

Q.E.D.

C.211.9 State_Transformer_Lift_Expr.expr_2_super_fatal_result

Terse proof for expr_2_super_fatal_result.
expr_2_super_fatal_result:

{1} ∀ (s: State): expr_2_super(fatal_result)(s) = Bottom

,

This completes the proof of expr_2_super_fatal_result.

Q.E.D.

C.212 Proofs for State_Transformer_Lift_Stmt (state-transformer.pvs)

C.212 Proofs for State_Transformer_Lift_Stmt (state-transformer.pvs)

This theory contains no provable formal statements.

C.213 Proofs for Statement_Composition_Rewrites (state-transformer.pvs)

C.213.1 Statement_Composition_Rewrites.composition_assoc_rewrite_1

Terse proof for composition_assoc_rewrite_1.
composition_assoc_rewrite_1:

{1} ∀ (stmt_1, stmt_2, stmt_3: [State → StmtResult[State]]):

(stmt_1 ## (stmt_2 ## stmt_3)) = ((stmt_1 ## stmt_2) ## stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_1.

Q.E.D.

C.213.2 Statement_Composition_Rewrites.composition_assoc_rewrite_2

Terse proof for composition_assoc_rewrite_2.
composition_assoc_rewrite_2:

{1} ∀ (lift_stmt_3: [StmtResult[State] → StmtResult[State]],

stmt_1, stmt_2: [State → StmtResult[State]]): (stmt_1 ## (lift(stmt_2) ## lift_stmt_3)) = ((stmt_1 ## stmt_2) ## lift_stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_2.

Q.E.D.

C.213.3 Statement_Composition_Rewrites.composition_assoc_rewrite_3

Terse proof for composition_assoc_rewrite_3.
composition_assoc_rewrite_3:

{1} ∀ (lift_stmt_2: [StmtResult[State] → StmtResult[State]], stmt_1, stmt_3: [State → StmtResult[State]]): (stmt_1 ## (lift_stmt_2 ## stmt_3)) = ((stmt_1 ## lift_stmt_2) ## stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_3.

Q.E.D.

C.213.4 Statement_Composition_Rewrites.composition_assoc_rewrite_4

Terse proof for composition_assoc_rewrite_4.
composition_assoc_rewrite_4:

{1} ∀ (lift_stmt_2, lift_stmt_3: [StmtResult[State] → StmtResult[State]],

stmt_1: [State → StmtResult[State]]): (stmt_1 ## (lift_stmt_2 ## lift_stmt_3)) = ((stmt_1 ## lift_stmt_2) ## lift_stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_4.

Q.E.D.

C.213.5 Statement_Composition_Rewrites.composition_assoc_rewrite_5

Terse proof for composition_assoc_rewrite_5.
composition_assoc_rewrite_5:

{1} ∀ (lift_stmt_1: [StmtResult[State] → StmtResult[State]], stmt_2, stmt_3: [State → StmtResult[State]]): (lift_stmt_1 ## (stmt_2 ## stmt_3)) = ((lift_stmt_1 ## stmt_2) ## stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_5.

Q.E.D.

C.213.6 Statement_Composition_Rewrites.composition_assoc_rewrite_6

Terse proof for composition_assoc_rewrite_6.
composition_assoc_rewrite_6:

{1} ∀ (lift_stmt_1, lift_stmt_3: [StmtResult[State] → StmtResult[State]],

stmt_2: [State → StmtResult[State]]): (equalities[[StmtResult[State] → StmtResult[State]]].=

((lift_stmt_1 ## (lift(stmt_2) ## lift_stmt_3)), ((lift_stmt_1 ## stmt_2) ## lift_stmt_3)))

C.214 Proofs for Statement_Rewrites (statement-rewrites.pvs)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_6.

Q.E.D.

C.213.7 Statement_Composition_Rewrites.composition_assoc_rewrite_7

Terse proof for composition_assoc_rewrite_7.
composition_assoc_rewrite_7:

{1} ∀ (lift_stmt_1, lift_stmt_2: [StmtResult[State] → StmtResult[State]],

stmt_3: [State → StmtResult[State]]): (lift_stmt_1 ## (lift_stmt_2 ## stmt_3)) = ((lift_stmt_1 ## lift_stmt_2) ## stmt_3)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_7.

Q.E.D.

C.213.8 Statement_Composition_Rewrites.composition_assoc_rewrite_8

Terse proof for composition_assoc_rewrite_8.
composition_assoc_rewrite_8:

{1} ∀ (lift_stmt_1, lift_stmt_2, lift_stmt_3: [StmtResult[State] → StmtResult[State]]): (equalities[[StmtResult[State] → StmtResult[State]]].= ((lift_stmt_1 ## (lift_stmt_2 ## lift_stmt_3)), ((lift_stmt_1 ## lift_stmt_2) ## lift_stmt_3)))

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of composition_assoc_rewrite_8.

Q.E.D.

C.214 Proofs for Statement_Rewrites (statement-rewrites.pvs)

This theory contains no provable formal statements.

C.215 Proofs for Statements (statements.pvs)

This theory contains no provable formal statements.

C.216 Proofs for StmtResult (result.pvs)

This theory contains no provable formal statements.

C.217 Proofs for StmtResult_adt (StmtResult_adt.pvs)

This theory contains no provable formal statements.

C.218 Proofs for StmtResult_adt_map (StmtResult_adt.pvs)

This theory contains no provable formal statements.

C.219 Proofs for StmtResult_adt_reduce (StmtResult_adt.pvs)

This theory contains no provable formal statements.

C.220 Proofs for Subtype_stable (graph.pvs)

C.220.1 Subtype_stable.length_stable

Terse proof for length_stable.

length_stable:

{1} ∀ (P: PRED[T ], l: list[T ]):
every(P)(l) ⊃ length[(P)](l) = length[T ](l)

By induction on l, and by repeatedly rewriting and simplifying, This completes the proof of length_stable. Q.E.D.

C.220.2 Subtype_stable.nth_stable_TCC1

Terse proof for nth_stable_TCC1.
nth_stable_TCC1:

{1} ∀ (P: PRED[T ], l: list[T ], n: below(length[T ](l))):
every(P)(l) ⊃ n < length[(P)](l)

Repeatedly Skolemizing and flattening, Rewriting using length_stable, matching in *, This completes the proof of nth_stable_TCC1. Q.E.D.

C.220 Proofs for Subtype_stable (graph.pvs)

C.220.3 Subtype_stable.nth_stable

Terse proof for nth_stable.

nth_stable:

{1} ∀ (P: PRED[T ], l: list[T ], n: below(length(l))): every(P)(l) ⊃ nth[(P)](l, n) = nth[T ](l, n)

Installing automatic rewrites from: length_stable Inducting on l on formula 1, we get 3 subgoals:

nth_stable.1:

{1} ∀ (P: PRED[T ], n: below(length(null))):

every(P)(null) ⊃ nth[(P)](null, n) = nth[T ](null, n)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of nth_stable.1.

nth_stable.2:

{1} ∀ (cons1_var: T, cons2_var: list[T ]):

(∀ (P: PRED[T ], n: below(length(cons2_var))):

every(P)(cons2_var) ⊃ nth[(P)](cons2_var, n) = nth[T ](cons2_var, n)) ⊃ (∀ (P: PRED[T ], n: below(length(cons(cons1_var, cons2_var)))):

every(P)(cons(cons1_var, cons2_var)) ⊃ nth[(P)](cons(cons1_var, cons2_var), n) = nth[T ](cons(cons1_var, cons2_var), n))

Repeatedly Skolemizing and flattening, Expanding the definition of nth, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of every, Applying disjunctive simplification to flatten sequent, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_stable.2.

nth_stable.3:

{1} ∀ (l: list[T ], P: PRED[T ], n: below(length[T ](l))):

every(P)(l) ⊃ n < length[(P)](l)
{2} ∀ (P: PRED[T ], n: below(length(l′))):

every(P)(l′) ⊃ nth[(P)](l′, n) = nth[T ](l′, n)

Hiding formulas: 2, Repeatedly Skolemizing and flattening, Simplifying, rewriting, and recording with decision procedures, This completes the proof of nth_stable.3. Q.E.D.

C.221 Proofs for SuperResult (result.pvs)

This theory contains no provable formal statements.

C.222 Proofs for SuperResult_adt (SuperResult_adt.pvs)

This theory contains no provable formal statements.

C.223 Proofs for SuperResult_adt_map (SuperResult_adt.pvs)

This theory contains no provable formal statements.

C.224 Proofs for SuperResult_adt_reduce (SuperResult_adt.pvs)

This theory contains no provable formal statements.

C.225 Proofs for Super_Embedding (result.pvs)

This theory contains no provable formal statements.

C.226 Proofs for Super_Embedding_Expr (result.pvs)

C.226.1 Super_Embedding_Expr.expr_2_super_res_TCC1

Terse proof for expr_2_super_res_TCC1.
  expr_2_super_res_TCC1:

{1} ∀ (expr: ExprResult[State, Data]):

OK?(expr) ⊃ OK?[State, Data](expr) ∨ Exception?[State, Data](expr)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of expr_2_super_res_TCC1. Q.E.D.

C.226.2 Super_Embedding_Expr.expr_2_super_res_TCC2

Terse proof for expr_2_super_res_TCC2.
  expr_2_super_res_TCC2:

{1} ∀ (expr: ExprResult[State, Data]): has_next_state(expr) ∧ ¬ OK?(expr) ⊃ OK?[State, Data](expr) ∨ Exception?[State, Data](expr)

Trying repeated skolemization, instantiation, and if-lifting,

C.227 Proofs for Super_Embedding_Stmt (result.pvs)

This completes the proof of expr_2_super_res_TCC2. Q.E.D.

C.227 Proofs for Super_Embedding_Stmt (result.pvs)

C.227.1 Super_Embedding_Stmt.stmt_2_super_res_TCC1

Terse proof for stmt_2_super_res_TCC1.
stmt_2_super_res_TCC1:

{1} ∀ (stmt: StmtResult[State]): OK?(stmt) ⊃ OK?[State](stmt) ∨ Break?[State](stmt) ∨ Continue?[State](stmt) ∨ Return?[State](stmt) ∨ Switch?[State](stmt) ∨ Default?[State](stmt) ∨ Exception?[State](stmt)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_2_super_res_TCC1. Q.E.D.

C.227.2 Super_Embedding_Stmt.stmt_2_super_res_TCC2

Terse proof for stmt_2_super_res_TCC2.
stmt_2_super_res_TCC2:

{1} ∀ (stmt: StmtResult[State]): has_next_state(stmt) ∧ ¬ OK?(stmt) ⊃ OK?[State](stmt) ∨ Break?[State](stmt) ∨ Continue?[State](stmt) ∨ Return?[State](stmt) ∨ Switch?[State](stmt) ∨ Default?[State](stmt) ∨ Exception?[State](stmt)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of stmt_2_super_res_TCC2. Q.E.D.

C.228 Proofs for Super_Result_Util (result.pvs)

This theory contains no provable formal statements.

C.229 Proofs for Transformer_Invariant (state-transformer.pvs)

C.229.1 Transformer_Invariant.result_pred_TCC1

Terse proof for result_pred_TCC1.
result_pred_TCC1:

{1} ∀ (res: SuperResult[State]):

has_next_state(res) ⊃ OK?[State](res) ∨ abnormal?[State](res)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of result_pred_TCC1. Q.E.D.

C.229.2 Transformer_Invariant.super_transformer_invariant_next_ok_TCC1

Terse proof for super_transformer_invariant_next_ok_TCC1.
super_transformer_invariant_next_ok_TCC1:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperRe-

sult[State]]], s: State,

q: [State → SuperResult[State]]): transformer_invariant?(states, transformers) ∧ states(s) ∧ transformers(q) ∧ has_next_state(q(s)) ⊃ OK?[State](q(s)) ∨ abnormal?[State](q(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of super_transformer_invariant_next_ok_TCC1.

Q.E.D.

C.229.3 Transformer_Invariant.super_transformer_invariant_next_ok

Terse proof for super_transformer_invariant_next_ok.
super_transformer_invariant_next_ok:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperRe-

sult[State]]], s: State,

q: [State → SuperResult[State]]): transformer_invariant?(states, transformers) ∧ states(s) ∧ transformers(q) ∧ has_next_state(q(s)) ⊃ states(state(q(s)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of super_transformer_invariant_next_ok.

Q.E.D.

C.229 Proofs for Transformer_Invariant (state-transformer.pvs)

C.229.4 Transformer_Invariant.transformer_invariant_mono_transformers

Terse proof for transformer_invariant_mono_transformers.
transformer_invariant_mono_transformers:

{1} ∀ (states: PRED[State], transformers_1, transformers_2: PRED[[State → SuperResult[State]]]): (transformers_1⊆ transformers_2) ∧ transformer_invariant?(states, transformers_2) ⊃ transformer_invariant?(states, transformers_1)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of transformer_invariant_mono_transformers.

Q.E.D.

C.229.5 Transformer_Invariant.transformer_invariant_union_transformers

Terse proof for transformer_invariant_union_transformers.
transformer_invariant_union_transformers:

{1} ∀ (states: PRED[State],

transformers_1, transformers_2: PRED[[State → SuperResult[State]]]): transformer_invariant?(states, transformers_1) ∧ transformer_invariant?(states, transformers_2) ⊃ transformer_invariant?(states, (transformers_1∪ transformers_2))

Installing automatic rewrites from: member Repeatedly Skolemizing and flattening, Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Expanding the definition of union, Splitting conjunctions, we get 2 subgoals:

transformer_invariant_union_transformers.1:

{-1} (q′ ∈ transformers′)

{-2} ∀ (s: State, q: [State → SuperResult[State]]):

states′(s) ∧ transformers′(q) ⊃ result_pred(states′)(q(s))

{-3} ∀ (s: State, q: [State → SuperResult[State]]):

states′(s) ∧ transformers′′(q) ⊃ result_pred(states′)(q(s))

{-4} states′(s′)
{1} result_pred(states′)(q′(s′))

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of transformer_invariant_union_transformers.1.

transformer_invariant_union_transformers.2:

{-1} (q′ ∈ transformers′′)

{-2} ∀ (s: State, q: [State → SuperResult[State]]):

states′(s) ∧ transformers′(q) ⊃ result_pred(states′)(q(s))

{-3} ∀ (s: State, q: [State → SuperResult[State]]):

states′(s) ∧ transformers′′(q) ⊃ result_pred(states′)(q(s))

{-4} states′(s′)
{1} result_pred(states′)(q′(s′))

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of transformer_invariant_union_transformers.2.

Q.E.D.

C.229.6 Transformer_Invariant.transformer_invariant_truth

Terse proof for transformer_invariant_truth.
transformer_invariant_truth:

{1} ∀ (transformers: PRED[[State → SuperResult[State]]]): transformer_invariant?(fullset[State], transformers)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of transformer_invariant_truth.

Q.E.D.

C.229.7 Transformer_Invariant.transformer_invariant_all_transformers

Terse proof for transformer_invariant_all_transformers.
transformer_invariant_all_transformers:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperResult[State]]]):

(∀ (q: [State → SuperResult[State]]):

transformers(q) ⊃ transformer_invariant?(states, singleton(q))) ⊃ transformer_invariant?(states, transformers)

Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures, Instantiating quantified variables, Expanding the definition of singleton, which is trivially true.

This completes the proof of transformer_invariant_all_transformers.

Q.E.D.

C.229.8 Transformer_Invariant.super_transformers_ok_ok

Terse proof for super_transformers_ok_ok.

C.229 Proofs for Transformer_Invariant (state-transformer.pvs)

super_transformers_ok_ok:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperRe-

sult[State]]], s: State,

q: [State → SuperResult[State]]): transformers_ok?(states, transformers) ∧ states(s) ∧ transformers(q) ⊃ OK?(q(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of super_transformers_ok_ok.

Q.E.D.

C.229.9 Transformer_Invariant.transformers_ok_mono_transformers

Terse proof for transformers_ok_mono_transformers.
transformers_ok_mono_transformers:

{1} ∀ (states: PRED[State],

transformers_1, transformers_2: PRED[[State → SuperResult[State]]]): (transformers_1⊆ transformers_2) ∧ transformers_ok?(states, transformers_2) ⊃ transformers_ok?(states, transformers_1)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of transformers_ok_mono_transformers.

Q.E.D.

C.229.10 Transformer_Invariant.transformers_ok_mono_states

Terse proof for transformers_ok_mono_states.
transformers_ok_mono_states:

{1} ∀ (transformers: PRED[[State → SuperResult[State]]], states_1, states_2: PRED[State]): (states_1⊆ states_2) ∧ transformers_ok?(states_2, transformers) ⊃ transformers_ok?(states_1, transformers)

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of transformers_ok_mono_states.

Q.E.D.

C.229.11 Transformer_Invariant.transformers_ok_union_transformers

Terse proof for transformers_ok_union_transformers.
transformers_ok_union_transformers:

{1} ∀ (states: PRED[State],

transformers_1, transformers_2: PRED[[State → SuperResult[State]]]): transformers_ok?(states, transformers_1) ∧ transformers_ok?(states, transform-

ers_2) ⊃ transformers_ok?(states, (transformers_1∪ transformers_2))

Installing automatic rewrites from: member Repeatedly Skolemizing and flattening, Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Expanding the definition of union, Splitting conjunctions, we get 2 subgoals:

transformers_ok_union_transformers.1:

{-1} (q′ ∈ transformers′)

{-2} ∀ (s: State, q: [State → SuperResult[State]]): states′(s) ∧ transformers′(q) ⊃ OK?(q(s)) {-3} ∀ (s: State, q: [State → SuperResult[State]]): states′(s) ∧ transformers′′(q) ⊃ OK?(q(s))

{-4} states′(s′)
{1} OK?(q′(s′))

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of transformers_ok_union_transformers.1.
transformers_ok_union_transformers.2:

{-1} (q′ ∈ transformers′′)

{-2} ∀ (s: State, q: [State → SuperResult[State]]): states′(s) ∧ transformers′(q) ⊃ OK?(q(s)) {-3} ∀ (s: State, q: [State → SuperResult[State]]): states′(s) ∧ transformers′′(q) ⊃ OK?(q(s))

{-4} states′(s′)
{1} OK?(q′(s′))

Instantiating quantified variables, Simplifying, rewriting, and recording with decision procedures,

This completes the proof of transformers_ok_union_transformers.2.

Q.E.D.

C.229.12 Transformer_Invariant.transformers_ok_all_transformers

Terse proof for transformers_ok_all_transformers.
transformers_ok_all_transformers:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperResult[State]]]):

(∀ (q: [State → SuperResult[State]]):

transformers(q) ⊃ transformers_ok?(states, singleton(q))) ⊃ transformers_ok?(states, transformers)

Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating quantified variables, Expanding the definition of singleton, which is trivially true.

This completes the proof of transformers_ok_all_transformers.

Q.E.D.

C.230 Proofs for Transformer_Invariant_2 (state-transformer.pvs)

C.230 Proofs for Transformer_Invariant_2 (state-transformer.pvs)

C.230.1 Transformer_Invariant_2.expr_transformer_invariant_next_ok_TCC1

Terse proof for expr_transformer_invariant_next_ok_TCC1.
expr_transformer_invariant_next_ok_TCC1:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperRe-

sult[State]]], s: State,

q: [State → ExprResult[State, Data]]): transformer_invariant?(states, transformers) ∧ states(s) ∧ transformers(expr_2_super(q)) ∧ has_next_state(q(s)) ⊃ OK?[State, Data](q(s)) ∨ Exception?[State, Data](q(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_transformer_invariant_next_ok_TCC1.

Q.E.D.

C.230.2 Transformer_Invariant_2.expr_transformer_invariant_next_ok

Terse proof for expr_transformer_invariant_next_ok.
expr_transformer_invariant_next_ok:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperRe-

sult[State]]], s: State,

q: [State → ExprResult[State, Data]]): transformer_invariant?(states, transformers) ∧ states(s) ∧ transformers(expr_2_super(q)) ∧ has_next_state(q(s)) ⊃ states(state(q(s)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_transformer_invariant_next_ok.

Q.E.D.

C.230.3 Transformer_Invariant_2.expr_transformers_ok_ok

Terse proof for expr_transformers_ok_ok.
expr_transformers_ok_ok:

{1} ∀ (states: PRED[State], transformers: PRED[[State → SuperRe-

sult[State]]], s: State,

q: [State → ExprResult[State, Data]]): transformers_ok?(states, transformers) ∧ states(s) ∧ transform-

ers(expr_2_super(q)) ⊃ OK?(q(s))

Repeatedly Skolemizing and flattening, Using lemma super_transformers_ok_ok[State], Simplifying, rewriting, and recording with decision procedures, Rewriting using ok_expr_2_super, matching in *, This completes the proof of expr_transformers_ok_ok. Q.E.D.

C.230.4 Transformer_Invariant_2.expr_result_pred_next_state_TCC1

Terse proof for expr_result_pred_next_state_TCC1.
expr_result_pred_next_state_TCC1:

{1} ∀ (states: PRED[State], s: State, q: [State → ExprResult[State, Data]]): has_next_state(q(s)) ∧ result_pred(states)(expr_2_super(q)(s)) ⊃ OK?[State, Data](q(s)) ∨ Exception?[State, Data](q(s))

Repeatedly Skolemizing and flattening, Expanding the definition of has_next_state, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of expr_result_pred_next_state_TCC1.

Q.E.D.

C.230.5 Transformer_Invariant_2.expr_result_pred_next_state

Terse proof for expr_result_pred_next_state.
expr_result_pred_next_state:

{1} ∀ (states: PRED[State], s: State, q: [State → ExprResult[State, Data]]): has_next_state(q(s)) ∧ result_pred(states)(expr_2_super(q)(s)) ⊃ states(state(q(s)))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of expr_result_pred_next_state.

Q.E.D.

C.231 Proofs for Transformer_Invariant_3 (state-transformer.pvs)

C.231.1 Transformer_Invariant_3.fexpr_composition_transformers_ok

Terse proof for fexpr_composition_transformers_ok.
fexpr_composition_transformers_ok:

{1} ∀ (expr1: [State → ExprResult[State, Data1]], fexpr: [Data1 → [State → ExprResult[State, Data2]]], states: PRED[State], P: PRED[Data1]): (transformers_ok?(states, singleton(expr_2_super(expr1))) ∧ transformer_invariant?(states, singleton(expr_2_super(expr1))) ∧ (∀ (s: (states)): OK?(expr1(s)) ⊃ P (data(expr1(s)))) ∧ (∀ (d: (P)): transformers_ok?(states, singleton(expr_2_super(fexpr(d)))))) ⊃ transformers_ok?(states, singleton(expr_2_super(expr1 ## fexpr)))

C.231 Proofs for Transformer_Invariant_3 (state-transformer.pvs)

Expanding the definition of transformers_ok?, Repeatedly Skolemizing and flattening, Installing automatic rewrites from: singleton ## expr_2_super expr_2_super_res Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Replacing using formula -6, Hiding formulas: -6, Instantiating quantified variables, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -5 with the terms: (data(expr1!1(s!1))), Instantiating the top quantifier in -5 with the terms: (state(expr1!1(s!1)) expr_2_super(fexpr!1(data(expr1!1(s!1))))), we get 2 subgoals:

fexpr_composition_transformers_ok.1:

{-1} states′(s′)
{-2} OK?(expr_2_super_res(expr1′(s′)))
{-3} transformer_invariant?(states′, singleton(expr_2_super(expr1′)))
{-4} P′(data(expr1′(s′)))

{-5} states′(state(expr1′(s′))) ⊃

OK?(expr_2_super(fexpr′(data(expr1′(s′))))(state(expr1′(s′))))

{1} OK?(expr_2_super_res((expr1′ ## fexpr′)(s′)))

Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma expr_transformer_invariant_next_ok, Installing automatic rewrites from: has_next_state Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of fexpr_composition_transformers_ok.1.
fexpr_composition_transformers_ok.2:

{-1} states′(s′)
{-2} OK?(expr_2_super_res(expr1′(s′)))
{-3} transformer_invariant?(states′, singleton(expr_2_super(expr1′)))
{-4} P′(data(expr1′(s′)))
{1} OK?[State, Data1](expr1′(s′)) ∨ Exception?[State, Data1](expr1′(s′))
{2} OK?(expr_2_super_res((expr1′ ## fexpr′)(s′)))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of fexpr_composition_transformers_ok.2.

Q.E.D.

C.231.2 Transformer_Invariant_3.expr_composition_transformers_ok

Terse proof for expr_composition_transformers_ok.
expr_composition_transformers_ok:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], states: PRED[State]): transformers_ok?(states, singleton(expr_2_super(expr1))) ∧ transformer_invariant?(states, singleton(expr_2_super(expr1))) ∧ transformers_ok?(states, singleton(expr_2_super(expr2))) ⊃ transformers_ok?(states, singleton(expr_2_super(expr1 ## expr2)))

Repeatedly Skolemizing and flattening, Using lemma fexpr_composition_transformers_ok, Expanding the definition of ##, Expanding the definition of ##, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of expr_composition_transformers_ok.

Q.E.D.

C.231.3 Transformer_Invariant_3.fexpr_composition_transformer_invariant

Terse proof for fexpr_composition_transformer_invariant.
fexpr_composition_transformer_invariant:

{1} ∀ (expr1: [State → ExprResult[State, Data1]], fexpr: [Data1 → [State → ExprResult[State, Data2]]], states: PRED[State], P: PRED[Data1]): (transformer_invariant?(states, singleton(expr_2_super(expr1))) ∧ (∀ (s: (states)): OK?(expr1(s)) ⊃ P (data(expr1(s)))) ∧ (∀ (d: (P)): transformer_invariant?(states, singleton(expr_2_super(fexpr(d)))))) ⊃ transformer_invariant?(states, singleton(expr_2_super(expr1 ## fexpr)))

Expanding the definition of transformer_invariant?, Repeatedly Skolemizing and flattening, Expanding the definition of singleton, Replacing using formula -5, Hiding formulas: -5, Instantiating quantified variables, Instantiating quantified variables, Case splitting on OK?(expr1!1(s!1)), we get 2 subgoals:

fexpr_composition_transformer_invariant.1:

{-1} OK?(expr1′(s′))
{-2} states′(s′) ⊃ result_pred(states′)(expr_2_super(expr1′)(s′))
{-3} OK?(expr1′(s′)) ⊃ P′(data(expr1′(s′)))
{-4} ∀ (d: (P′)):

∀ (s: State, q: [State → SuperResult[State]]):

states′(s) ∧ q = expr_2_super(fexpr′(d)) ⊃ result_pred(states′)(q(s))

{-5} states′(s′)
{1} result_pred(states′)(expr_2_super(expr1′ ## fexpr′)(s′))

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -5 with the terms: (data(expr1!1(s!1))), Instantiating the top quantifier in -5 with the terms: (state(expr1!1(s!1)) expr_2_super(fexpr!1(data(expr1!1(s!1))))), Installing automatic rewrites from: ## result_pred expr_2_super expr_2_super_res has_next_state Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of fexpr_composition_transformer_invariant.1.

C.232 Proofs for Transformer_Super_Embedding (state-transformer.pvs)

fexpr_composition_transformer_invariant.2:

{-1} states′(s′) ⊃ result_pred(states′)(expr_2_super(expr1′)(s′))
{-2} OK?(expr1′(s′)) ⊃ P′(data(expr1′(s′)))
{-3} ∀ (d: (P′)):

∀ (s: State, q: [State → SuperResult[State]]):

states′(s) ∧ q = expr_2_super(fexpr′(d)) ⊃ result_pred(states′)(q(s))

{-4} states′(s′)
{1} OK?(expr1′(s′))
{2} result_pred(states′)(expr_2_super(expr1′ ## fexpr′)(s′))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of fexpr_composition_transformer_invariant.2.

Q.E.D.

C.231.4 Transformer_Invariant_3.expr_composition_transformer_invariant

Terse proof for expr_composition_transformer_invariant.
expr_composition_transformer_invariant:

{1} ∀ (expr1: [State → ExprResult[State, Data1]],

expr2: [State → ExprResult[State, Data2]], states: PRED[State]): transformer_invariant?(states, singleton(expr_2_super(expr1))) ∧ transformer_invariant?(states, singleton(expr_2_super(expr2))) ⊃ transformer_invariant?(states, singleton(expr_2_super(expr1 ## expr2)))

Repeatedly Skolemizing and flattening, Using lemma fexpr_composition_transformer_invariant, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of ##, Expanding the definition of ##, which is trivially true.

This completes the proof of expr_composition_transformer_invariant.

Q.E.D.

C.232 Proofs for Transformer_Super_Embedding (state-transformer.pvs)

This theory contains no provable formal statements.

C.233 Proofs for Transformer_Super_Embedding_Expr (state-transformer.pvs)

C.233.1 Transformer_Super_Embedding_Expr.ok_expr_2_super

Terse proof for ok_expr_2_super.

ok_expr_2_super:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State): OK?(expr_2_super(expr)(s)) = OK?(expr(s))

, This completes the proof of ok_expr_2_super. Q.E.D.

C.233.2 Transformer_Super_Embedding_Expr.has_next_state_expr_2_super

Terse proof for has_next_state_expr_2_super.
has_next_state_expr_2_super:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State):

has_next_state(expr_2_super(expr)(s)) = has_next_state(expr(s))

,

This completes the proof of has_next_state_expr_2_super.

Q.E.D.

C.233.3 Transformer_Super_Embedding_Expr.state_expr_2_super_TCC1

Terse proof for state_expr_2_super_TCC1.
state_expr_2_super_TCC1:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State): has_next_state(expr(s)) ⊃ OK?[State](expr_2_super(expr)(s)) ∨ abnormal?[State](expr_2_super(expr)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of state_expr_2_super_TCC1. Q.E.D.

C.233.4 Transformer_Super_Embedding_Expr.state_expr_2_super_TCC2

Terse proof for state_expr_2_super_TCC2.
state_expr_2_super_TCC2:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State): has_next_state(expr(s)) ⊃ OK?[State, Data](expr(s)) ∨ Exception?[State, Data](expr(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of state_expr_2_super_TCC2. Q.E.D.

C.234 Proofs for Transformer_Super_Embedding_Stmt (state-transformer.pvs)

C.233.5 Transformer_Super_Embedding_Expr.state_expr_2_super

Terse proof for state_expr_2_super.
state_expr_2_super:

{1} ∀ (expr: [State → ExprResult[State, Data]], s: State):

has_next_state(expr(s)) ⊃ state(expr_2_super(expr)(s)) = state(expr(s))

, This completes the proof of state_expr_2_super. Q.E.D.

C.234 Proofs for Transformer_Super_Embedding_Stmt (state-transformer.pvs)

C.234.1 Transformer_Super_Embedding_Stmt.ok_stmt_2_super

Terse proof for ok_stmt_2_super.
ok_stmt_2_super:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt_2_super(stmt)(s)) = OK?(stmt(s))

, This completes the proof of ok_stmt_2_super. Q.E.D.

C.234.2 Transformer_Super_Embedding_Stmt.has_next_state_stmt_2_super

Terse proof for has_next_state_stmt_2_super.
has_next_state_stmt_2_super:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

has_next_state(stmt_2_super(stmt)(s)) = has_next_state(stmt(s))

,

This completes the proof of has_next_state_stmt_2_super.

Q.E.D.

C.234.3 Transformer_Super_Embedding_Stmt.state_stmt_2_super_TCC1

Terse proof for state_stmt_2_super_TCC1.
state_stmt_2_super_TCC1:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]): has_next_state(stmt(s)) ⊃ OK?[State](stmt_2_super(stmt)(s)) ∨ abnormal?[State](stmt_2_super(stmt)(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of state_stmt_2_super_TCC1. Q.E.D.

C.234.4 Transformer_Super_Embedding_Stmt.state_stmt_2_super_TCC2

Terse proof for state_stmt_2_super_TCC2.
state_stmt_2_super_TCC2:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

has_next_state(stmt(s)) ⊃ OK?[State](stmt(s)) ∨ Break?[State](stmt(s)) ∨ Continue?[State](stmt(s)) ∨ Return?[State](stmt(s)) ∨ Switch?[State](stmt(s)) ∨ Default?[State](stmt(s)) ∨ Exception?[State](stmt(s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of state_stmt_2_super_TCC2. Q.E.D.

C.234.5 Transformer_Super_Embedding_Stmt.state_stmt_2_super

Terse proof for state_stmt_2_super.
state_stmt_2_super:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

has_next_state(stmt(s)) ⊃ state(stmt_2_super(stmt)(s)) = state(stmt(s))

, This completes the proof of state_stmt_2_super. Q.E.D.

C.235 Proofs for UnaryExpressions (expressions.pvs)

C.235.1 UnaryExpressions.deref_TCC1

Terse proof for deref_TCC1.

deref_TCC1:

{1} ∀ ((p_typ: Cpp_Subtype(cv(pointer?)))): pointer?(cv_base(p_typ))

Repeatedly Skolemizing and flattening, Rewriting using cv_base_result, matching in *, Keeping (1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of deref_TCC1. Q.E.D.

C.235 Proofs for UnaryExpressions (expressions.pvs)

C.235.2 UnaryExpressions.arrow_TCC1

Terse proof for arrow_TCC1.

arrow_TCC1:

{1} ∀ (t: Cpp_Type):

pointer?(t) ⊃ array?(t) ∨ pointer?(t) ∨ reference?(t) ∨ bitfield?(t) ∨ enum?(t) ∨ pointer_to_member?(t) ∨ const?(t) ∨ volatile?(t)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of arrow_TCC1. Q.E.D.

C.235.3 UnaryExpressions.arrow_TCC2

Terse proof for arrow_TCC2.

arrow_TCC2:

{1} ∀ ((p_typ:

Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] (λ (t: Cpp_Type): pointer?(t) ∧ (class?(typ(t)) ∨ union?(typ(t)))))))):

cv(pointer?)(p_typ)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of arrow_TCC2. Q.E.D.

C.235.4 UnaryExpressions.unary_minus_TCC1

Terse proof for unary_minus_TCC1.
unary_minus_TCC1:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] ({t: Cpp_Type |

(char?(t) ∨

wchar_t?(t) ∨ signed_integer?(t))}))),

n: (range(typ))): cv(non_bool_integral_enum?)(typ)

Repeatedly Skolemizing and flattening, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of unary_minus_TCC1. Q.E.D.

C.235.5 UnaryExpressions.unary_minus_TCC2

Terse proof for unary_minus_TCC2.
unary_minus_TCC2:

{1} ∀ (typ:

Cpp_Subtype(cv(extend[Cpp_Type_, Cpp_Type, bool, false] ({t: Cpp_Type |

(char?(t) ∨

wchar_t?(t) ∨ signed_integer?(t))})))):

cv(non_bool_integral_enum?)(typ)

Repeatedly Skolemizing and flattening, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of unary_minus_TCC2. Q.E.D.

C.235.6 UnaryExpressions.unary_minus_unsigned_TCC1

Terse proof for unary_minus_unsigned_TCC1.
unary_minus_unsigned_TCC1:

{1} ∀ (typ: Cpp_Subtype(cv(unsigned_integer?)), n: (range(typ))):

cv(non_bool_integral_enum?)(typ)

Repeatedly Skolemizing and flattening, Keeping (-2 1) and hiding *, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unary_minus_unsigned_TCC1.

Q.E.D.

C.235.7 UnaryExpressions.unary_minus_unsigned_TCC2

Terse proof for unary_minus_unsigned_TCC2.
unary_minus_unsigned_TCC2:

{1} ∀ (typ: Cpp_Subtype(cv(unsigned_integer?))): cv(non_bool_integral_enum?)(typ)

Repeatedly Skolemizing and flattening, Hiding formulas: -1, Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of unary_minus_unsigned_TCC2.

Q.E.D.

C.235.8 UnaryExpressions.preinc_TCC1

Terse proof for preinc_TCC1.

preinc_TCC1:

{1} ∀ ((typ: Cpp_Subtype(v(non_bool_integral?)))): cv(non_bool_integral_enum?)(typ)

C.236 Proofs for Uninterpreted_Data (abstract_data.pvs)

Repeatedly Skolemizing and flattening, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of preinc_TCC1. Q.E.D.

C.235.9 UnaryExpressions.sizeof_TCC1

Terse proof for sizeof_TCC1.

sizeof_TCC1:

{1} Cpp_Type?(uint) ∧ cv(non_bool_integral_enum?)(uint)

Trying repeated skolemization, instantiation, and if-lifting, Expanding the definition of Cpp_Type?, Repeatedly Skolemizing and flattening, Expanding the definition of subterm, Replacing using formula -1, Installing automatic rewrites from: no_pointers_to_bitfield? no_pointers_to_references?

no_cv_references? no_reference_to_reference? no_reference_to_bitfields? no_pointer_to_member_to_reference? no_pointer_to_member_to_cv_void? no_cv_void_parameter? no_array_of_references? no_array_of_bitfields? no_array_of_cv_void? no_array_of_function? no_array_of_abstract_class? no_pointer_or_ref_to_incomplete_array_parameter? no_array_return_type? no_function_return_type? bitfield_underlying_integral_or_enum_type? cv_array? enum_underlying_integral? enum_constants? const_volatile? const_stutter? volatile_stutter? no_cv_class? no_cv_union? no_cv_function? no_reference_to_void? no_cv_void?

Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of sizeof_TCC1. Q.E.D.

C.236 Proofs for Uninterpreted_Data (abstract_data.pvs)

C.236.1 Uninterpreted_Data.u_data_type_length

Terse proof for u_data_type_length.
u_data_type_length:

{1} ∀ (uidt: (uninterpreted_data_type?), l: list[Byte], a: Address): valid?(uidt)(l, a) ⊃ length(l) = size(uidt)

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of u_data_type_length. Q.E.D.

C.237 Proofs for Unit (vfiasco-prelude.pvs)

This theory contains no provable formal statements.

C.238 Proofs for Unit_adt (Unit_adt.pvs)

This theory contains no provable formal statements.

C.239 Proofs for Unit_adt_reduce (Unit_adt.pvs)

This theory contains no provable formal statements.

C.240 Proofs for While_Hoare (statement-rewrites.pvs)

C.240.1 While_Hoare.iterate_while_right

Terse proof for iterate_while_right.
iterate_while_right:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], n: nat): iterate_while(1 + n, b_ex, body) = iterate_while(n, b_ex, body) ## lift(e2s(b_ex) ## body ## catch_continue)

Installing automatic rewrites from: erplus_ax erminus_ax extended_real_superset_of_number_fields Inducting on n on formula 1, we get 2 subgoals:

iterate_while_right.1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]): iterate_while(1 + 0, b_ex, body) = iterate_while(0, b_ex, body) ## lift(e2s(b_ex) ## body ## catch_continue)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Trying repeated skolemization, instantiation, and if-lifting, Applying eta axiom scheme to body!1(state(b_ex!1(x!1))), This completes the proof of iterate_while_right.1.

iterate_while_right.2:

{1} ∀ j:

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]):

iterate_while(1 + j, b_ex, body) = iterate_while(j, b_ex, body) ## lift(e2s(b_ex) ## body ## catch_continue))

⊃

(∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]):

iterate_while(1 + j + 1, b_ex, body) = iterate_while(j + 1, b_ex, body) ## lift(e2s(b_ex) ## body ## catch_continue))

Repeatedly Skolemizing and flattening, Instantiating quantified variables,

C.240 Proofs for While_Hoare (statement-rewrites.pvs)

Expanding the definition of iterate_while, Expanding the definition of ##, Applying decompose-equality, Expanding the definition of lift, Replacing using formula -2, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, This completes the proof of iterate_while_right.2. Q.E.D.

C.240.2 While_Hoare.while_variant?_TCC1

Terse proof for while_variant?_TCC1.

while_variant?_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

<: PRED[[Ord, Ord]], variant: [State → Ord], Q: PRED[StmtResult[State]]): while_invariant?(b_ex, body)(Q, Q) ∧ well_founded?(<) ⊃ (∀ (s: State):

Q(OK(s)) ∧ OK?(b_ex(s)) ∧ data(b_ex(s)) ∧ OK?((e2s(b_ex) ## body ## catch_continue)(s)) ⊃ OK?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨ Break?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Continue?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Return?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Switch?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Default?[State]

((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s))

∨

Exception?[State] ((##[State]

(##[State](e2s[State, boolean](b_ex), body),

catch_continue[State])) (s)))

C.240 Proofs for While_Hoare (statement-rewrites.pvs)

Repeatedly Skolemizing and flattening, This completes the proof of while_variant?_TCC1. Q.E.D.

C.240.3 While_Hoare.while_no_cb_TCC1

Terse proof for while_no_cb_TCC1.
while_no_cb_TCC1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State): (∃ (n: nat): while_termination_point?(b_ex, body, s)(n)) ⊃ nonempty?[nat](while_termination_point?[State](b_ex, body, s))

Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of while_no_cb_TCC1. Q.E.D.

C.240.4 While_Hoare.while_no_cb_cb_while

Terse proof for while_no_cb_cb_while.
while_no_cb_cb_while:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]]): while(b_ex, body) = (while_no_cb(b_ex, body) ## catch_break)

Repeatedly Skolemizing and flattening, Applying decompose-equality, Expanding the definition of while, Expanding the definition of while_no_cb, Trying repeated skolemization, instantiation, and if-lifting, This completes the proof of while_no_cb_cb_while. Q.E.D.

C.240.5 While_Hoare.iterate_while_invariant

Terse proof for iterate_while_invariant.
iterate_while_invariant:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s_{0}: State, inv_abnorm?, inv_norm?: PRED[StmtResult[State]], n: nat): (while_invariant?(b_ex, body)(inv_abnorm?, inv_norm?) ∧ inv_abnorm?(OK(s_{0})) ∧ (∀ (m: nat): m < n ⊃ ¬ while_termination_point?(b_ex, body, s_{0})(m))) ⊃ inv_abnorm?(iterate_while(n, b_ex, body)(s_{0}))

Inducting on n on formula 1, we get 2 subgoals:

iterate_while_invariant.1:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s_{0}: State, inv_abnorm?, inv_norm?: PRED[StmtResult[State]]): (while_invariant?(b_ex, body)(inv_abnorm?, inv_norm?) ∧ inv_abnorm?(OK(s_{0})) ∧ (∀ (m: nat): m < 0 ⊃ ¬ while_termination_point?(b_ex, body, s_{0})(m))) ⊃ inv_abnorm?(iterate_while(0, b_ex, body)(s_{0}))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of iterate_while_invariant.1.
iterate_while_invariant.2:

{1} ∀ j: (∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtRe- sult[State]], s_{0}: State, inv_abnorm?, inv_norm?: PRED[StmtResult[State]]): (while_invariant?(b_ex, body)(inv_abnorm?, inv_norm?) ∧ inv_abnorm?(OK(s_{0})) ∧ (∀ (m: nat): m < j ⊃ ¬ while_termination_point?(b_ex, body, s_{0})(m))) ⊃ inv_abnorm?(iterate_while(j, b_ex, body)(s_{0}))) ⊃ (∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtRe- sult[State]], s_{0}: State, inv_abnorm?, inv_norm?: PRED[StmtResult[State]]): (while_invariant?(b_ex, body)(inv_abnorm?, inv_norm?) ∧ inv_abnorm?(OK(s_{0})) ∧ (∀ (m: nat): m < j + 1 ⊃ ¬ while_termination_point?(b_ex, body, s_{0})(m))) ⊃ inv_abnorm?(iterate_while(j + 1, b_ex, body)(s_{0})))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Instantiating the top quantifier in -2 with the terms: (s0!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, we get 2 subgoals:

iterate_while_invariant.2.1:

{-1} j′ ≥ 0
{-2} while_invariant?(b_ex′, body′)(inv_abnorm?′, inv_norm?′)
{-3} inv_abnorm?′(OK(s′_{0}))
{-4} inv_abnorm?′(iterate_while(j′, b_ex′, body′)(s′_{0}))
{-5} ∀ (m: nat): m < 1 + j′ ⊃ ¬ while_termination_point?(b_ex′, body′, s′_{0})(m)
{1} inv_abnorm?′(iterate_while(1 + j′, b_ex′, body′)(s′_{0}))

Expanding the definition of while_invariant?, Using lemma iterate_while_right, Simplifying, rewriting, and recording with decision procedures, Replacing using formula -1, Instantiating the top quantifier in -6 with the terms: (j!1), Expanding the definition of while_termination_point?, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Instantiating the top quantifier in -3 with the terms: (state(iterate_while(j!1, b_ex!1, body!1)(s0!1))),

C.240 Proofs for While_Hoare (statement-rewrites.pvs)

Applying eta axiom scheme to iterate_while(j!1, b_ex!1, body!1)(s0!1), Expanding the definition of ##, Expanding the definition of lift, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of skip, Replacing using formula -1, which is trivially true.

This completes the proof of iterate_while_invariant.2.1.
iterate_while_invariant.2.2:

{-1} j′ ≥ 0
{-2} while_invariant?(b_ex′, body′)(inv_abnorm?′, inv_norm?′)
{-3} inv_abnorm?′(OK(s′_{0}))
{-4} ∀ (m: nat): m < 1 + j′ ⊃ ¬ while_termination_point?(b_ex′, body′, s′_{0})(m)
{1} ∀ (m: nat): m < j′ ⊃ ¬ while_termination_point?(b_ex′, body′, s′_{0})(m)
{2} inv_abnorm?′(iterate_while(1 + j′, b_ex′, body′)(s′_{0}))

Repeatedly Skolemizing and flattening, Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of iterate_while_invariant.2.2.

Q.E.D.

C.240.6 While_Hoare.min_termination_point_no_less

Terse proof for min_termination_point_no_less.
min_termination_point_no_less:

{1} ∀ (b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s_{0}: State, m: nat): (∃ (n: nat): while_termination_point?(b_ex, body, s_{0})(n)) ∧ m < min[nat](while_termination_point?(b_ex, body, s_{0})) ⊃ ¬ while_termination_point?(b_ex, body, s_{0})(m)

Repeatedly Skolemizing and flattening, Adding type constraints for min[nat](while_termination_point?(b_ex!1, body!1, s0!1)), Instantiating quantified variables, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of min_termination_point_no_less.

Q.E.D.

C.240.7 While_Hoare.while_terminates

The L^{A}TEX code for this proof is broken.

C.240.8 While_Hoare.hoare_while

The L^{A}TEX code for this proof is broken.

C.241 Proofs for While_Rewrites (statement-rewrites.pvs)

C.241.1 While_Rewrites.while_to_while_no_cb

Terse proof for while_to_while_no_cb.
while_to_while_no_cb:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

variant: [State → [State → Ord]]): while[State, Ord](b_ex, body)(P, Q, R, variant, <) = (while_no_cb(b_ex, body)(P, Q, R, variant, <) ## catch_break)

Expanding the definition of while_no_cb, Expanding the definition of while, Repeatedly Skolemizing and flattening, Using lemma while_no_cb_cb_while[State, Ord], This completes the proof of while_to_while_no_cb. Q.E.D.

C.241.2 While_Rewrites.while_inv_rewrite_termination_result

Terse proof for while_inv_rewrite_termination_result.
while_inv_rewrite_termination_result:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]], S: PRED[StmtResult[State]], b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, vari-

ant: [State → [State → Ord]]):

(P (s)(skip(s)) ∧ R(s)(skip(s)) ∧ while_variant?(b_ex, body, <)(variant(s), R(s)) ∧ while_invariant?(b_ex, body)(P (s), Q(s)) ∧ (∀ (res: StmtResult[State]): R(s)(res) ⊃ S(res))) ⊃ S(while_no_cb(b_ex, body)(P, Q, R, variant, <)(s))

Repeatedly Skolemizing and flattening, Using lemma hoare_while[State, Ord], Installing automatic rewrites from: skip while_no_cb Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement,

This completes the proof of while_inv_rewrite_termination_result.

Q.E.D.

C.241.3 While_Rewrites.while_inv_rewrite_data_ok

Terse proof for while_inv_rewrite_data_ok.

C.241 Proofs for While_Rewrites (statement-rewrites.pvs)

while_inv_rewrite_data_ok:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

S: PRED[StmtResult[State]], b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, vari-

ant: [State → [State → Ord]]):

(P (s)(skip(s)) ∧ R(s)(skip(s)) ∧ while_variant?(b_ex, body, <)(variant(s), R(s)) ∧ while_invariant?(b_ex, body)(P (s), Q(s)) ∧ OK?(while_no_cb(b_ex, body)(P, Q, R, variant, <)(s)) ∧ (∀ (res: StmtResult[State]): Q(s)(res) ⊃ S(res))) ⊃ S(while_no_cb(b_ex, body)(P, Q, R, variant, <)(s))

Installing automatic rewrites from: skip while_no_cb Repeatedly Skolemizing and flattening, Using lemma hoare_while[State, Ord], Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement,

This completes the proof of while_inv_rewrite_data_ok.

Q.E.D.

C.241.4 While_Rewrites.while_inv_rewrite_data_break

Terse proof for while_inv_rewrite_data_break.
while_inv_rewrite_data_break:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

S: PRED[StmtResult[State]], b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, vari-

ant: [State → [State → Ord]]):

(P (s)(skip(s)) ∧ R(s)(skip(s)) ∧ while_variant?(b_ex, body, <)(variant(s), R(s)) ∧ while_invariant?(b_ex, body)(P (s), Q(s)) ∧ Break?(while_no_cb(b_ex, body)(P, Q, R, variant, <)(s)) ∧ (∀ (res: StmtResult[State]):

(P (s)(res) ∨ Q(s)(res)) ∧ Break?(res) ⊃ S(res)))

⊃ S(while_no_cb(b_ex, body)(P, Q, R, variant, <)(s))

Installing automatic rewrites from: skip while_no_cb Repeatedly Skolemizing and flattening, Using lemma hoare_while[State, Ord], Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement,

This completes the proof of while_inv_rewrite_data_break.

Q.E.D.

C.241.5 While_Rewrites.while_inv_rewrite_data_return

Terse proof for while_inv_rewrite_data_return.

while_inv_rewrite_data_return:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]], S: PRED[StmtResult[State]], b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, vari-

ant: [State → [State → Ord]]):

(P (s)(skip(s)) ∧ R(s)(skip(s)) ∧ while_variant?(b_ex, body, <)(variant(s), R(s)) ∧ while_invariant?(b_ex, body)(P (s), Q(s)) ∧ Return?(while_no_cb(b_ex, body)(P, Q, R, variant, <)(s)) ∧ (∀ (res: StmtResult[State]):

(P (s)(res) ∨ Q(s)(res)) ∧ Return?(res) ⊃ S(res)))

⊃ S(while_no_cb(b_ex, body)(P, Q, R, variant, <)(s))

Installing automatic rewrites from: skip while_no_cb Repeatedly Skolemizing and flattening, Using lemma hoare_while[State, Ord], Repeatedly simplifying with decision procedures, rewriting, propositional reasoning, quantifier in-

stantiation, skolemization, if-lifting and equality replacement,

This completes the proof of while_inv_rewrite_data_return.

Q.E.D.

C.241.6 While_Rewrites.stmt_while_inv_rewrite_termination_result_TCC1

Terse proof for stmt_while_inv_rewrite_termination_result_TCC1.
stmt_while_inv_rewrite_termination_result_TCC1:

{1} ∀ (s: State, stmt: [State → StmtResult[State]]):

OK?(stmt(s)) ⊃ OK?[State](stmt(s)) ∨ Break?[State](stmt(s)) ∨ Continue?[State](stmt(s)) ∨ Return?[State](stmt(s)) ∨ Switch?[State](stmt(s)) ∨ Default?[State](stmt(s)) ∨ Exception?[State](stmt(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of stmt_while_inv_rewrite_termination_result_TCC1.

Q.E.D.

C.241.7 While_Rewrites.stmt_while_inv_rewrite_termination_result

Terse proof for stmt_while_inv_rewrite_termination_result.

stmt_while_inv_rewrite_termination_result:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]], S: PRED[StmtResult[State]], b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, stmt: [State → StmtRe-

sult[State]],

variant: [State → [State → Ord]]): (OK?(stmt(s)) ∧

P (state(stmt(s)))(stmt(s)) ∧ R(state(stmt(s)))(stmt(s)) ∧ while_variant?(b_ex, body, <)

(variant(state(stmt(s))), R(state(stmt(s))))

∧

while_invariant?(b_ex, body)(P (state(stmt(s))), Q(state(stmt(s)))) ∧ (∀ (res: StmtResult[State]): R(state(stmt(s)))(res) ⊃ S(res))) ⊃ S((stmt ## while_no_cb(b_ex, body)(P, Q, R, variant, <))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: ## skip lift! Using lemma while_inv_rewrite_termination_result, Applying eta axiom scheme to stmt!1(s!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of stmt_while_inv_rewrite_termination_result.

Q.E.D.

C.241.8 While_Rewrites.stmt_while_inv_rewrite_data_ok

Terse proof for stmt_while_inv_rewrite_data_ok.
stmt_while_inv_rewrite_data_ok:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]], S: PRED[StmtResult[State]], b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, stmt: [State → StmtRe-

sult[State]],

variant: [State → [State → Ord]]): (OK?(stmt(s)) ∧

P (state(stmt(s)))(stmt(s)) ∧ R(state(stmt(s)))(stmt(s)) ∧ while_variant?(b_ex, body, <)

(variant(state(stmt(s))), R(state(stmt(s))))

∧

while_invariant?(b_ex, body)(P (state(stmt(s))), Q(state(stmt(s)))) ∧ OK?((stmt ## while_no_cb(b_ex, body)(P, Q, R, variant, <))(s)) ∧ (∀ (res: StmtResult[State]): Q(state(stmt(s)))(res) ⊃ S(res)))

⊃ S((stmt ## while_no_cb(b_ex, body)(P, Q, R, variant, <))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: ## skip lift! Applying eta axiom scheme to stmt!1(s!1), Using lemma while_inv_rewrite_data_ok, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of stmt_while_inv_rewrite_data_ok.

Q.E.D.

C.241.9 While_Rewrites.stmt_while_inv_rewrite_data_break

Terse proof for stmt_while_inv_rewrite_data_break.
stmt_while_inv_rewrite_data_break:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]], S: PRED[StmtResult[State]], b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, stmt: [State → StmtRe- sult[State]], variant: [State → [State → Ord]]): (OK?(stmt(s)) ∧ P (state(stmt(s)))(stmt(s)) ∧ R(state(stmt(s)))(stmt(s)) ∧ while_variant?(b_ex, body, <) (variant(state(stmt(s))), R(state(stmt(s)))) ∧ while_invariant?(b_ex, body)(P (state(stmt(s))), Q(state(stmt(s)))) ∧ Break?((stmt ## while_no_cb(b_ex, body)(P, Q, R, variant, <))(s)) ∧ (∀ (res: StmtResult[State]): (P (state(stmt(s)))(res) ∨ Q(state(stmt(s)))(res)) ∧ Break?(res) ⊃ S(res))) ⊃ S((stmt ## while_no_cb(b_ex, body)(P, Q, R, variant, <))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: ## skip lift! Applying eta axiom scheme to stmt!1(s!1), Using lemma while_inv_rewrite_data_break, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of stmt_while_inv_rewrite_data_break.

Q.E.D.

C.241.10 While_Rewrites.stmt_while_inv_rewrite_data_return

Terse proof for stmt_while_inv_rewrite_data_return.

stmt_while_inv_rewrite_data_return:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]], S: PRED[StmtResult[State]], b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]], s: State, stmt: [State → StmtRe- sult[State]], variant: [State → [State → Ord]]): (OK?(stmt(s)) ∧ P (state(stmt(s)))(stmt(s)) ∧ R(state(stmt(s)))(stmt(s)) ∧ while_variant?(b_ex, body, <) (variant(state(stmt(s))), R(state(stmt(s)))) ∧ while_invariant?(b_ex, body)(P (state(stmt(s))), Q(state(stmt(s)))) ∧ Return?((stmt ## while_no_cb(b_ex, body)(P, Q, R, variant, <))(s)) ∧ (∀ (res: StmtResult[State]): (P (state(stmt(s)))(res) ∨ Q(state(stmt(s)))(res)) ∧ Return?(res) ⊃ S(res))) ⊃ S((stmt ## while_no_cb(b_ex, body)(P, Q, R, variant, <))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: ## skip lift! Applying eta axiom scheme to stmt!1(s!1), Using lemma while_inv_rewrite_data_return, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting,

This completes the proof of stmt_while_inv_rewrite_data_return.

Q.E.D.

C.241.11 While_Rewrites.pm_q_prop_while

Terse proof for pm_q_prop_while.
pm_q_prop_while:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

pm: Plain_Memory[State], s: State, variant: [State → [State → Ord]]): let pm_q_prop_inv =

λ (s_1: State): λ (res: StmtResult[State]): pm_q_prop(pm)(catch_break(res)) in pm`states(s) ∧ R(s)(skip(s)) ∧ while_variant?(b_ex, body, <)(variant(s), R(s)) ∧ while_invariant?(b_ex, body)(pm_q_prop_inv(s), pm_q_prop_inv(s))

⊃ pm_q_prop(pm)(while(b_ex, body)(P, Q, R, variant, <)(s))

Repeatedly Skolemizing and flattening, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma hoare_while[State, Ord], Rewriting using while_to_while_no_cb, matching in *, Expanding the definition of ##, Expanding the definition of while_no_cb, Expanding the definition of skip, Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pm_q_prop, Expanding the definition of catch_break, which is trivially true. This completes the proof of pm_q_prop_while. Q.E.D.

C.241.12 While_Rewrites.pm_q_prop_stmt_while_TCC1

Terse proof for pm_q_prop_stmt_while_TCC1.
pm_q_prop_stmt_while_TCC1:

{1} ∀ (pm: Plain_Memory[State], s: State, stmt: [State → StmtResult[State]], pm_q_prop_inv: [State → [StmtResult[State] → bool]]):

(pm_q_prop(pm)(stmt(s)) ∧ pm_q_prop_inv = (λ (s_1: State):

λ (res: StmtResult[State]): pm_q_prop(pm)(catch_break(res)))) ⊃ OK?[State](stmt(s)) ∨ Break?[State](stmt(s)) ∨ Continue?[State](stmt(s)) ∨ Return?[State](stmt(s)) ∨ Switch?[State](stmt(s)) ∨ Default?[State](stmt(s)) ∨ Exception?[State](stmt(s))

Trying repeated skolemization, instantiation, and if-lifting,

This completes the proof of pm_q_prop_stmt_while_TCC1.

Q.E.D.

C.241.13 While_Rewrites.pm_q_prop_stmt_while

Terse proof for pm_q_prop_stmt_while.

pm_q_prop_stmt_while:

{1} ∀ (<: PRED[[Ord, Ord]], P, Q, R: [State → PRED[StmtResult[State]]],

b_ex: [State → ExprResult[State, bool]], body: [State → StmtResult[State]],

pm: Plain_Memory[State], s: State, stmt: [State → StmtResult[State]], variant: [State → [State → Ord]]):

let pm_q_prop_inv =

λ (s_1: State): λ (res: StmtResult[State]): pm_q_prop(pm)(catch_break(res)) in pm_q_prop(pm)(stmt(s)) ∧ R(state(stmt(s)))(stmt(s)) ∧ while_variant?(b_ex, body, <)(variant(state(stmt(s))), R(state(stmt(s)))) ∧ while_invariant?(b_ex, body)

(pm_q_prop_inv(state(stmt(s))), pm_q_prop_inv(state(stmt(s)))) ⊃ pm_q_prop(pm)((stmt ## while(b_ex, body)(P, Q, R, variant, <))(s))

Repeatedly Skolemizing and flattening, Installing automatic rewrites from: ## skip lift! Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Using lemma pm_q_prop_while, Applying eta axiom scheme to stmt!1(s!1), Repeatedly simplifying with BDDs, decision procedures, rewriting, and if-lifting, Expanding the definition of pm_q_prop, which is trivially true. This completes the proof of pm_q_prop_stmt_while. Q.E.D.