| # buf1 = PEB_SIZE, 2 * EB_PAGE_SIZE + m2 = (avhdr = empty ⊃ EB_PAGE_SIZE;m2 + 2 * EB_PAGE_SIZE), n4 + m2 = LEB_SIZE, LEB_SIZE = (n2 + n3) + m1, PEB_SIZE = n4 + 2 * EB_PAGE_SIZE + m2, apebs[m3] = mkpeb(aehdr, avhdr, subarray(buf1, 2 * EB_PAGE_SIZE, LEB_SIZE), m2, false), pebs[m3] = mkpeb(buf1, 2 * EB_PAGE_SIZE + m2, false), avhdr.valid?, aehdr.valid?, n3 < n, m3 < # apebs, m3 < # pebs, n1 < n2, abs(pebs, apebs), abs-echdr(subarray(buf1, 0, EB_PAGE_SIZE), aehdr), abs-vidhdr(subarray(buf1, EB_PAGE_SIZE, EB_PAGE_SIZE), avhdr), is-aligned(m1, EB_PAGE_SIZE), is-aligned(n, EB_PAGE_SIZE), is-aligned(n3, EB_PAGE_SIZE), is-aligned(m2, EB_PAGE_SIZE), ubi-io-inv(apebs), n3 + m1 ≤ LEB_SIZE, m1 + n3 ≤ LEB_SIZE, m1 ≤ LEB_SIZE, m2 ≤ LEB_SIZE, m1 + n ≤ LEB_SIZE, n0 + n ≤ # buf, (m1 + 2 * EB_PAGE_SIZE) + n3 ≤ PEB_SIZE, m2 ≤ m1, n0 + n3 ≤ # buf, 2 * EB_PAGE_SIZE + m2 ≤ PEB_SIZE, ⌊err1⌋ , m1 + n3 + n1 - m2 < n4 → buf1[(2 * EB_PAGE_SIZE + m2) + (m1 + n3 + n1 - m2)] = empty ⊦ buf1[2 * EB_PAGE_SIZE + (m1 + n3) + n1] = empty, aehdr = empty, n3 = 0 |
# buf1 = PEB_SIZE, n4 + m2 = LEB_SIZE, 2 * EB_PAGE_SIZE + m2 = (avhdr = empty ⊃ EB_PAGE_SIZE;m2 + 2 * EB_PAGE_SIZE), LEB_SIZE = (n2 + n3) + m1, PEB_SIZE = n4 + 2 * EB_PAGE_SIZE + m2, pebs[m3] = mkpeb(buf1, 2 * EB_PAGE_SIZE + m2, false), apebs[m3] = mkpeb(aehdr, avhdr, subarray(buf1, 2 * EB_PAGE_SIZE, LEB_SIZE), m2, false), aehdr.valid?, avhdr.valid?, n1 < n2, m3 < # pebs, m3 < # apebs, n3 < n, abs(pebs, apebs), abs-echdr(subarray(buf1, 0, EB_PAGE_SIZE), aehdr), abs-vidhdr(subarray(buf1, EB_PAGE_SIZE, EB_PAGE_SIZE), avhdr), is-aligned(m2, EB_PAGE_SIZE), is-aligned(n3, EB_PAGE_SIZE), is-aligned(n, EB_PAGE_SIZE), is-aligned(m1, EB_PAGE_SIZE), ubi-io-inv(apebs), 2 * EB_PAGE_SIZE + m2 ≤ PEB_SIZE, n0 + n3 ≤ # buf, m2 ≤ m1, (m1 + 2 * EB_PAGE_SIZE) + n3 ≤ PEB_SIZE, n0 + n ≤ # buf, m1 + n ≤ LEB_SIZE, m2 ≤ LEB_SIZE, m1 ≤ LEB_SIZE, m1 + n3 ≤ LEB_SIZE, n3 + m1 ≤ LEB_SIZE, n4 ≤ (m1 - m2) + n3 + n1, ⌊err1⌋ ⊦ buf1[2 * EB_PAGE_SIZE + (m1 + n3) + n1] = empty, aehdr = empty, n3 = 0
Used simplifier rules: ⊦ m < n ↔ ¬ n ≤ m; (ss)% ⊦ n ≤ n0 → (m + (n0 - n)) + n = m + n0; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ n ≤ m → m + n0 - n = (m - n) + n0; (s)