This is a listing of all goals defined over the current specification. Axioms are marked yellow, proved theorems green and unproved theorems blue. Click on individual names to get more information on the proof.
| Name: | Sequent: | Type: |
|---|---|---|
| format | ebm_format#(; ; AVOLS, ERR){fail_or_success#(; ; ERR); if ERR = ESUCCESS then AVOLS := ∅ else AVOLS := ?} | An Axiom |
| change | ebm_change#(VOLID, LNUM, N, BUF; AVOLS; ERR) {if VOLID ∈ AVOLS ∧ LNUM < # AVOLS[VOLID] ∧ N ≤ LEB_SIZE ∧ N ≤ # BUF ∧ is-aligned(N, EB_PAGE_SIZE) then {fail_or_success#(; ; ERR); if ERR = ESUCCESS then AVOLS[VOLID][LNUM] := mapped(subarray(BUF, 0, N) + mkempbuf(LEB_SIZE - N), N)} else abort } | An Axiom |
| map | ebm_map#(VOLID, LNUM; AVOLS; ERR) {if VOLID ∈ AVOLS ∧ LNUM < # AVOLS[VOLID] ∧ ¬ AVOLS[VOLID][LNUM].mapped? then {fail_or_success#(; ; ERR); if ERR = ESUCCESS then AVOLS[VOLID][LNUM] := mapped(emptyleb, 0)} else abort } | An Axiom |
| unmap | ebm_unmap#(VOLID, LNUM; AVOLS){if VOLID ∈ AVOLS ∧ LNUM < # AVOLS[VOLID] then AVOLS[VOLID][LNUM] := unmapped else abort} | An Axiom |
| erase | ebm_erase#(VOLID, LNUM; AVOLS; ERR) {if VOLID ∈ AVOLS ∧ LNUM < # AVOLS[VOLID] then {fail_or_success#(; ; ERR); if ERR = ESUCCESS then AVOLS[VOLID][LNUM] := erased else {skip or AVOLS[VOLID][LNUM] := unmapped}} else abort } | An Axiom |
| write | ebm_write#(VOLID, LNUM, OFFSET, N0, N, BUF; AVOLS; ERR) {if VOLID ∈ AVOLS ∧ LNUM < # AVOLS[VOLID] ∧ OFFSET + N ≤ LEB_SIZE ∧ is-aligned(OFFSET, EB_PAGE_SIZE) ∧ is-aligned(N, EB_PAGE_SIZE) ∧ N + N0 ≤ # BUF ∧ (AVOLS[VOLID][LNUM].mapped? → OFFSET ≥ AVOLS[VOLID][LNUM].fill) then {fail_or_success#(; ; ERR); if ERR = ESUCCESS then if AVOLS[VOLID][LNUM].mapped? then if N ≠ 0 then AVOLS[VOLID][LNUM] := mapped(subarray(AVOLS[VOLID][LNUM].data, 0, OFFSET) + subarray(BUF, N0, N) + mkempbuf(LEB_SIZE - OFFSET - N), OFFSET + N) else AVOLS[VOLID][LNUM] := mapped(mkempbuf(OFFSET) + subarray(BUF, N0, N) + mkempbuf(LEB_SIZE - OFFSET - N), OFFSET + N) else if AVOLS[VOLID][LNUM].mapped? then choose N1 with N1 < N ∧ is-aligned(N1, EB_PAGE_SIZE) in if N1 ≠ 0 then AVOLS[VOLID][LNUM] := mapped (subarray(AVOLS[VOLID][LNUM].data, 0, OFFSET) + subarray(BUF, N0, N1) + mkempbuf(LEB_SIZE - OFFSET - N1), OFFSET + N1) ifnone skip else if N ≠ 0 then AVOLS[VOLID][LNUM] := unmapped} else abort } | An Axiom |
| read | ebm_read#(VOLID, LNUM, OFFSET, N0, N, AVOLS; BUF; ERR) {if VOLID ∈ AVOLS ∧ LNUM < # AVOLS[VOLID] ∧ OFFSET + N ≤ LEB_SIZE ∧ N0 + N ≤ # BUF then {fail_or_success#(; ; ERR); if ERR = ESUCCESS then if ¬ AVOLS[VOLID][LNUM].mapped? then BUF := fill(BUF, empty, N0, N) else BUF := copy(AVOLS[VOLID][LNUM].data, OFFSET, BUF, N0, N) else choose BUF0 with # BUF0 = # BUF ∧ range=(BUF0, 0, BUF, 0, N0) ∧ range=(BUF0, N0 + N, BUF, N0 + N, # BUF - N0 + N) in BUF := BUF0} else abort } | An Axiom |
| create-volume | ebm_create_volume#(VOLID, N; AVOLS; ERR) {if ¬ VOLID ∈ AVOLS then {fail_or_success#(; ; ERR); if ERR = ESUCCESS then AVOLS[VOLID] := fill(mkabstractvolume(N), erased)} else abort} | An Axiom |
| get-volume-size | ebm_get_volume_size#(VOLID, AVOLS; ; N){if VOLID ∈ AVOLS then N := # AVOLS[VOLID] else abort} | An Axiom |
| recover | ebm_recover#(; AVOLS; ERR){fail_or_success#(; ; ERR); if ERR ≠ ESUCCESS then AVOLS := ?} | An Axiom |
| sync-device | ebm_sync_device#(AVOLS; ; ERR){fail_or_success#(; ; ERR)} | An Axiom |
| get-leb-size | ebm_get_leb_size#(AVOLS; ; N){N := LEB_SIZE} | An Axiom |
| get-page-size | ebm_get_page_size#(AVOLS; ; N){N := EB_PAGE_SIZE} | An Axiom |
| inv-format | ⊦ ⟪ebm_format#(; ; avols, err)⟫ (err = ESUCCESS → ebm-cons(avols)) | A Proof Obligation |
| inv-change | ebm-cons(avols), v ∈ avols, m < # avols[v], n ≤ LEB_SIZE, n ≤ # buf, is-aligned(n, EB_PAGE_SIZE) ⊦ ⟪ebm_change#(v, m, n, buf; avols; err)⟫ ebm-cons(avols) | A Proof Obligation |
| inv-map | ebm-cons(avols), v ∈ avols, m < # avols[v], ¬ avols[v][m].mapped? ⊦ ⟪ebm_map#(v, m; avols; err)⟫ ebm-cons(avols) | A Proof Obligation |
| inv-unmap | ebm-cons(avols), v ∈ avols, m < # avols[v] ⊦ ⟪ebm_unmap#(v, m; avols)⟫ ebm-cons(avols) | A Proof Obligation |
| inv-erase | ebm-cons(avols), v ∈ avols, m < # avols[v] ⊦ ⟪ebm_erase#(v, m; avols; err)⟫ ebm-cons(avols) | A Proof Obligation |
| inv-write | ebm-cons(avols), v ∈ avols, m < # avols[v], m0 + n ≤ LEB_SIZE, is-aligned(m0, EB_PAGE_SIZE), is-aligned(n, EB_PAGE_SIZE), n + n0 ≤ # buf, avols[v][m].mapped? → m0 ≥ avols[v][m].fill ⊦ ⟪ebm_write#(v, m, m0, n0, n, buf; avols; err)⟫ ebm-cons(avols) | A Proof Obligation |
| inv-read | ebm-cons(avols), v ∈ avols, m < # avols[v], m0 + n ≤ LEB_SIZE, n0 + n ≤ # buf ⊦ ⟪ebm_read#(v, m, m0, n0, n, avols; buf; err)⟫ true | A Proof Obligation |
| inv-create-volume | ebm-cons(avols), ¬ v ∈ avols ⊦ ⟪ebm_create_volume#(v, n; avols; err)⟫ ebm-cons(avols) | A Proof Obligation |
| inv-get-volume-size | ebm-cons(avols), v ∈ avols ⊦ ⟪ebm_get_volume_size#(v, avols; ; n)⟫ true | A Proof Obligation |
| inv-recover | avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0), ebm-cons(avols) ⊦ ⟪ebm_recover#(; avols0; err)⟫ (err = ESUCCESS → ebm-cons(avols0)) | A Proof Obligation |
| crash-neutral-change | v ∈ avols, m < # avols[v], n ≤ LEB_SIZE, n ≤ # buf, is-aligned(n, EB_PAGE_SIZE), ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_change#(v, m, n, buf; avols; err)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-map | v ∈ avols, m < # avols[v], ¬ avols[v][m].mapped?, ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_map#(v, m; avols; err)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-unmap | v ∈ avols, m < # avols[v], ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_unmap#(v, m; avols)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-erase | v ∈ avols, m < # avols[v], ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_erase#(v, m; avols; err)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-write | v ∈ avols, m < # avols[v], m0 + n ≤ LEB_SIZE, is-aligned(m0, EB_PAGE_SIZE), is-aligned(n, EB_PAGE_SIZE), n + n0 ≤ # buf, avols[v][m].mapped? → m0 ≥ avols[v][m].fill, ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_write#(v, m, m0, n0, n, buf; avols; err)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-read | v ∈ avols, m < # avols[v], m0 + n ≤ LEB_SIZE, n0 + n ≤ # buf, ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_read#(v, m, m0, n0, n, avols; buf; err)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-create-volume | ¬ v ∈ avols, ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_create_volume#(v, n; avols; err)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-get-volume-size | v ∈ avols, ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_get_volume_size#(v, avols; ; n)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-sync-device | ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_sync_device#(avols; ; err)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| inv-sync-device | ebm-cons(avols) ⊦ ⟪ebm_sync_device#(avols; ; err)⟫ true | A Proof Obligation |
| crash-neutral-get-leb-size | ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_get_leb_size#(avols; ; n)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| crash-neutral-get-page-size | ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_get_page_size#(avols; ; n)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |
| inv-get-leb-size | ebm-cons(avols) ⊦ ⟪ebm_get_leb_size#(avols; ; n)⟫ true | A Proof Obligation |
| inv-get-page-size | ebm-cons(avols) ⊦ ⟪ebm_get_page_size#(avols; ; n)⟫ true | A Proof Obligation |
| crash-neutral-recover | ebm-cons(avols), avols ⊆ avols0, ebm-cons(avols) → ebm-cons(avols0) ⊦ ⟨ebm_recover#(; avols; err)⟩ (avols ⊆ avols0 ∧ (ebm-cons(avols) → ebm-cons(avols0))) | A Proof Obligation |