[Imprint][Data Privacy Statement][E-Mail]

View long theorem info. View the proof. Back to main index. View the specification. View theorem base summary, View theorem base listing, the used properties by spec, the dependency list, the symbol table,

Proof step 188 from proof prepost-write-once (previous step)

# apebs0 = # wlar, # apebs2 = # wlar0, q0.head = eq-entry(m4, lref), LEB_SIZE = (n1 + m0) + m1, vols0[v][m] = unmapped, wlar0[vtblpnum] = wl-entry(m5, free), apebs2[vtblpnum] = mkpeb(aehdr, empty, mkempbuf(LEB_SIZE), 0, false), apebs = apebs2, apebs1 = apebs[vtblpnum, apebs[vtblpnum].vidhdr:= avhdr], err = err0, vols = vols0, aehdr.valid?, vtblpnum < # apebs, m < # vols0[v], vtblpnum < # wlar0, bflipset-cons(bflipset, wlar), bflipset-cons(bflipset, wlar0), id(apebs2, apebs0, mapped-pebs(vols0)), is-aligned(m1, EB_PAGE_SIZE), is-aligned(m0, EB_PAGE_SIZE), ubi-io-inv(apebs0), ubi-io-inv(apebs2), ubi-io-inv(apebs[vtblpnum, apebs[vtblpnum].vidhdr:= avhdr]), unique-sqns(apebs0), unique-sqns(apebs2), valid-ebatbl(apebs0, wlar, vols0, vtblpnum2), valid-ebatbl(apebs2, wlar0, vols0, vtblpnum2), valid-eraseq(apebs0, q0), valid-eraseq(wlar, q0), valid-eraseq(q0), valid-eraseq(q1), valid-eraseq(wlar0, q1), valid-eraseq(apebs2, q1), valid-global-sqn(apebs0, sqnum), valid-global-sqn(apebs2, sqnum), valid-vtbl(apebs0, vols0, wlar, vtblpnum2), valid-vtbl(apebs2, vols0, wlar0, vtblpnum2), valid-wl(apebs0, wlar), valid-wl(apebs2, wlar0), v ∈ vols0, m1 ≤ LEB_SIZE, m1 + m2 ≤ # buf, m0 + m1 ≤ LEB_SIZE, q1.lebrefs ⊆ q0.lebrefs, ⌊err0⌋ ∨ err0 = ESUCCESS, apebs0 = apebs2 ∧ wlar = wlar0 ∧ q0 = q1 ∨ id○(apebs0, apebs2, vtblpnum) ∧ id○(wlar, wlar0, vtblpnum) ∧ q0 = eq-entry(vtblpnum, lref) ' + q1 ⊦ ⟪ubi_wl_put_peb#(none, vtblpnum; wlar0, q1)⟫ ( # apebs1 = # wlar0 ∧ unique-sqns(apebs1) ∧ valid-global-sqn(apebs1, sqnum + 1) ∧ valid-wl(apebs1, wlar0) ∧ valid-eraseq(q1) ∧ valid-eraseq(wlar0, q1) ∧ valid-eraseq(apebs1, q1) ∧ ¬ VTBL_VOLID ∈ vols ∧ bflipset-cons(bflipset, wlar0) ∧ valid-ebatbl(apebs1, wlar0, vols, vtblpnum2) ∧ valid-vtbl(apebs1, vols, wlar0, vtblpnum2) ∧ ubi-io-inv(apebs1) ∧ id(apebs1, apebs0, mapped-pebs(vols0)) ∧ q1.lebrefs ⊆ q0.lebrefs ++ (v × m) ∧ (m1 = 0 → q1.lebrefs ⊆ q0.lebrefs) ∧ (err = ESUCCESS ∨ ⌊err⌋ ) ∧ (err ≠ ESUCCESS → vols = vols0) ∧ ( err = ESUCCESS → (∃ n. vols = vols0[v, vols0[v][m, ⌜n⌝ ]] ∧ (m1 ≠ 0 → apebs1[n].fill = m0 + m1) ∧ (m1 = 0 → apebs1[n].fill = 0) ∧ apebs1[n].data = mkempbuf(m0) + subarray(buf, m2, m1) + mkempbuf(n1)))), err = ESUCCESS, vtblpnum2 = vtblpnum, avhdr.valid?, vtblpnum2 ∈ q1, VTBL_VOLID ∈ vols0, vtblpnum2 ∈ q0

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 189:
# apebs2 = # wlar0, # apebs0 = # wlar, q0.head = eq-entry(m4, lref), LEB_SIZE = (n1 + m0) + m1, apebs2[vtblpnum] = mkpeb(aehdr, empty, mkempbuf(LEB_SIZE), 0, false), wlar0[vtblpnum] = wl-entry(m5, free), vols0[v][m] = unmapped, vtblpnum2 ≠ vtblpnum, aehdr.valid?, m < # vols0[v], vtblpnum < # wlar0, bflipset-cons(bflipset, wlar0), bflipset-cons(bflipset, wlar), id(apebs2, apebs0, mapped-pebs(vols0)), is-aligned(m0, EB_PAGE_SIZE), is-aligned(m1, EB_PAGE_SIZE), ubi-io-inv(apebs2[vtblpnum, mkpeb(aehdr, avhdr, mkempbuf(LEB_SIZE), 0, false)]), ubi-io-inv(apebs2), ubi-io-inv(apebs0), unique-sqns(apebs2), unique-sqns(apebs0), valid-ebatbl(apebs2, wlar0, vols0, vtblpnum2), valid-ebatbl(apebs0, wlar, vols0, vtblpnum2), valid-eraseq(apebs2, q1), valid-eraseq(wlar0, q1), valid-eraseq(q1), valid-eraseq(q0), valid-eraseq(wlar, q0), valid-eraseq(apebs0, q0), valid-global-sqn(apebs2, sqnum), valid-global-sqn(apebs0, sqnum), valid-vtbl(apebs2, vols0, wlar0, vtblpnum2), valid-vtbl(apebs0, vols0, wlar, vtblpnum2), valid-wl(apebs2, wlar0), valid-wl(apebs0, wlar), v ∈ vols0, m0 + m1 ≤ LEB_SIZE, m1 + m2 ≤ # buf, m1 ≤ LEB_SIZE, q1.lebrefs ⊆ q0.lebrefs, ⌊err0⌋ , ¬ avhdr.valid?, ¬ vtblpnum2 ∈ q0, ¬ VTBL_VOLID ∈ vols0, ¬ vtblpnum2 ∈ q1, apebs0 = apebs2 ∧ wlar = wlar0 ∧ q0 = q1 ∨ id○(apebs0, apebs2, vtblpnum) ∧ id○(wlar, wlar0, vtblpnum) ∧ q0 = eq-entry(vtblpnum, lref) ' + q1 ⊦ ⟪ubi_wl_put_peb#(none, vtblpnum; wlar0, q1)⟫ ( # apebs2 = # wlar0 ∧ unique-sqns(apebs2[vtblpnum, apebs2[vtblpnum].vidhdr:= avhdr]) ∧ valid-global-sqn(apebs2[vtblpnum, apebs2[vtblpnum].vidhdr:= avhdr], sqnum + 1) ∧ valid-wl(apebs2[vtblpnum, apebs2[vtblpnum].vidhdr:= avhdr], wlar0) ∧ valid-eraseq(q1) ∧ valid-eraseq(wlar0, q1) ∧ valid-eraseq(apebs2[vtblpnum, apebs2[vtblpnum].vidhdr:= avhdr], q1) ∧ bflipset-cons(bflipset, wlar0) ∧ valid-ebatbl(apebs2[vtblpnum, apebs2[vtblpnum].vidhdr:= avhdr], wlar0, vols0, vtblpnum2) ∧ valid-vtbl(apebs2, vols0, wlar0, vtblpnum2) ∧ id(apebs2[vtblpnum, apebs2[vtblpnum].vidhdr:= avhdr], apebs0, mapped-pebs(vols0)) ∧ q1.lebrefs ⊆ q0.lebrefs ++ (v × m) ∧ (m1 = 0 → q1.lebrefs ⊆ q0.lebrefs))

Rule argument

Additional information

Used simplifier rules: lf-valid-wl-free-emptyvidhdr: n < # wlar, n < # apebs ⊦ wlar[n] = wl-entry(m, free) ∧ valid-wl(apebs, wlar) ∧ ubi-io-inv(apebs) → apebs[n].vidhdr = empty ∧ apebs[n].echdr.valid? ∧ apebs[n].fill = 0;% ⊦ mkpeb(aehdr, avhdr, buf, m, boolvar).echdr = aehdr; (s)% ⊦ mkpeb(aehdr, avhdr, buf, m, boolvar).fill = m; (s)% ⊦ mkpeb(aehdr, avhdr, buf, m, boolvar).vidhdr = avhdr; (s)%⊦ mkpeb(aehdr, avhdr, buf, m, boolvar).vidhdr:= avhdr0 = mkpeb(aehdr, avhdr0, buf, m, boolvar); (s)%lf-01: ⊦ m < n ∧ n = n0 → m < n0; (forward) from specification nat-basic%⊦ m ≠ n0 → ( valid-vtbl(apebs[m, apeb], vols, wlar, n0) ↔ valid-vtbl(apebs, vols, wlar, n0)); (s)% ⊦ # apebs[n, apeb] = # apebs; (s)% ⊦ ⌊err⌋ → err ≠ ESUCCESS; (s)