Package h: Memory safety for the H interface

Information

nameh
version1.124
descriptionMemory safety for the H interface
authorJoe Leslie-Hurd <joe@gilith.com>
licenseMIT
hol-light-int-filehol-light.int
hol-light-thm-filehol-light.art
checksumefd44a900842ec6cd0077372cb002dd1d91de9a3
requiresbase
byte
natural-bits
word10
word12
showData.Bool
Data.Byte
Data.List
Data.Option
Data.Pair
Data.Word10
Data.Word12
Function
Number.Natural
Set
System.H

Files

Defined Type Operators

Defined Constants

Theorems

⊦ View.mkCurrentPageDirectoryH = State.cr3

⊦ View.mkReferencePageDirectoryH = State.reference

⊦ View.mkRegionHandlesH = State.regions

⊦ View.mkRegionHandlesKernel = State.regions

⊦ Page.Data.zero = Page.Data.mk (λi. 0)

⊦ ∀f. View.observablePagesEnvironment (View.Environment f) = f

⊦ ∀f. View.observablePagesUser (View.User f) = f

⊦ ∀d s. View.equivalent d s s

⊦ ∀pdd. ∃f. pdd = Page.Directory.Data.mk f

⊦ ∀n.
    Physical.Superpage.fromNatural n =
    Physical.Superpage.mk (fromNatural n)

⊦ ∀n. Superpage.Offset.fromNatural n = Superpage.Offset.mk (fromNatural n)

⊦ ∀n.
    Virtual.Superpage.fromNatural n = Virtual.Superpage.mk (fromNatural n)

⊦ ∀p. Page.isDirectory p ⇔ isSome (Page.destDirectory p)

⊦ ∀p. Page.isEnvironment p ⇔ isSome (Page.destEnvironment p)

⊦ ∀p. Page.isInstalled p ⇔ ¬Page.isNotInstalled p

⊦ ∀p. Page.isNormal p ⇔ isSome (Page.destNormal p)

⊦ ∀p. Page.isTable p ⇔ isSome (Page.destTable p)

⊦ ∀va. Virtual.Address.isUser va ⇔ ¬Virtual.Address.isKernel va

⊦ ∀vpa. Virtual.Page.isKernel vpa ⇔ ¬Virtual.Page.isUser vpa

⊦ ∀vpa. Virtual.Page.isUser vpa ⇔ ¬Virtual.Page.isKernel vpa

⊦ ∀vr.
    Virtual.Region.isKernel vr ⇔
    Virtual.Region.forall Virtual.Page.isKernel vr

⊦ ∀vr.
    Virtual.Region.isUser vr ⇔ Virtual.Region.forall Virtual.Page.isUser vr

⊦ ∀vsa. Virtual.Superpage.isUser vsa ⇔ ¬Virtual.Superpage.isKernel vsa

⊦ ∀pr.
    length (Physical.Region.pageList pr) =
    RegionLength.toNatural (Physical.Region.length pr)

⊦ ∀vr.
    length (Virtual.Region.pageList vr) =
    RegionLength.toNatural (Virtual.Region.length vr)

⊦ ∀s l. Physical.Region.length (Physical.Region.mk s l) = l

⊦ ∀s l. Physical.Region.start (Physical.Region.mk s l) = s

⊦ ∀f g. View.regionHandlesKernel (View.Kernel f g) = g

⊦ ∀f g. View.observablePagesKernel (View.Kernel f g) = f

⊦ ∀s l. Virtual.Region.length (Virtual.Region.mk s l) = l

⊦ ∀s l. Virtual.Region.start (Virtual.Region.mk s l) = s

⊦ ∀i a. State.Regions.all (State.Regions i a) = a

⊦ ∀i a. State.Regions.initial (State.Regions i a) = i

⊦ View.mkObservablePagesKernel =
  View.ObservablePages.fromTranslate
    (λs vpa. State.translatePage s (State.cr3 s) vpa)

⊦ ∀p. Page.isDirectoryOrTable p ⇔ Page.isDirectory p ∨ Page.isTable p

⊦ ∀p.
    Page.isEnvironment p ⇒
    Page.destEnvironmentOrNormal p = Page.destEnvironment p

⊦ ∀s.
    State.cr3IsPageDirectory s ⇔
    Page.isDirectory (State.page s (State.cr3 s))

⊦ ∀s.
    State.referenceIsPageDirectory s ⇔
    Page.isDirectory (State.page s (State.reference s))

⊦ ∀s. State.wellformed s ⇒ Page.isDirectory (State.page s (State.cr3 s))

⊦ ∀s.
    State.wellformed s ⇒
    Page.isDirectory (State.page s (State.reference s))

⊦ ∀pr. ∃s l. pr = Physical.Region.mk s l

⊦ ∀x. ∃a0 a1. x = State.Regions a0 a1

⊦ ∀pr. ∃s l. pr = Virtual.Region.mk s l

⊦ ∀s ppa. State.unmappedNormalPage s ppa ⇒ State.isNormalPage s ppa

⊦ ∀s ppa. State.unmappedNormalPage s ppa ⇒ State.unmappedPage s ppa

⊦ ∀s ppa.
    State.isEnvironmentPage s ppa ⇔ Page.isEnvironment (State.page s ppa)

⊦ ∀s ppa. State.isNormalPage s ppa ⇔ Page.isNormal (State.page s ppa)

⊦ ∀ppa pr.
    Physical.Region.member ppa pr ⇔
    member ppa (Physical.Region.pageList pr)

⊦ ∀ppa vr.
    Virtual.Region.member ppa vr ⇔ member ppa (Virtual.Region.pageList vr)

⊦ ∀p pr. Physical.Region.exists p pr ⇔ any p (Physical.Region.pageList pr)

⊦ ∀p pr. Physical.Region.forall p pr ⇔ all p (Physical.Region.pageList pr)

⊦ ∀p vr. Virtual.Region.exists p vr ⇔ any p (Virtual.Region.pageList vr)

⊦ ∀p vr. Virtual.Region.forall p vr ⇔ all p (Virtual.Region.pageList vr)

⊦ ∀s.
    State.initialRegionsAreRegions s ⇔
    State.Regions.initial (State.regions s) ⊆
    State.Regions.all (State.regions s)

⊦ ∀a s. output a s = Output.mk (view (domain a) s)

⊦ ∀vr vpa.
    Virtual.Region.isKernel vr ∧ Virtual.Region.member vpa vr ⇒
    Virtual.Page.isKernel vpa

⊦ ∀vr vpa.
    Virtual.Region.isUser vr ∧ Virtual.Region.member vpa vr ⇒
    Virtual.Page.isUser vpa

⊦ ∀pr1 pr2.
    Physical.Region.isSubregion pr1 pr2 ⇔
    Physical.Region.forall (λppa. Physical.Region.member ppa pr2) pr1

⊦ ∀vr1 vr2.
    Virtual.Region.isSubregion vr1 vr2 ⇔
    Virtual.Region.forall (λppa. Virtual.Region.member ppa vr2) vr1

⊦ ∀psa n.
    Physical.Superpage.add psa n =
    Physical.Superpage.mk (Physical.Superpage.dest psa + fromNatural n)

⊦ ∀si n.
    Superpage.Offset.add si n =
    Superpage.Offset.mk (Superpage.Offset.dest si + fromNatural n)

⊦ ∀vsa n.
    Virtual.Superpage.add vsa n =
    Virtual.Superpage.mk (Virtual.Superpage.dest vsa + fromNatural n)

⊦ ∀p. (∀s l. p (Physical.Region.mk s l)) ⇒ ∀pr. p pr

⊦ ∀P. (∀a0 a1. P (State.Regions a0 a1)) ⇒ ∀x. P x

⊦ ∀p. (∀s l. p (Virtual.Region.mk s l)) ⇒ ∀pr. p pr

⊦ View.mkObservablePagesUser =
  View.ObservablePages.fromTranslate
    (λs vpa.
       if Virtual.Page.isUser vpa then
         State.translatePage s (State.cr3 s) vpa
       else none)

⊦ ∀d s t. View.equivalent d s t ⇒ View.equivalent d t s

⊦ ∀pde.
    (∃psa. pde = Page.Directory.Entry.Superpage psa) ∨
    ∃pt. pde = Page.Directory.Entry.Table pt

⊦ ∀s s' pr vr.
    Action.specificationAddKernelMappingH pr vr s s' ⇒
    Virtual.Region.isKernel vr

⊦ ∀s s'.
    State.page s = State.page s' ⇒
    State.translatePage s = State.translatePage s'

⊦ ∀s ppa.
    State.unmappedNormalPage s ppa ⇔
    State.unmappedPage s ppa ∧ State.isNormalPage s ppa

⊦ ∀s vpa.
    State.wellformed s ∧ State.mappedPage s (State.reference s) vpa ⇒
    Virtual.Page.isKernel vpa

⊦ ∀s.
    State.referenceMapsKernelAddresses s ⇔
    ∀vpa.
      State.mappedPage s (State.reference s) vpa ⇒
      Virtual.Page.isKernel vpa

⊦ ∀c r s g. State.cr3 (State c r s g) = c

⊦ ∀c r s g. State.reference (State c r s g) = r

⊦ ∀c r s g. State.regions (State c r s g) = g

⊦ ∀c r s g. State.page (State c r s g) = s

⊦ ∀c p g r. View.currentPageDirectoryH (View.H c p g r) = c

⊦ ∀c p g r. View.referencePageDirectoryH (View.H c p g r) = r

⊦ ∀c p g r. View.regionHandlesH (View.H c p g r) = g

⊦ ∀c p g r. View.pagesH (View.H c p g r) = p

⊦ ∀f. ∃fn. ∀s l. fn (Physical.Region.mk s l) = f s l

⊦ ∀f. ∃fn. ∀s l. fn (Virtual.Region.mk s l) = f s l

⊦ ∀f. ∃fn. ∀a0 a1. fn (State.Regions a0 a1) = f a0 a1

⊦ (∀x. Output.mk (Output.dest x) = x) ∧ ∀v. Output.dest (Output.mk v) = v

⊦ (∀l. RegionLength.fromNatural (RegionLength.toNatural l) = l) ∧
  ∀n. RegionLength.toNatural (RegionLength.fromNatural n) = n

⊦ (∀d. Page.Data.mk (Page.Data.dest d) = d) ∧
  ∀f. Page.Data.dest (Page.Data.mk f) = f

⊦ (∀i. Page.Offset.mk (Page.Offset.dest i) = i) ∧
  ∀w. Page.Offset.dest (Page.Offset.mk w) = w

⊦ (∀d. Page.Directory.Data.mk (Page.Directory.Data.dest d) = d) ∧
  ∀f. Page.Directory.Data.dest (Page.Directory.Data.mk f) = f

⊦ (∀t. Page.Table.Data.mk (Page.Table.Data.dest t) = t) ∧
  ∀f. Page.Table.Data.dest (Page.Table.Data.mk f) = f

⊦ (∀pa. Physical.Address.mk (Physical.Address.dest pa) = pa) ∧
  ∀r. Physical.Address.dest (Physical.Address.mk r) = r

⊦ (∀ppa. Physical.Page.mk (Physical.Page.dest ppa) = ppa) ∧
  ∀r. Physical.Page.dest (Physical.Page.mk r) = r

⊦ (∀psa. Physical.Superpage.mk (Physical.Superpage.dest psa) = psa) ∧
  ∀w. Physical.Superpage.dest (Physical.Superpage.mk w) = w

⊦ (∀si. Superpage.Offset.mk (Superpage.Offset.dest si) = si) ∧
  ∀w. Superpage.Offset.dest (Superpage.Offset.mk w) = w

⊦ (∀v. View.ObservablePages.mk (View.ObservablePages.dest v) = v) ∧
  ∀f. View.ObservablePages.dest (View.ObservablePages.mk f) = f

⊦ (∀va. Virtual.Address.mk (Virtual.Address.dest va) = va) ∧
  ∀r. Virtual.Address.dest (Virtual.Address.mk r) = r

⊦ (∀vpa. Virtual.Page.mk (Virtual.Page.dest vpa) = vpa) ∧
  ∀r. Virtual.Page.dest (Virtual.Page.mk r) = r

⊦ (∀vsa. Virtual.Superpage.mk (Virtual.Superpage.dest vsa) = vsa) ∧
  ∀w. Virtual.Superpage.dest (Virtual.Superpage.mk w) = w

⊦ ∀s s' ppa.
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    State.cr3 s = State.cr3 s'

⊦ ∀s s' ppa.
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    State.reference s = State.reference s'

⊦ ∀s s' ppa.
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    State.regions s = State.regions s'

⊦ ∀s s' pd.
    Action.specificationExecuteH pd s s' ⇒
    State.reference s = State.reference s'

⊦ ∀s s' pd.
    Action.specificationExecuteH pd s s' ⇒
    State.regions s = State.regions s'

⊦ ∀s s' pd.
    Action.specificationExecuteH pd s s' ⇒ State.page s = State.page s'

⊦ ∀s s' pd.
    Action.specificationExecuteH pd s s' ⇒
    State.translatePage s = State.translatePage s'

⊦ ∀s s' pd.
    Action.specificationFreePageDirectoryH pd s s' ⇒
    State.cr3 s = State.cr3 s'

⊦ ∀s s' pd.
    Action.specificationFreePageDirectoryH pd s s' ⇒
    State.reference s = State.reference s'

⊦ ∀s s' pd.
    Action.specificationFreePageDirectoryH pd s s' ⇒
    State.regions s = State.regions s'

⊦ ∀s pd vpa.
    State.mappedPage s pd vpa ⇔ isSome (State.translatePage s pd vpa)

⊦ ∀s pd vpa.
    isSome (State.translatePage s pd vpa) ⇒
    Page.isDirectory (State.page s pd)

⊦ ∀x. ∃a0 a1 a2 a3. x = State a0 a1 a2 a3

⊦ ∀s l.
    Physical.Region.pageList (Physical.Region.mk s l) =
    map (Physical.Page.add s) (interval 0 (RegionLength.toNatural l))

⊦ ∀s l.
    Virtual.Region.pageList (Virtual.Region.mk s l) =
    map (Virtual.Page.add s) (interval 0 (RegionLength.toNatural l))

⊦ ∀f1 f2.
    View.ObservablePages.mk f1 = View.ObservablePages.mk f2 ⇔
    ∀vpa. f1 vpa = f2 vpa

⊦ ∀P.
    (∀a. P (Page.Directory.Entry.Superpage a)) ∧
    (∀a. P (Page.Directory.Entry.Table a)) ⇒ ∀x. P x

⊦ ∀d s t. View.equivalent d s t ⇔ view d s = view d t

⊦ ∀d.
    d = Domain.Environment ∨ d = Domain.H ∨ d = Domain.Kernel ∨
    d = Domain.User

⊦ ∀s pd pt.
    State.wellformed s ∧ State.tableMappedInDirectory s pd pt ⇒
    Page.isDirectory (State.page s pd)

⊦ ∀s pd pt.
    State.wellformed s ∧ State.tableMappedInDirectory s pd pt ⇒
    Page.isTable (State.page s pt)

⊦ ∀s pd vpa.
    ¬Page.isDirectory (State.page s pd) ⇒
    State.translatePage s pd vpa = none

⊦ ∀s ppa.
    View.mkPagesH s ppa =
    let page ← State.page s ppa in
    if Page.isNormal page then none else some page

⊦ ∀s s' pd vr.
    Action.specificationRemoveMappingH pd vr s s' ⇒
    State.cr3 s = State.cr3 s'

⊦ ∀s s' pr vr.
    Action.specificationAddKernelMappingH pr vr s s' ⇒
    State.cr3 s = State.cr3 s'

⊦ ∀s s' pr vr.
    Action.specificationAddKernelMappingH pr vr s s' ⇒
    State.reference s = State.reference s'

⊦ ∀s s' va b.
    Action.specificationWriteEnvironment va b s s' ⇒
    State.cr3 s = State.cr3 s'

⊦ ∀s s' va b.
    Action.specificationWriteEnvironment va b s s' ⇒
    State.reference s = State.reference s'

⊦ ∀s s' va b.
    Action.specificationWriteEnvironment va b s s' ⇒
    State.regions s = State.regions s'

⊦ ∀s s' va b.
    Action.specificationWriteEnvironment va b s s' ⇒
    State.translatePage s = State.translatePage s'

⊦ ∀s s' va b.
    Action.specificationWriteKernel va b s s' ⇒ State.cr3 s = State.cr3 s'

⊦ ∀s s' va b.
    Action.specificationWriteKernel va b s s' ⇒
    State.reference s = State.reference s'

⊦ ∀s s' va b.
    Action.specificationWriteKernel va b s s' ⇒
    State.regions s = State.regions s'

⊦ ∀s s' va b.
    Action.specificationWriteKernel va b s s' ⇒
    State.translatePage s = State.translatePage s'

⊦ ∀s s' va b.
    Action.specificationWriteUser va b s s' ⇒ State.cr3 s = State.cr3 s'

⊦ ∀s s' va b.
    Action.specificationWriteUser va b s s' ⇒
    State.reference s = State.reference s'

⊦ ∀s s' va b.
    Action.specificationWriteUser va b s s' ⇒
    State.regions s = State.regions s'

⊦ ∀s s' va b.
    Action.specificationWriteUser va b s s' ⇒
    State.translatePage s = State.translatePage s'

⊦ ∀p.
    p Domain.Environment ∧ p Domain.H ∧ p Domain.Kernel ∧ p Domain.User ⇒
    ∀d. p d

⊦ ∀s s' ppa.
    State.wellformed s ∧
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    ¬(State.cr3 s = ppa)

⊦ ∀s s' ppa.
    State.wellformed s ∧
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    ¬(State.cr3 s' = ppa)

⊦ ∀s s' pd.
    State.wellformed s' ∧ Action.specificationFreePageDirectoryH pd s s' ⇒
    ¬(State.cr3 s = pd)

⊦ ∀s s' pd.
    State.wellformed s' ∧ Action.specificationFreePageDirectoryH pd s s' ⇒
    ¬(State.cr3 s' = pd)

⊦ ∀s.
    State.mappedPagesAreAvailable s ⇔
    ∀pd vpa.
      case State.translatePage s pd vpa of
        none → ⊤
      | some ppa → Page.isInstalled (State.page s ppa)

⊦ ∀va.
    Virtual.Address.isKernel va ⇔
    let (vpa, i) ← Virtual.Address.dest va in Virtual.Page.isKernel vpa

⊦ ∀vpa.
    Virtual.Page.isKernel vpa ⇔
    let (vsa, si) ← Virtual.Page.dest vpa in Virtual.Superpage.isKernel vsa

⊦ ∀P. (∀a0 a1 a2 a3. P (State a0 a1 a2 a3)) ⇒ ∀x. P x

⊦ ∀n. n < 768 ⇒ Virtual.Superpage.isUser (Virtual.Superpage.fromNatural n)

⊦ ∀s s' pd pts pr vr.
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    Virtual.Region.isUser vr

⊦ ∀k v d.
    Page.Data.update k v d =
    Page.Data.mk (λi. if i = k then v else Page.Data.dest d i)

⊦ ∀a s s'.
    action a s s' ⇔
    State.wellformed s ∧ State.wellformed s' ∧ Action.specification a s s'

⊦ ∀s s' pr ppa l.
    Action.specificationDeriveRegionH pr ppa l s s' ⇒
    State.cr3 s = State.cr3 s'

⊦ ∀s s' pr ppa l.
    Action.specificationDeriveRegionH pr ppa l s s' ⇒
    State.reference s = State.reference s'

⊦ ∀s s' pr ppa l.
    Action.specificationDeriveRegionH pr ppa l s s' ⇒
    State.page s = State.page s'

⊦ ∀s s' pr ppa l.
    Action.specificationDeriveRegionH pr ppa l s s' ⇒
    State.translatePage s = State.translatePage s'

⊦ View.mkObservablePagesEnvironment =
  View.ObservablePages.fromTranslate
    (λs vpa.
       case State.translatePage s (State.cr3 s) vpa of
         none → none
       | some ppa →
           if Page.isEnvironment (State.page s ppa) then some ppa
           else none)

⊦ (∀ppa. Physical.Page.add ppa 0 = ppa) ∧
  ∀ppa n.
    Physical.Page.add ppa (suc n) =
    Physical.Page.add (Physical.Page.suc ppa) n

⊦ (∀vpa. Virtual.Page.add vpa 0 = vpa) ∧
  ∀vpa n.
    Virtual.Page.add vpa (suc n) =
    Virtual.Page.add (Virtual.Page.suc vpa) n

⊦ ∀d s1 s2 s3.
    View.equivalent d s1 s2 ∧ View.equivalent d s2 s3 ⇒
    View.equivalent d s1 s3

⊦ ∀s vpa.
    State.wellformed s ∧ Virtual.Page.isKernel vpa ⇒
    State.translatePage s (State.cr3 s) vpa =
    State.translatePage s (State.reference s) vpa

⊦ ∀s s' pr vr ppa.
    Action.specificationAddKernelMappingH pr vr s s' ∧
    Physical.Region.member ppa pr ⇒ State.isNormalPage s ppa

⊦ ∀s.
    State.referenceContainsEnvironment s ⇔
    ∀ppa.
      Page.isEnvironment (State.page s ppa) ⇒
      ∃vpa. State.translatePage s (State.reference s) vpa = some ppa

⊦ ∀pd s s'.
    Action.specificationFreePageDirectoryH pd s s' ⇔
    Action.specificationAllocatePageDirectoryH pd s' s ∧
    State.page s' pd = Page.Normal Page.Data.zero

⊦ ∀f0 f1.
    ∃fn.
      (∀a. fn (Page.Directory.Entry.Superpage a) = f0 a) ∧
      ∀a. fn (Page.Directory.Entry.Table a) = f1 a

⊦ ∀s s' a u.
    ¬interferes (domain a) u ∧ action a s s' ⇒ View.equivalent u s s'

⊦ ∀s s' pd pts pr vr.
    Action.specificationAddMapping pd pts pr vr s s' ⇒ ¬(pd ∈ pts)

⊦ ∀s s' pd pts pr vr.
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    Page.isDirectory (State.page s pd)

⊦ ∀s s' pd pts pr vr.
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    Page.isDirectory (State.page s' pd)

⊦ ∀s s' va b.
    Action.specificationWriteEnvironment va b s s' ⇒
    State.translatePage s (State.cr3 s) =
    State.translatePage s' (State.cr3 s')

⊦ ∀s s' va b.
    Action.specificationWriteKernel va b s s' ⇒
    State.translatePage s (State.cr3 s) =
    State.translatePage s' (State.cr3 s')

⊦ ∀s s' va b.
    Action.specificationWriteUser va b s s' ⇒
    State.translatePage s (State.cr3 s) =
    State.translatePage s' (State.cr3 s')

⊦ ∀s s'.
    (∀pd vpa.
       State.translatePage s pd vpa = State.translatePage s' pd vpa) ⇒
    State.translatePage s = State.translatePage s'

⊦ ∀f. ∃fn. ∀a0 a1 a2 a3. fn (State a0 a1 a2 a3) = f a0 a1 a2 a3

⊦ ∀s s' pd vr.
    Action.specificationRemoveMappingH pd vr s s' ⇒
    ∃ppa. State.translatePage s pd (Virtual.Region.start vr) = some ppa

⊦ ∀s s' ppa.
    State.wellformed s ∧
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    State.translatePage s (State.cr3 s) =
    State.translatePage s' (State.cr3 s')

⊦ ∀s s' pd.
    State.wellformed s' ∧ Action.specificationFreePageDirectoryH pd s s' ⇒
    State.translatePage s (State.cr3 s) =
    State.translatePage s' (State.cr3 s')

⊦ ∀s s' pd pts pr vr.
    Action.specificationAddMappingH pd pts pr vr s s' ⇒
    State.cr3 s = State.cr3 s'

⊦ ∀s s' pd pts pr vr.
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    State.cr3 s = State.cr3 s'

⊦ ∀s s' pd pts pr vr.
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    State.reference s = State.reference s'

⊦ ∀vsa.
    Virtual.Superpage.isKernel vsa ⇔
    let w ← Virtual.Superpage.dest vsa in bit w 9 ∧ bit w 8

⊦ ∀s s' va b ppa.
    Action.specificationWriteEnvironment va b s s' ⇒
    (Page.isEnvironment (State.page s ppa) ⇔
     Page.isEnvironment (State.page s' ppa))

⊦ ∀s s' va b ppa.
    Action.specificationWriteEnvironment va b s s' ⇒
    Page.destNormal (State.page s ppa) =
    Page.destNormal (State.page s' ppa)

⊦ ∀s s' va b ppa.
    Action.specificationWriteKernel va b s s' ⇒
    (Page.isEnvironment (State.page s ppa) ⇔
     Page.isEnvironment (State.page s' ppa))

⊦ ∀s s' va b ppa.
    Action.specificationWriteKernel va b s s' ⇒
    Page.destEnvironment (State.page s ppa) =
    Page.destEnvironment (State.page s' ppa)

⊦ ∀s s' va b ppa.
    Action.specificationWriteUser va b s s' ⇒
    (Page.isEnvironment (State.page s ppa) ⇔
     Page.isEnvironment (State.page s' ppa))

⊦ ∀s s' va b ppa.
    Action.specificationWriteUser va b s s' ⇒
    Page.destEnvironment (State.page s ppa) =
    Page.destEnvironment (State.page s' ppa)

⊦ ∀s.
    State.regionsAreNotEnvironment s ⇔
    ∀r ppa.
      r ∈ State.Regions.all (State.regions s) ∧
      Physical.Region.member ppa r ⇒ ¬Page.isEnvironment (State.page s ppa)

⊦ ∀s s' ppa ppa'.
    State.wellformed s ∧
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    (Page.isEnvironment (State.page s' ppa') ⇔
     Page.isEnvironment (State.page s ppa'))

⊦ ∀s s' ppa ppa'.
    State.wellformed s ∧
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    Page.destEnvironment (State.page s' ppa') =
    Page.destEnvironment (State.page s ppa')

⊦ ∀s s' ppa pt.
    State.wellformed s ∧
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    Page.destTable (State.page s' pt) = Page.destTable (State.page s pt)

⊦ ∀s s' pd pt.
    State.wellformed s' ∧ Action.specificationFreePageDirectoryH pd s s' ⇒
    Page.destEnvironment (State.page s' pt) =
    Page.destEnvironment (State.page s pt)

⊦ ∀s s' pd pt.
    State.wellformed s' ∧ Action.specificationFreePageDirectoryH pd s s' ⇒
    Page.destTable (State.page s' pt) = Page.destTable (State.page s pt)

⊦ ∀s s' ppa ppa'.
    Action.specificationAllocatePageDirectoryH ppa s s' ∧ ¬(ppa' = ppa) ⇒
    State.page s' ppa' = State.page s ppa'

⊦ ∀s ppa.
    State.unmappedPage s ppa ⇔
    ∀pd.
      Page.isDirectory (State.page s pd) ⇒
      ∀vpa. ¬(State.translatePage s pd vpa = some ppa)

⊦ ∀s s' pr ppa l.
    Action.specificationDeriveRegionH pr ppa l s s' ⇒
    State.translatePage s (State.cr3 s) =
    State.translatePage s' (State.cr3 s')

⊦ ∀s pd vpa ppa.
    State.wellformed s ∧ State.translatePage s pd vpa = some ppa ∧
    Page.isEnvironment (State.page s ppa) ⇒ Virtual.Page.isKernel vpa

⊦ ∀s.
    State.environmentOnlyInReference s ⇔
    ∀pd vpa.
      case State.translatePage s pd vpa of
        none → ⊤
      | some ppa →
          Page.isEnvironment (State.page s ppa) ⇒
          State.mappedPage s (State.reference s) vpa

⊦ ∀s pd pt.
    State.tableMappedInDirectory s pd pt ⇔
    case Page.destDirectory (State.page s pd) of
      none → ⊥
    | some pdd →
        ∃pdi.
          Page.Directory.Data.dest pdd pdi =
          some (Page.Directory.Entry.Table pt)

⊦ ∀s s' pd pts pr vr pt.
    Action.specificationAddMapping pd pts pr vr s s' ∧ pt ∈ pts ⇒
    State.isNormalPage s pt

⊦ ∀s s' pd pts pr vr pt.
    Action.specificationAddMapping pd pts pr vr s s' ∧ pt ∈ pts ⇒
    State.unmappedNormalPage s pt

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    (Page.isDirectory (State.page s ppa) ⇔
     Page.isDirectory (State.page s' ppa))

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    (Page.isEnvironment (State.page s ppa) ⇔
     Page.isEnvironment (State.page s' ppa))

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    (Page.isNormal (State.page s ppa) ⇔ Page.isNormal (State.page s' ppa))

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    (Page.isTable (State.page s ppa) ⇔ Page.isTable (State.page s' ppa))

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    Page.destEnvironment (State.page s ppa) =
    Page.destEnvironment (State.page s' ppa)

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    Page.destEnvironmentOrNormal (State.page s ppa) =
    Page.destEnvironmentOrNormal (State.page s' ppa)

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    Page.destNormal (State.page s ppa) =
    Page.destNormal (State.page s' ppa)

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    Page.destDirectory (State.page s ppa) =
    Page.destDirectory (State.page s' ppa)

⊦ ∀s pd vpa.
    State.wellformed s ∧ Page.isDirectory (State.page s pd) ∧
    Virtual.Page.isKernel vpa ⇒
    State.translatePage s pd vpa =
    State.translatePage s (State.reference s) vpa

⊦ ∀s.
    State.pageDirectoriesContainReference s ⇔
    ∀pd vpa.
      Page.isDirectory (State.page s pd) ∧ Virtual.Page.isKernel vpa ⇒
      State.translatePage s pd vpa =
      State.translatePage s (State.reference s) vpa

⊦ (∀f g psa.
     Page.Directory.Entry.case f g (Page.Directory.Entry.Superpage psa) =
     f psa) ∧
  ∀f g pt.
    Page.Directory.Entry.case f g (Page.Directory.Entry.Table pt) = g pt

⊦ ∀fe fh fk fu.
    ∃fn.
      fn Domain.Environment = fe ∧ fn Domain.H = fh ∧
      fn Domain.Kernel = fk ∧ fn Domain.User = fu

⊦ ∀s s' pd pts pr vr pt.
    Action.specificationAddMapping pd pts pr vr s s' ∧ pt ∈ pts ⇒
    State.tableMappedInDirectory s' pd pt

⊦ ∀s pd pt.
    State.tableMappedInDirectory s pd pt ⇔
    ∃pdd pdi.
      State.page s pd = Page.Directory pdd ∧
      Page.Directory.Data.dest pdd pdi =
      some (Page.Directory.Entry.Table pt)

⊦ ∀s s' ppa pd.
    State.wellformed s ∧
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    State.translatePage s pd =
    if pd = ppa then const none else State.translatePage s' pd

⊦ ∀s s' ppa pd.
    State.wellformed s ∧
    Action.specificationAllocatePageDirectoryH ppa s s' ⇒
    State.translatePage s' pd =
    State.translatePage s (if pd = ppa then State.reference s else pd)

⊦ ∀s s' pd pd'.
    State.wellformed s' ∧ Action.specificationFreePageDirectoryH pd s s' ⇒
    State.translatePage s pd' =
    State.translatePage s' (if pd' = pd then State.reference s' else pd')

⊦ ∀s s' pd pd'.
    State.wellformed s' ∧ Action.specificationFreePageDirectoryH pd s s' ⇒
    State.translatePage s' pd' =
    if pd' = pd then const none else State.translatePage s pd'

⊦ ∀s s' pr vr pd pt.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    (State.tableMappedInDirectory s pd pt ⇔
     State.tableMappedInDirectory s' pd pt)

⊦ ∀s s' pr vr pt.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ⇒
    (State.tableMappedInDirectory s (State.reference s) pt ⇔
     State.tableMappedInDirectory s' (State.reference s') pt)

⊦ ∀s s' pr vr ppa.
    Action.specificationAddKernelMappingH pr vr s s' ∧
    ¬State.tableMappedInDirectory s (State.reference s) ppa ⇒
    State.page s ppa = State.page s' ppa

⊦ ∀s s'.
    (∀ppa.
       Page.isDirectoryOrTable (State.page s ppa) ∨
       Page.isDirectoryOrTable (State.page s' ppa) ⇒
       State.page s ppa = State.page s' ppa) ⇒
    State.translatePage s = State.translatePage s'

⊦ ∀s.
    State.tablePointersArePageTables s ⇔
    ∀pd pdi.
      case Page.destDirectory (State.page s pd) of
        none → ⊤
      | some pdd →
          case Page.Directory.Data.dest pdd pdi of
            none → ⊤
          | some pde →
              case pde of
                Page.Directory.Entry.Superpage spa → ⊤
              | Page.Directory.Entry.Table ppa →
                  Page.isTable (State.page s ppa)

⊦ ∀va b.
    ∃f.
      ∀s s'.
        State.wellformed s ∧ State.wellformed s' ∧
        Action.specificationWriteEnvironment va b s s' ⇒
        view Domain.Environment s' = f (view Domain.Environment s)

⊦ ∀va b.
    ∃f.
      ∀s s'.
        State.wellformed s ∧ State.wellformed s' ∧
        Action.specificationWriteKernel va b s s' ⇒
        view Domain.Kernel s' = f (view Domain.Kernel s)

⊦ ∀s s' pd vr ppa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationRemoveMappingH pd vr s s' ⇒
    (Page.isEnvironment (State.page s ppa) ⇔
     Page.isEnvironment (State.page s' ppa))

⊦ ∀s s' pd vr ppa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationRemoveMappingH pd vr s s' ⇒
    Page.destEnvironment (State.page s ppa) =
    Page.destEnvironment (State.page s' ppa)

⊦ ∀s pd vpa ppa.
    State.wellformed s ∧ Virtual.Page.isUser vpa ∧
    State.translatePage s pd vpa = some ppa ⇒
    Page.destEnvironmentOrNormal (State.page s ppa) =
    Page.destNormal (State.page s ppa)

⊦ ∀s s' pd pts pr vr pt.
    State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ∧ pt ∈ pts ⇒
    Page.isTable (State.page s' pt)

⊦ ∀s s' pr vr ppa.
    State.wellformed s ∧ Action.specificationAddKernelMappingH pr vr s s' ∧
    ¬Page.isTable (State.page s ppa) ⇒ State.page s ppa = State.page s' ppa

⊦ ∀s pd pdd pdi pt.
    State.wellformed s ∧ State.page s pd = Page.Directory pdd ∧
    Page.Directory.Data.dest pdd pdi =
    some (Page.Directory.Entry.Table pt) ⇒ Page.isTable (State.page s pt)

⊦ ∀P.
    (∀a. P (Page.Environment a)) ∧ (∀a. P (Page.Normal a)) ∧
    (∀a. P (Page.Directory a)) ∧ (∀a. P (Page.Table a)) ∧
    P Page.NotInstalled ⇒ ∀x. P x

⊦ ∀p.
    (∃d. p = Page.Environment d) ∨ (∃d. p = Page.Normal d) ∨
    (∃pdd. p = Page.Directory pdd) ∨ (∃ptd. p = Page.Table ptd) ∨
    p = Page.NotInstalled

⊦ ∀s s' pr vr vpa.
    Action.specificationAddKernelMappingH pr vr s s' ∧
    Virtual.Region.member vpa vr ⇒
    ∃ppa.
      Physical.Region.member ppa pr ∧
      State.translatePage s' (State.reference s') vpa = some ppa

⊦ ∀s va.
    State.translation s va =
    let (vpa, i) ← Virtual.Address.dest va in
    case State.translatePage s (State.cr3 s) vpa of
      none → none
    | some ppa → some (Physical.Address.mk (ppa, i))

⊦ ∀pd s s'.
    Action.specificationExecuteH pd s s' ⇔
    State.reference s = State.reference s' ∧ State.page s = State.page s' ∧
    State.regions s = State.regions s' ∧ State.cr3 s' = pd

⊦ ∀s s' pd pts pr vr.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    State.translatePage s (State.reference s) =
    State.translatePage s' (State.reference s')

⊦ ∀s s' pr vr vpa ppa.
    Action.specificationAddKernelMappingH pr vr s s' ∧
    Virtual.Region.member vpa vr ∧
    State.translatePage s (State.reference s) vpa = some ppa ⇒
    ¬State.isEnvironmentPage s ppa

⊦ ∀s s' pd pts pr vr vpa.
    Action.specificationAddMapping pd pts pr vr s s' ∧
    ¬Virtual.Region.member vpa vr ⇒
    State.translatePage s pd vpa = State.translatePage s' pd vpa

⊦ ∀s s' va b ppa.
    Action.specificationWriteEnvironment va b s s' ∧
    (¬Page.isEnvironment (State.page s ppa) ∨
     ¬Page.isEnvironment (State.page s' ppa)) ⇒
    State.page s ppa = State.page s' ppa

⊦ ∀s s' va b ppa.
    Action.specificationWriteKernel va b s s' ∧
    (¬Page.isNormal (State.page s ppa) ∨
     ¬Page.isNormal (State.page s' ppa)) ⇒
    State.page s ppa = State.page s' ppa

⊦ ∀s s' va b ppa.
    Action.specificationWriteUser va b s s' ∧
    (¬Page.isNormal (State.page s ppa) ∨
     ¬Page.isNormal (State.page s' ppa)) ⇒
    State.page s ppa = State.page s' ppa

⊦ ∀s s' pd vr pd' vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationRemoveMappingH pd vr s s' ∧
    Virtual.Page.isKernel vpa ⇒
    State.translatePage s pd' vpa = State.translatePage s' pd' vpa

⊦ ∀s s' pr vr pd vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddKernelMappingH pr vr s s' ∧
    Virtual.Page.isUser vpa ⇒
    State.translatePage s pd vpa = State.translatePage s' pd vpa

⊦ ∀s s' pd vr vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationRemoveMappingH pd vr s s' ∧
    Virtual.Page.isKernel vpa ⇒
    State.translatePage s (State.cr3 s) vpa =
    State.translatePage s' (State.cr3 s') vpa

⊦ ∀s s' pd pts pr vr ppa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMappingH pd pts pr vr s s' ⇒
    (Page.isEnvironment (State.page s ppa) ⇔
     Page.isEnvironment (State.page s' ppa))

⊦ ∀s s' pd pts pr vr ppa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMappingH pd pts pr vr s s' ⇒
    Page.destEnvironment (State.page s ppa) =
    Page.destEnvironment (State.page s' ppa)

⊦ ∀s s' pd pts pr vr ppa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    (Page.isDirectory (State.page s ppa) ⇔
     Page.isDirectory (State.page s' ppa))

⊦ ∀s s' pd pts pr vr ppa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    (Page.isEnvironment (State.page s ppa) ⇔
     Page.isEnvironment (State.page s' ppa))

⊦ ∀s s' pd pts pr vr ppa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ⇒
    Page.destEnvironment (State.page s ppa) =
    Page.destEnvironment (State.page s' ppa)

⊦ ∀s.
    State.wellformed s ⇔
    State.cr3IsPageDirectory s ∧ State.pageDirectoriesContainReference s ∧
    State.mappedPagesAreAvailable s ∧ State.tablePointersArePageTables s ∧
    State.noSharedPageTables s ∧ State.referenceIsPageDirectory s ∧
    State.referenceMapsKernelAddresses s ∧
    State.environmentOnlyInReference s ∧ State.initialRegionsAreRegions s ∧
    State.regionsAreNotEnvironment s

⊦ ∀s s' pr vr vpa.
    State.wellformed s' ∧
    Action.specificationAddKernelMappingH pr vr s s' ∧
    Virtual.Region.member vpa vr ⇒
    ∃ppa.
      Physical.Region.member ppa pr ∧
      State.translatePage s' (State.cr3 s') vpa = some ppa

⊦ (∀d. Page.isNotInstalled (Page.Environment d) ⇔ ⊥) ∧
  (∀d. Page.isNotInstalled (Page.Normal d) ⇔ ⊥) ∧
  (∀pdd. Page.isNotInstalled (Page.Directory pdd) ⇔ ⊥) ∧
  (∀ptd. Page.isNotInstalled (Page.Table ptd) ⇔ ⊥) ∧
  (Page.isNotInstalled Page.NotInstalled ⇔ ⊤)

⊦ ∀s s' pr vr pd vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddKernelMappingH pr vr s s' ∧
    ¬Virtual.Region.member vpa vr ⇒
    State.translatePage s pd vpa = State.translatePage s' pd vpa

⊦ ∀ppa.
    Physical.Page.suc ppa =
    let (psa, si) ← Physical.Page.dest ppa in
    let si' ← Superpage.Offset.add si 1 in
    let psa' ← if si' = 0 then Physical.Superpage.add psa 1 else psa in
    Physical.Page.mk (psa', si')

⊦ ∀vpa.
    Virtual.Page.suc vpa =
    let (vsa, si) ← Virtual.Page.dest vpa in
    let si' ← Superpage.Offset.add si 1 in
    let vsa' ← if si' = 0 then Virtual.Superpage.add vsa 1 else vsa in
    Virtual.Page.mk (vsa', si')

⊦ (∀d. Page.destNormal (Page.Environment d) = none) ∧
  (∀d. Page.destNormal (Page.Normal d) = some d) ∧
  (∀pdd. Page.destNormal (Page.Directory pdd) = none) ∧
  (∀ptd. Page.destNormal (Page.Table ptd) = none) ∧
  Page.destNormal Page.NotInstalled = none

⊦ (∀d. Page.destDirectory (Page.Environment d) = none) ∧
  (∀d. Page.destDirectory (Page.Normal d) = none) ∧
  (∀pdd. Page.destDirectory (Page.Directory pdd) = some pdd) ∧
  (∀ptd. Page.destDirectory (Page.Table ptd) = none) ∧
  Page.destDirectory Page.NotInstalled = none

⊦ (∀d. Page.destTable (Page.Environment d) = none) ∧
  (∀d. Page.destTable (Page.Normal d) = none) ∧
  (∀pdd. Page.destTable (Page.Directory pdd) = none) ∧
  (∀ptd. Page.destTable (Page.Table ptd) = some ptd) ∧
  Page.destTable Page.NotInstalled = none

⊦ (∀d. Page.destEnvironment (Page.Environment d) = some d) ∧
  (∀d. Page.destEnvironment (Page.Normal d) = none) ∧
  (∀pdd. Page.destEnvironment (Page.Directory pdd) = none) ∧
  (∀ptd. Page.destEnvironment (Page.Table ptd) = none) ∧
  Page.destEnvironment Page.NotInstalled = none

⊦ ∀s s' pd pts pr vr ppa.
    State.wellformed s ∧ Action.specificationAddMapping pd pts pr vr s s' ∧
    ¬(ppa ∈ pts) ⇒
    (Page.isTable (State.page s ppa) ⇔ Page.isTable (State.page s' ppa))

⊦ ∀s s' pr vr vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddKernelMappingH pr vr s s' ∧
    ¬Virtual.Region.member vpa vr ⇒
    State.translatePage s (State.cr3 s) vpa =
    State.translatePage s' (State.cr3 s') vpa

⊦ (∀d. Page.destEnvironmentOrNormal (Page.Environment d) = some d) ∧
  (∀d. Page.destEnvironmentOrNormal (Page.Normal d) = some d) ∧
  (∀pdd. Page.destEnvironmentOrNormal (Page.Directory pdd) = none) ∧
  (∀ptd. Page.destEnvironmentOrNormal (Page.Table ptd) = none) ∧
  Page.destEnvironmentOrNormal Page.NotInstalled = none

⊦ ∀s s' pd pts pr vr pd'.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ∧ ¬(pd' = pd) ⇒
    State.translatePage s pd' = State.translatePage s' pd'

⊦ ∀v.
    (∃f. v = View.Environment f) ∨ (∃c p g r. v = View.H c p g r) ∨
    (∃f g. v = View.Kernel f g) ∨ ∃f. v = View.User f

⊦ ∀tr s.
    View.ObservablePages.fromTranslate tr s =
    View.ObservablePages.mk
      (λvpa.
         case tr s vpa of
           none → none
         | some ppa →
             case Page.destEnvironmentOrNormal (State.page s ppa) of
               none → none
             | some d → some (d, { vpa'. vpa' | tr s vpa' = some ppa }))

⊦ ∀phi.
    (∀f. phi (View.Environment f)) ∧ (∀c p g r. phi (View.H c p g r)) ∧
    (∀f g. phi (View.Kernel f g)) ∧ (∀f. phi (View.User f)) ⇒ ∀v. phi v

⊦ ∀s s' pd pts pr vr pd' vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMappingH pd pts pr vr s s' ∧
    Virtual.Page.isKernel vpa ⇒
    State.translatePage s pd' vpa = State.translatePage s' pd' vpa

⊦ ∀s s' pd pts pr vr pd' vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ∧
    Virtual.Page.isKernel vpa ⇒
    State.translatePage s pd' vpa = State.translatePage s' pd' vpa

⊦ ∀s s' pd pts pr vr vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMappingH pd pts pr vr s s' ∧
    Virtual.Page.isKernel vpa ⇒
    State.translatePage s (State.cr3 s) vpa =
    State.translatePage s' (State.cr3 s') vpa

⊦ ∀s s' pd pts pr vr ppa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ∧ ¬(ppa = pd) ⇒
    Page.destDirectory (State.page s ppa) =
    Page.destDirectory (State.page s' ppa)

⊦ ∀s s' pd pts pr vr ppa.
    Action.specificationAddMapping pd pts pr vr s s' ∧ ¬(ppa ∈ pts) ∧
    ¬State.tableMappedInDirectory s pd ppa ⇒
    Page.destTable (State.page s ppa) = Page.destTable (State.page s' ppa)

⊦ ∀s s' pd pts pr vr vpa.
    State.wellformed s ∧ State.wellformed s' ∧
    Action.specificationAddMapping pd pts pr vr s s' ∧
    Virtual.Page.isKernel vpa ⇒
    State.translatePage s (State.cr3 s) vpa =
    State.translatePage s' (State.cr3 s') vpa

⊦ ∀s s' pd pts pr vr ppa.
    Action.specificationAddMapping pd pts pr vr s s' ∧ ¬(ppa = pd) ∧
    ¬(ppa ∈ pts) ∧ ¬State.tableMappedInDirectory s pd ppa ⇒
    State.page s ppa = State.page s' ppa

⊦ ∀s s' va b pd vpa ppa.
    State.wellformed s ∧ State.wellformed s' ∧ Virtual.Page.isUser vpa ∧
    State.translatePage s pd vpa = some ppa ∧
    Action.specificationWriteEnvironment va b s s' ⇒
    Page.destEnvironmentOrNormal (State.page s ppa) =
    Page.destEnvironmentOrNormal (State.page s' ppa)

⊦ (∀s.
     view Domain.Environment s =
     View.Environment (View.mkObservablePagesEnvironment s)) ∧
  (∀s.
     view Domain.H s =
     View.H (View.mkCurrentPageDirectoryH s) (View.mkPagesH s)
       (View.mkRegionHandlesH s) (View.mkReferencePageDirectoryH s)) ∧
  (∀s.
     view Domain.Kernel s =
     View.Kernel (View.mkObservablePagesKernel s)
       (View.mkRegionHandlesKernel s)) ∧
  ∀s. view Domain.User s = View.User (View.mkObservablePagesUser s)

⊦ ∀ppa s s'.
    Action.specificationAllocatePageDirectoryH ppa s s' ⇔
    State.cr3 s = State.cr3 s' ∧ State.reference s = State.reference s' ∧
    State.regions s = State.regions s' ∧ State.unmappedNormalPage s ppa ∧
    ∀ppa'.
      State.page s' ppa' =
      State.page s (if ppa' = ppa then State.reference s else ppa')

⊦ ∀pd pts pr vr s s'.
    Action.specificationAddMappingH pd pts pr vr s s' ⇔
    length (nub pts) = length pts ∧
    pr ∈ State.Regions.all (State.regions s) ∧
    ∃n.
      n ≤ length pts ∧
      Action.specificationAddMapping pd (toSet (take n pts)) pr vr s s'

⊦ ∀f0 f1 f2 f3 f4.
    ∃fn.
      (∀a. fn (Page.Environment a) = f0 a) ∧
      (∀a. fn (Page.Normal a) = f1 a) ∧
      (∀a. fn (Page.Directory a) = f2 a) ∧ (∀a. fn (Page.Table a) = f3 a) ∧
      fn Page.NotInstalled = f4

⊦ ∀pd vr s s'.
    Action.specificationRemoveMappingH pd vr s s' ⇔
    case State.translatePage s pd (Virtual.Region.start vr) of
      none → ⊥
    | some prs →
        let pr ← Physical.Region.mk prs (Virtual.Region.length vr) in
        let pts ←
            { ppa. ppa |
              Page.isTable (State.page s ppa) ∧
              State.page s' ppa = Page.Normal Page.Data.zero } in
        Action.specificationAddMapping pd pts pr vr s' s

⊦ ∀s pd vpa.
    State.translatePage s pd vpa =
    let (vsa, si) ← Virtual.Page.dest vpa in
    case Page.destDirectory (State.page s pd) of
      none → none
    | some pdd →
        case Page.Directory.Data.dest pdd vsa of
          none → none
        | some pde →
            case pde of
              Page.Directory.Entry.Superpage psa →
                some (Physical.Page.mk (psa, si))
            | Page.Directory.Entry.Table pt →
                case Page.destTable (State.page s pt) of
                  none → none
                | some ptd → Page.Table.Data.dest ptd si

⊦ ∀fe fh fk fu.
    ∃fn.
      (∀f. fn (View.Environment f) = fe f) ∧
      (∀c p g r. fn (View.H c p g r) = fh c p g r) ∧
      (∀f g. fn (View.Kernel f g) = fk f g) ∧ ∀f. fn (View.User f) = fu f

⊦ ∀s pt pd1 pd2 pdd1 pdd2 vsa1 vsa2.
    State.wellformed s ∧
    Page.destDirectory (State.page s pd1) = some pdd1 ∧
    Page.destDirectory (State.page s pd2) = some pdd2 ∧
    Page.Directory.Data.dest pdd1 vsa1 =
    some (Page.Directory.Entry.Table pt) ∧
    Page.Directory.Data.dest pdd2 vsa2 =
    some (Page.Directory.Entry.Table pt) ⇒
    vsa1 = vsa2 ∧ (Virtual.Superpage.isKernel vsa1 ∨ pd1 = pd2)

⊦ ∀s.
    State.noSharedPageTables s ⇔
    ∀pt pd1 pd2 pdd1 pdd2 vsa1 vsa2.
      Page.destDirectory (State.page s pd1) = some pdd1 ∧
      Page.destDirectory (State.page s pd2) = some pdd2 ∧
      Page.Directory.Data.dest pdd1 vsa1 =
      some (Page.Directory.Entry.Table pt) ∧
      Page.Directory.Data.dest pdd2 vsa2 =
      some (Page.Directory.Entry.Table pt) ⇒
      vsa1 = vsa2 ∧ (Virtual.Superpage.isKernel vsa1 ∨ pd1 = pd2)

⊦ ∀s s' va b.
    Action.specificationWriteEnvironment va b s s' ⇒
    ∃vpa i ppa d.
      va = Virtual.Address.mk (vpa, i) ∧
      State.translatePage s (State.cr3 s) vpa = some ppa ∧
      State.page s ppa = Page.Environment d ∧
      ∀ppa'.
        State.page s' ppa' =
        if ppa' = ppa then Page.Environment (Page.Data.update i b d)
        else State.page s ppa'

⊦ ∀s s' va b.
    Action.specificationWriteKernel va b s s' ⇒
    ∃vpa i ppa d.
      va = Virtual.Address.mk (vpa, i) ∧
      State.translatePage s (State.cr3 s) vpa = some ppa ∧
      State.page s ppa = Page.Normal d ∧
      ∀ppa'.
        State.page s' ppa' =
        if ppa' = ppa then Page.Normal (Page.Data.update i b d)
        else State.page s ppa'

⊦ ∀s s' pd vr.
    Action.specificationRemoveMappingH pd vr s s' ⇔
    ∃prs pr pts.
      State.translatePage s pd (Virtual.Region.start vr) = some prs ∧
      Physical.Region.mk prs (Virtual.Region.length vr) = pr ∧
      { ppa. ppa |
        Page.isTable (State.page s ppa) ∧
        State.page s' ppa = Page.Normal Page.Data.zero } = pts ∧
      Action.specificationAddMapping pd pts pr vr s' s

⊦ ∀pr ppa l s s'.
    Action.specificationDeriveRegionH pr ppa l s s' ⇔
    State.cr3 s = State.cr3 s' ∧ State.reference s = State.reference s' ∧
    State.page s = State.page s' ∧
    State.Regions.initial (State.regions s) =
    State.Regions.initial (State.regions s') ∧
    let r ← Physical.Region.mk ppa l in
    Physical.Region.isSubregion r pr ∧
    ¬(r ∈ State.Regions.all (State.regions s)) ∧
    State.Regions.all (State.regions s') =
    insert r (State.Regions.all (State.regions s))

⊦ ∀va b s s'.
    Action.specificationWriteEnvironment va b s s' ⇔
    State.cr3 s = State.cr3 s' ∧ State.reference s = State.reference s' ∧
    State.regions s = State.regions s' ∧
    case State.translation s va of
      none → ⊥
    | some pa →
        let (ppa, i) ← Physical.Address.dest pa in
        ∀ppa'.
          if ppa' = ppa then
            case Page.destEnvironment (State.page s ppa') of
              none → ⊥
            | some d →
                Page.destEnvironment (State.page s' ppa') =
                some (Page.Data.update i b d)
          else State.page s ppa' = State.page s' ppa'

⊦ ∀va b s s'.
    Action.specificationWriteKernel va b s s' ⇔
    State.cr3 s = State.cr3 s' ∧ State.reference s = State.reference s' ∧
    State.regions s = State.regions s' ∧ Virtual.Address.isKernel va ∧
    case State.translation s va of
      none → ⊥
    | some pa →
        let (ppa, i) ← Physical.Address.dest pa in
        ∀ppa'.
          if ppa' = ppa then
            case Page.destNormal (State.page s ppa') of
              none → ⊥
            | some d →
                Page.destNormal (State.page s' ppa') =
                some (Page.Data.update i b d)
          else State.page s ppa' = State.page s' ppa'

⊦ ∀va b s s'.
    Action.specificationWriteUser va b s s' ⇔
    State.cr3 s = State.cr3 s' ∧ State.reference s = State.reference s' ∧
    State.regions s = State.regions s' ∧ Virtual.Address.isUser va ∧
    case State.translation s va of
      none → ⊥
    | some pa →
        let (ppa, i) ← Physical.Address.dest pa in
        ∀ppa'.
          if ppa' = ppa then
            case Page.destNormal (State.page s ppa') of
              none → ⊥
            | some d →
                Page.destNormal (State.page s' ppa') =
                some (Page.Data.update i b d)
          else State.page s ppa' = State.page s' ppa'

⊦ ∀p.
    (∀va b. p (Action.WriteEnvironment va b)) ∧
    (∀pr ppa l. p (Action.DeriveRegionH pr ppa l)) ∧
    (∀ppa. p (Action.AllocatePageDirectoryH ppa)) ∧
    (∀pd. p (Action.FreePageDirectoryH pd)) ∧
    (∀pd pts pr vr. p (Action.AddMappingH pd pts pr vr)) ∧
    (∀pd vr. p (Action.RemoveMappingH pd vr)) ∧
    (∀pr vr. p (Action.AddKernelMappingH pr vr)) ∧
    (∀pd. p (Action.ExecuteH pd)) ∧ (∀va b. p (Action.WriteKernel va b)) ∧
    (∀va b. p (Action.WriteUser va b)) ⇒ ∀a. p a

⊦ ∀x y.
    interferes x y ⇔
    x = Domain.Environment ∧ y = Domain.Environment ∨
    x = Domain.Environment ∧ y = Domain.H ∨
    x = Domain.Environment ∧ y = Domain.Kernel ∨
    x = Domain.H ∧ y = Domain.H ∨ x = Domain.H ∧ y = Domain.Kernel ∨
    x = Domain.H ∧ y = Domain.User ∨
    x = Domain.Kernel ∧ y = Domain.Kernel ∨
    x = Domain.Kernel ∧ y = Domain.User ∨
    x = Domain.User ∧ y = Domain.Kernel ∨ x = Domain.User ∧ y = Domain.User

⊦ (∀f f'. View.Environment f = View.Environment f' ⇔ f = f') ∧
  (∀c p g r c' p' g' r'.
     View.H c p g r = View.H c' p' g' r' ⇔
     c = c' ∧ p = p' ∧ g = g' ∧ r = r') ∧
  (∀f g f' g'. View.Kernel f g = View.Kernel f' g' ⇔ f = f' ∧ g = g') ∧
  ∀f f'. View.User f = View.User f' ⇔ f = f'

⊦ ∀a.
    (∃va b. a = Action.WriteEnvironment va b) ∨
    (∃pr ppa l. a = Action.DeriveRegionH pr ppa l) ∨
    (∃ppa. a = Action.AllocatePageDirectoryH ppa) ∨
    (∃pd. a = Action.FreePageDirectoryH pd) ∨
    (∃pd pts pr vr. a = Action.AddMappingH pd pts pr vr) ∨
    (∃pd vr. a = Action.RemoveMappingH pd vr) ∨
    (∃pr vr. a = Action.AddKernelMappingH pr vr) ∨
    (∃pd. a = Action.ExecuteH pd) ∨ (∃va b. a = Action.WriteKernel va b) ∨
    ∃va b. a = Action.WriteUser va b

⊦ (∀va b. domain (Action.WriteEnvironment va b) = Domain.Environment) ∧
  (∀pr ppa l. domain (Action.DeriveRegionH pr ppa l) = Domain.H) ∧
  (∀ppa. domain (Action.AllocatePageDirectoryH ppa) = Domain.H) ∧
  (∀pd. domain (Action.FreePageDirectoryH pd) = Domain.H) ∧
  (∀pd pts pr vr. domain (Action.AddMappingH pd pts pr vr) = Domain.H) ∧
  (∀pd vr. domain (Action.RemoveMappingH pd vr) = Domain.H) ∧
  (∀pr vr. domain (Action.AddKernelMappingH pr vr) = Domain.H) ∧
  (∀pd. domain (Action.ExecuteH pd) = Domain.H) ∧
  (∀va b. domain (Action.WriteKernel va b) = Domain.Kernel) ∧
  ∀va b. domain (Action.WriteUser va b) = Domain.User

⊦ ∀pr vr s s'.
    Action.specificationAddKernelMappingH pr vr s s' ⇔
    State.cr3 s = State.cr3 s' ∧ State.reference s = State.reference s' ∧
    State.regions s = State.regions s' ∧
    pr ∈ State.Regions.all (State.regions s) ∧
    Physical.Region.forall (State.isNormalPage s) pr ∧
    Physical.Region.length pr = Virtual.Region.length vr ∧
    Virtual.Region.isKernel vr ∧
    (∀vpa.
       ¬Virtual.Region.member vpa vr ⇒
       State.translatePage s' (State.reference s') vpa =
       State.translatePage s (State.reference s) vpa) ∧
    Virtual.Region.forall
      (λvpa.
         case State.translatePage s (State.reference s) vpa of
           none → ⊤
         | some ppa → ¬State.isEnvironmentPage s ppa) vr ∧
    all id
      (zipWith
         (λvpa ppa.
            State.translatePage s' (State.reference s') vpa = some ppa)
         (Virtual.Region.pageList vr) (Physical.Region.pageList pr)) ∧
    ∀ppa.
      if State.tableMappedInDirectory s (State.reference s) ppa then
        Page.isTable (State.page s' ppa)
      else State.page s ppa = State.page s' ppa

⊦ (∀va b.
     Action.specification (Action.WriteEnvironment va b) =
     Action.specificationWriteEnvironment va b) ∧
  (∀pr ppa l.
     Action.specification (Action.DeriveRegionH pr ppa l) =
     Action.specificationDeriveRegionH pr ppa l) ∧
  (∀ppa.
     Action.specification (Action.AllocatePageDirectoryH ppa) =
     Action.specificationAllocatePageDirectoryH ppa) ∧
  (∀pd.
     Action.specification (Action.FreePageDirectoryH pd) =
     Action.specificationFreePageDirectoryH pd) ∧
  (∀pd pts pr vr.
     Action.specification (Action.AddMappingH pd pts pr vr) =
     Action.specificationAddMappingH pd pts pr vr) ∧
  (∀pd vr.
     Action.specification (Action.RemoveMappingH pd vr) =
     Action.specificationRemoveMappingH pd vr) ∧
  (∀pr vr.
     Action.specification (Action.AddKernelMappingH pr vr) =
     Action.specificationAddKernelMappingH pr vr) ∧
  (∀pd.
     Action.specification (Action.ExecuteH pd) =
     Action.specificationExecuteH pd) ∧
  (∀va b.
     Action.specification (Action.WriteKernel va b) =
     Action.specificationWriteKernel va b) ∧
  ∀va b.
    Action.specification (Action.WriteUser va b) =
    Action.specificationWriteUser va b

⊦ ∀fwe fdr fapd ffpd fam frm fakm fe fwk fwu.
    ∃fn.
      (∀va b. fn (Action.WriteEnvironment va b) = fwe va b) ∧
      (∀pr ppa l. fn (Action.DeriveRegionH pr ppa l) = fdr pr ppa l) ∧
      (∀ppa. fn (Action.AllocatePageDirectoryH ppa) = fapd ppa) ∧
      (∀pd. fn (Action.FreePageDirectoryH pd) = ffpd pd) ∧
      (∀pd pts pr vr.
         fn (Action.AddMappingH pd pts pr vr) = fam pd pts pr vr) ∧
      (∀pd vr. fn (Action.RemoveMappingH pd vr) = frm pd vr) ∧
      (∀pr vr. fn (Action.AddKernelMappingH pr vr) = fakm pr vr) ∧
      (∀pd. fn (Action.ExecuteH pd) = fe pd) ∧
      (∀va b. fn (Action.WriteKernel va b) = fwk va b) ∧
      ∀va b. fn (Action.WriteUser va b) = fwu va b

⊦ ∀pd pts pr vr s s'.
    Action.specificationAddMapping pd pts pr vr s s' ⇔
    State.cr3 s = State.cr3 s' ∧ State.reference s = State.reference s' ∧
    State.regions s = State.regions s' ∧
    Page.isDirectory (State.page s pd) ∧
    (∀pt. pt ∈ pts ⇒ State.unmappedNormalPage s pt) ∧
    (∀pt. pt ∈ pts ⇒ ¬Physical.Region.member pt pr) ∧
    Physical.Region.forall (State.isNormalPage s) pr ∧
    Physical.Region.length pr = Virtual.Region.length vr ∧
    Virtual.Region.isUser vr ∧
    (∀vpa.
       if Virtual.Region.member vpa vr then
         isNone (State.translatePage s pd vpa)
       else State.translatePage s' pd vpa = State.translatePage s pd vpa) ∧
    all id
      (zipWith (λvpa ppa. State.translatePage s' pd vpa = some ppa)
         (Virtual.Region.pageList vr) (Physical.Region.pageList pr)) ∧
    ∀ppa.
      if ppa ∈ pts then State.tableMappedInDirectory s' pd ppa
      else if ppa = pd then Page.isDirectory (State.page s' ppa)
      else if State.tableMappedInDirectory s pd ppa then
        Page.isTable (State.page s' ppa)
      else State.page s ppa = State.page s' ppa

External Type Operators

External Constants

Assumptions

⊦ ⊤

⊦ ¬isSome none

⊦ ¬⊥ ⇔ ⊤

⊦ ¬⊤ ⇔ ⊥

⊦ length [] = 0

⊦ bit0 0 = 0

⊦ Bits.fromList [] = 0

⊦ ∀a. isSome (some a)

⊦ ∀t. t ⇒ t

⊦ ∀n. 0 ≤ n

⊦ ∀n. n ≤ n

⊦ ⊥ ⇔ ∀p. p

⊦ ∀x. id x = x

⊦ ∀t. t ∨ ¬t

⊦ (¬) = λp. p ⇒ ⊥

⊦ (∃) = λp. p ((select) p)

⊦ ∀a. ∃!x. x = a

⊦ ∀t. (∀x. t) ⇔ t

⊦ ∀t. (∃x. t) ⇔ t

⊦ ∀t. (λx. t x) = t

⊦ (∀) = λp. p = λx. ⊤

⊦ ∀a. ¬(some a = none)

⊦ ∀x. replicate x 0 = []

⊦ ∀t. ¬¬t ⇔ t

⊦ ∀t. (⊤ ⇔ t) ⇔ t

⊦ ∀t. (t ⇔ ⊤) ⇔ t

⊦ ∀t. ⊥ ∧ t ⇔ ⊥

⊦ ∀t. ⊤ ∧ t ⇔ t

⊦ ∀t. t ∧ ⊥ ⇔ ⊥

⊦ ∀t. t ∧ ⊤ ⇔ t

⊦ ∀t. t ∧ t ⇔ t

⊦ ∀t. ⊥ ⇒ t ⇔ ⊤

⊦ ∀t. ⊤ ⇒ t ⇔ t

⊦ ∀t. t ⇒ ⊤ ⇔ ⊤

⊦ ∀t. ⊥ ∨ t ⇔ t

⊦ ∀t. ⊤ ∨ t ⇔ ⊤

⊦ ∀t. t ∨ ⊥ ⇔ t

⊦ ∀t. t ∨ ⊤ ⇔ ⊤

⊦ ∀t. t ∨ t ⇔ t

⊦ ∀n. ¬(suc n = 0)

⊦ ∀n. 0 * n = 0

⊦ ∀m. m * 0 = 0

⊦ ∀n. 0 + n = n

⊦ ∀m. m + 0 = m

⊦ ∀l. [] @ l = l

⊦ modulus = 2 ↑ width

⊦ width = 10

⊦ ∀t. (⊥ ⇔ t) ⇔ ¬t

⊦ ∀t. (t ⇔ ⊥) ⇔ ¬t

⊦ ∀t. t ⇒ ⊥ ⇔ ¬t

⊦ ∀q. Bits.compare q [] [] ⇔ q

⊦ ∀n. even (2 * n)

⊦ ∀n. bit1 n = suc (bit0 n)

⊦ ∀m. m ↑ 0 = 1

⊦ ∀m. 1 * m = m

⊦ ∀l. Bits.toWord l = fromNatural (Bits.fromList l)

⊦ ∀x y. const x y = x

⊦ (⇒) = λp q. p ∧ q ⇔ p

⊦ ∀t. (t ⇔ ⊤) ∨ (t ⇔ ⊥)

⊦ ∀n. even (suc n) ⇔ ¬even n

⊦ ∀m. m ≤ 0 ⇔ m = 0

⊦ ∀x. (fst x, snd x) = x

⊦ ∀t1 t2. (if ⊥ then t1 else t2) = t2

⊦ ∀t1 t2. (if ⊤ then t1 else t2) = t1

⊦ ∀a b. fst (a, b) = a

⊦ ∀a b. snd (a, b) = b

⊦ ∀b f. case b f none = b

⊦ ∀m n. length (interval m n) = n

⊦ ∀p x. p x ⇒ p ((select) p)

⊦ ∀n. bit0 (suc n) = suc (suc (bit0 n))

⊦ ∀f y. (let x ← y in f x) = f y

⊦ ∀x. ∃a b. x = (a, b)

⊦ ∀x y. x = y ⇔ y = x

⊦ ∀x y. x = y ⇒ y = x

⊦ ∀h t. nth (h :: t) 0 = h

⊦ ∀t1 t2. t1 ∨ t2 ⇔ t2 ∨ t1

⊦ ∀a b. (a ⇔ b) ⇒ a ⇒ b

⊦ ∀m n. m * n = n * m

⊦ ∀m n. m + n = n + m

⊦ ∀m n. m + n - n = m

⊦ ∀f l. length (map f l) = length l

⊦ ∀n. Bits.cons ⊥ n = 2 * n

⊦ ∀n. n < modulus ⇒ toNatural (fromNatural n) = n

⊦ ∀n. n ↑ 2 = n * n

⊦ ∀n. 2 * n = n + n

⊦ ∀h t. length (h :: t) = suc (length t)

⊦ ∀m n. ¬(m < n ∧ n ≤ m)

⊦ ∀m n. ¬(m ≤ n ∧ n < m)

⊦ ∀m n. ¬(m ≤ n) ⇔ n < m

⊦ ∀m n. suc m ≤ n ⇔ m < n

⊦ ∀x. x = none ∨ ∃a. x = some a

⊦ (∧) = λp q. (λf. f p q) = λf. f ⊤ ⊤

⊦ ∀p. ¬(∀x. p x) ⇔ ∃x. ¬p x

⊦ ∀p. ¬(∃x. p x) ⇔ ∀x. ¬p x

⊦ (∃) = λp. ∀q. (∀x. p x ⇒ q) ⇒ q

⊦ ∀a b. some a = some b ⇔ a = b

⊦ ∀t1 t2. ¬t1 ⇒ ¬t2 ⇔ t2 ⇒ t1

⊦ ∀h t. Bits.fromList (h :: t) = Bits.cons h (Bits.fromList t)

⊦ ∀x y. x < y ⇔ toNatural x < toNatural y

⊦ ∀m n. m + suc n = suc (m + n)

⊦ ∀m n. suc m + n = suc (m + n)

⊦ ∀m n. suc m = suc n ⇔ m = n

⊦ ∀b f a. case b f (some a) = f a

⊦ ∀t1 t2. ¬(t1 ∧ t2) ⇔ ¬t1 ∨ ¬t2

⊦ ∀w1 w2. Bits.compare ⊥ (Bits.fromWord w1) (Bits.fromWord w2) ⇔ w1 < w2

⊦ ∀m n. even (m * n) ⇔ even m ∨ even n

⊦ ∀m n. even (m + n) ⇔ even m ⇔ even n

⊦ ∀m n. m * suc n = m + m * n

⊦ ∀m n. m ↑ suc n = m * m ↑ n

⊦ ∀m n. suc m * n = m * n + n

⊦ ∀n. Bits.cons ⊤ n = 1 + 2 * n

⊦ ∀f g. (∀x. f x = g x) ⇔ f = g

⊦ ∀p a. (∃x. a = x ∧ p x) ⇔ p a

⊦ (∨) = λp q. ∀r. (p ⇒ r) ⇒ (q ⇒ r) ⇒ r

⊦ ∀m n. m ≤ n ⇔ m < n ∨ m = n

⊦ ∀m n. m ≤ n ∧ n ≤ m ⇔ m = n

⊦ ∀f. ∃fn. ∀a b. fn (a, b) = f a b

⊦ ∀m n. m < n ⇔ ∃d. n = m + suc d

⊦ ∀p l. (∀x. member x l ⇒ p x) ⇔ all p l

⊦ ∀p. (∃x y. p x y) ⇔ ∃y x. p x y

⊦ ∀p q. (∃x. p ∧ q x) ⇔ p ∧ ∃x. q x

⊦ ∀p q. p ∧ (∃x. q x) ⇔ ∃x. p ∧ q x

⊦ ∀p q. p ∨ (∃x. q x) ⇔ ∃x. p ∨ q x

⊦ ∀x y z. x = y ∧ y = z ⇒ x = z

⊦ ∀t1 t2 t3. (t1 ∧ t2) ∧ t3 ⇔ t1 ∧ t2 ∧ t3

⊦ ∀t1 t2 t3. (t1 ∨ t2) ∨ t3 ⇔ t1 ∨ t2 ∨ t3

⊦ ∀m n p. m * (n * p) = n * (m * p)

⊦ ∀m n p. m * (n * p) = m * n * p

⊦ ∀m n p. m + (n + p) = m + n + p

⊦ ∀p m n. m + p = n + p ⇔ m = n

⊦ ∀m n p. m < n ∧ n < p ⇒ m < p

⊦ ∀l h t. (h :: t) @ l = h :: t @ l

⊦ ∀s t. (∀x. x ∈ s ⇔ x ∈ t) ⇔ s = t

⊦ ∀s t. (∀x. x ∈ s ⇔ x ∈ t) ⇒ s = t

⊦ ∀p x. (∀y. p y ⇔ y = x) ⇒ (select) p = x

⊦ ∀r. (∀x. ∃y. r x y) ⇔ ∃f. ∀x. r x (f x)

⊦ ∀m n. m ≤ suc n ⇔ m = suc n ∨ m ≤ n

⊦ ∀m n. m * n = 0 ⇔ m = 0 ∨ n = 0

⊦ ∀p. p 0 ∧ (∀n. p n ⇒ p (suc n)) ⇒ ∀n. p n

⊦ ∀m n. m ↑ n = 0 ⇔ m = 0 ∧ ¬(n = 0)

⊦ ∀p x. x ∈ { y. y | p y } ⇔ p x

⊦ ∀m n p. m * (n + p) = m * n + m * p

⊦ ∀m n p. m ↑ (n + p) = m ↑ n * m ↑ p

⊦ ∀m n p. (m + n) * p = m * p + n * p

⊦ (∃!) = λp. (∃) p ∧ ∀x y. p x ∧ p y ⇒ x = y

⊦ ∀l x. member x l ⇔ ∃i. i < length l ∧ x = nth l i

⊦ ∀p q. (∀x. p x ∧ q x) ⇔ (∀x. p x) ∧ ∀x. q x

⊦ ∀p q. (∀x. p x ⇒ q x) ⇒ (∀x. p x) ⇒ ∀x. q x

⊦ ∀p q. (∀x. p x ⇒ q x) ⇒ (∃x. p x) ⇒ ∃x. q x

⊦ ∀p q. (∀x. p x) ∧ (∀x. q x) ⇔ ∀x. p x ∧ q x

⊦ ∀p q. (∃x. p x) ∨ (∃x. q x) ⇔ ∃x. p x ∨ q x

⊦ ∀e f. ∃!fn. fn 0 = e ∧ ∀n. fn (suc n) = f (fn n) n

⊦ ∀h t n. n < length t ⇒ nth (h :: t) (suc n) = nth t n

⊦ ∀m n p. m * n = m * p ⇔ m = 0 ∨ n = p

⊦ ∀m n p. m * n ≤ m * p ⇔ m = 0 ∨ n ≤ p

⊦ ∀l n. bit (Bits.toWord l) n ⇔ n < width ∧ n < length l ∧ nth l n

⊦ ∀m n p. m * n < m * p ⇔ ¬(m = 0) ∧ n < p

⊦ ∀a b a' b'. (a, b) = (a', b') ⇔ a = a' ∧ b = b'

⊦ ∀p1 p2 q1 q2. (p1 ⇒ p2) ∧ (q1 ⇒ q2) ⇒ p1 ∧ q1 ⇒ p2 ∧ q2

⊦ ∀p1 p2 q1 q2. (p1 ⇒ p2) ∧ (q1 ⇒ q2) ⇒ p1 ∨ q1 ⇒ p2 ∨ q2

⊦ ∀p. (∀x. ∃!y. p x y) ⇔ ∃f. ∀x y. p x y ⇔ f x = y

⊦ ∀l.
    Bits.fromWord (Bits.toWord l) =
    if length l ≤ width then l @ replicate ⊥ (width - length l)
    else take width l

⊦ ∀p c x y. p (if c then x else y) ⇔ (c ⇒ p x) ∧ (¬c ⇒ p y)

⊦ ∀p. (∃!x. p x) ⇔ (∃x. p x) ∧ ∀x x'. p x ∧ p x' ⇒ x = x'

⊦ ∀f l1 l2 n. length l1 = n ∧ length l2 = n ⇒ length (zipWith f l1 l2) = n

⊦ ∀q h1 h2 t1 t2.
    Bits.compare q (h1 :: t1) (h2 :: t2) ⇔
    Bits.compare (¬h1 ∧ h2 ∨ ¬(h1 ∧ ¬h2) ∧ q) t1 t2

⊦ ∀f l1 l2 n i.
    length l1 = n ∧ length l2 = n ∧ i < n ⇒
    nth (zipWith f l1 l2) i = f (nth l1 i) (nth l2 i)

⊦ ∀w.
    ∃x0 x1 x2 x3 x4 x5 x6 x7 x8 x9.
      w =
      Bits.toWord
        (x0 :: x1 :: x2 :: x3 :: x4 :: x5 :: x6 :: x7 :: x8 :: x9 :: [])