source: C-semantics/Events.ma @ 82

(* *********************************************************************)
(*                                                                     *)
(*              The Compcert verified compiler                         *)
(*                                                                     *)
(*          Xavier Leroy, INRIA Paris-Rocquencourt                     *)
(*                                                                     *)
(*  Copyright Institut National de Recherche en Informatique et en     *)
(*  Automatique.  All rights reserved.  This file is distributed       *)
(*  under the terms of the GNU General Public License as published by  *)
(*  the Free Software Foundation, either version 2 of the License, or  *)
(*  (at your option) any later version.  This file is also distributed *)
(*  under the terms of the INRIA Non-Commercial License Agreement.     *)
(*                                                                     *)
(* *********************************************************************)

(* * Representation of observable events and execution traces. *)
(*
Require Import Coqlib.
*)
include "AST.ma".
include "Integers.ma".
include "Floats.ma".
include "Values.ma".
include "datatypes/list.ma".
include "extralib.ma".

(* * The observable behaviour of programs is stated in terms of
  input/output events, which can also be thought of as system calls 
  to the operating system.  An event is generated each time an
  external function (see module AST) is invoked.  The event records
  the name of the external function, the arguments to the function
  invocation provided by the program, and the return value provided by
  the outside world (e.g. the operating system).  Arguments and values
  are either integers or floating-point numbers.  We currently do not
  allow pointers to be exchanged between the program and the outside
  world. *)

ninductive eventval: Type :=
  | EVint: int -> eventval
  | EVfloat: float -> eventval.

nrecord event : Type := {
  ev_name: ident;
  ev_args: list eventval;
  ev_res: eventval
}.

(* * The dynamic semantics for programs collect traces of events.
  Traces are of two kinds: finite (type [trace]) or infinite (type [traceinf]). *)

ndefinition trace := list event.

ndefinition E0 : trace := nil ?.

ndefinition Eextcall : ident → list eventval → eventval → trace ≝
             λname: ident. λargs: list eventval. λres: eventval.
  mk_event name args res :: (nil ?).

ndefinition Eapp : trace → trace → trace ≝ λt1,t2. t1 @ t2.

ncoinductive traceinf : Type :=
  | Econsinf: event -> traceinf -> traceinf.

nlet rec Eappinf (t: trace) (T: traceinf) on t : traceinf :=
  match t with
  [ nil => T
  | cons ev t' => Econsinf ev (Eappinf t' T)
  ].

(* * Concatenation of traces is written [**] in the finite case
  or [***] in the infinite case. *)

notation "hvbox(l1 break ⧺ l2)"
  right associative with precedence 47
  for @{'doubleplus $l1 $l2 }.

notation "hvbox(l1 break ⧻ l2)"
  right associative with precedence 47
  for @{'tripleplus $l1 $l2 }.

interpretation "trace concatenation" 'doubleplus l1 l2 = (Eapp l1 l2).
interpretation "infinite trace concatenation" 'tripleplus l1 l2 = (Eappinf l1 l2).
(*
Infix "**" := Eapp (at level 60, right associativity).
Infix "***" := Eappinf (at level 60, right associativity).
*)
nlemma E0_left: ∀t. E0 ⧺ t = t.
//; nqed.

nlemma E0_right: ∀t. t ⧺ E0 = t.
napply append_nil; nqed.

nlemma Eapp_assoc: ∀t1,t2,t3. (t1 ⧺ t2) ⧺ t3 = t1 ⧺ (t2 ⧺ t3).
napply associative_append; nqed.

nlemma Eapp_E0_inv: ∀t1,t2. t1 ⧺ t2 = E0 → t1 = E0 ∧ t2 = E0.
napply nil_append_nil_both; nqed.
  
nlemma E0_left_inf: ∀T. E0 ⧻ T = T.
//; nqed. 

nlemma Eappinf_assoc: ∀t1,t2,T. (t1 ⧺ t2) ⧻ T = t1 ⧻ (t2 ⧻ T).
#t1; nelim t1; #t2 T; nnormalize; //; nqed.

(*
Hint Rewrite E0_left E0_right Eapp_assoc
             E0_left_inf Eappinf_assoc: trace_rewrite.

Opaque trace E0 Eextcall Eapp Eappinf.

(** The following [traceEq] tactic proves equalities between traces
  or infinite traces. *)

Ltac substTraceHyp :=
  match goal with
  | [ H: (@eq trace ?x ?y) |- _ ] =>
       subst x || clear H
  end.

Ltac decomposeTraceEq :=
  match goal with
  | [ |- (_ ** _) = (_ ** _) ] =>
      apply (f_equal2 Eapp); auto; decomposeTraceEq
  | _ =>
      auto
  end.

Ltac traceEq := 
  repeat substTraceHyp; autorewrite with trace_rewrite; decomposeTraceEq.
*)
(* * The predicate [event_match ef vargs t vres] expresses that
  the event [t] is generated when invoking external function [ef]
  with arguments [vargs], and obtaining [vres] as a return value
  from the operating system. *)

ninductive eventval_match: eventval -> typ -> val -> Prop :=
  | ev_match_int:
      ∀i. eventval_match (EVint i) Tint (Vint i)
  | ev_match_float:
      ∀f. eventval_match (EVfloat f) Tfloat (Vfloat f).

ninductive eventval_list_match: list eventval -> list typ -> list val -> Prop :=
  | evl_match_nil:
      eventval_list_match (nil ?) (nil ?) (nil ?)
  | evl_match_cons:
      ∀ev1,evl,ty1,tyl,v1,vl.
      eventval_match ev1 ty1 v1 ->
      eventval_list_match evl tyl vl ->
      eventval_list_match (ev1::evl) (ty1::tyl) (v1::vl).

ninductive event_match:
         external_function -> list val -> trace -> val -> Prop :=
  event_match_intro:
    ∀ef,vargs,vres,eargs,eres.
    eventval_list_match eargs (sig_args (ef_sig ef)) vargs ->
    eventval_match eres (proj_sig_res (ef_sig ef)) vres ->
    event_match ef vargs (Eextcall (ef_id ef) eargs eres) vres.
(*
(** The following section shows that [event_match] is stable under
  relocation of pointer values, as performed by memory injections
  (see module [Mem]). *)

Require Import Mem.

Section EVENT_MATCH_INJECT.

Variable f: meminj.

Remark eventval_match_inject:
  forall ev ty v1,  eventval_match ev ty v1 ->
  forall v2, val_inject f v1 v2 ->
  eventval_match ev ty v2.
Proof.
  induction 1; intros; inversion H; constructor.
Qed.

Remark eventval_list_match_inject:
  forall evl tyl vl1,  eventval_list_match evl tyl vl1 ->
  forall vl2, val_list_inject f vl1 vl2 ->
  eventval_list_match evl tyl vl2.
Proof.
  induction 1; intros.
  inversion H; constructor. 
  inversion H1; constructor. 
  eapply eventval_match_inject; eauto.
  eauto.
Qed.

Lemma event_match_inject:
  forall ef args1 t res args2,
  event_match ef args1 t res ->
  val_list_inject f args1 args2 ->
  event_match ef args2 t res /\ val_inject f res res.
Proof.
  intros. inversion H; subst. 
  split. constructor. eapply eventval_list_match_inject; eauto. auto.
  inversion H2; constructor.
Qed.

End EVENT_MATCH_INJECT.

(** The following section shows that [event_match] is stable under
  replacement of [Vundef] values by more defined values. *)

Section EVENT_MATCH_LESSDEF.

Remark eventval_match_lessdef:
  forall ev ty v1,  eventval_match ev ty v1 ->
  forall v2, Val.lessdef v1 v2 ->
  eventval_match ev ty v2.
Proof.
  induction 1; intros; inv H; constructor.
Qed.

Remark eventval_list_match_moredef:
  forall evl tyl vl1, eventval_list_match evl tyl vl1 ->
  forall vl2, Val.lessdef_list vl1 vl2 ->
  eventval_list_match evl tyl vl2.
Proof.
  induction 1; intros.
  inversion H; constructor. 
  inversion H1; constructor. 
  eapply eventval_match_lessdef; eauto.
  eauto.
Qed.

Lemma event_match_lessdef:
  forall ef args1 t res1 args2,
  event_match ef args1 t res1 ->
  Val.lessdef_list args1 args2 ->
  exists res2, event_match ef args2 t res2 /\ Val.lessdef res1 res2.
Proof.
  intros. inversion H; subst. exists res1; split. 
  constructor. eapply eventval_list_match_moredef; eauto. auto.
  auto.
Qed.

End EVENT_MATCH_LESSDEF.

(** Bisimilarity between infinite traces. *)

CoInductive traceinf_sim: traceinf -> traceinf -> Prop :=
  | traceinf_sim_cons: forall e T1 T2,
      traceinf_sim T1 T2 ->
      traceinf_sim (Econsinf e T1) (Econsinf e T2).

Lemma traceinf_sim_refl:
  forall T, traceinf_sim T T.
Proof.
  cofix COINDHYP; intros.
  destruct T. constructor. apply COINDHYP.
Qed.
 
Lemma traceinf_sim_sym:
  forall T1 T2, traceinf_sim T1 T2 -> traceinf_sim T2 T1.
Proof.
  cofix COINDHYP; intros. inv H; constructor; auto.
Qed.

Lemma traceinf_sim_trans:
  forall T1 T2 T3, 
  traceinf_sim T1 T2 -> traceinf_sim T2 T3 -> traceinf_sim T1 T3.
Proof.
  cofix COINDHYP;intros. inv H; inv H0; constructor; eauto.
Qed.

(** The "is prefix of" relation between a finite and an infinite trace. *)

Inductive traceinf_prefix: trace -> traceinf -> Prop :=
  | traceinf_prefix_nil: forall T,
      traceinf_prefix nil T
  | traceinf_prefix_cons: forall e t1 T2,
      traceinf_prefix t1 T2 ->
      traceinf_prefix (e :: t1) (Econsinf e T2).

(*
Lemma traceinf_prefix_compat:
  forall T1 T2 T1' T2',
  traceinf_prefix T1 T2 -> traceinf_sim T1 T1' -> traceinf_sim T2 T2' ->
  traceinf_prefix T1' T2'.
Proof.
  cofix COINDHYP; intros.
  inv H; inv H0; inv H1; constructor; eapply COINDHYP; eauto.
Qed.

Transparent trace E0 Eapp Eappinf.
*)

Lemma traceinf_prefix_app:
  forall t1 T2 t,
  traceinf_prefix t1 T2 ->
  traceinf_prefix (t ** t1) (t *** T2).
Proof.
  induction t; simpl; intros. auto.
  change ((a :: t) ** t1) with (a :: (t ** t1)).
  change ((a :: t) *** T2) with (Econsinf a (t *** T2)).
  constructor. auto.
Qed.

*)