source: src/ASM/ASMCosts.ma @ 1645

Last change on this file since 1645 was 1645, checked in by mulligan, 8 years ago

more progress on the ASMCosts work: block_costs is now complete (subject to inhabiting the type of the subaddressing_mode eliminator). pushing on through file propagating changes and fixing type errors

File size: 28.6 KB
Line 
1include "ASM/ASM.ma".
2include "ASM/Arithmetic.ma".
3include "ASM/Fetch.ma".
4include "ASM/Interpret.ma".
5include "common/StructuredTraces.ma".
6
7definition current_instruction0 ≝
8  λmem,pc. \fst (\fst (fetch … mem pc)).
9
10definition current_instruction ≝
11 λs:Status. current_instruction0 (code_memory … s) (program_counter … s).
12
13definition ASM_classify0: instruction → status_class ≝
14 λi.
15  match i with
16   [ RealInstruction pre ⇒
17     match pre with
18      [ RET ⇒ cl_return
19      | JZ _ ⇒ cl_jump
20      | JNZ _ ⇒ cl_jump
21      | JC _ ⇒ cl_jump
22      | JNC _ ⇒ cl_jump
23      | JB _ _ ⇒ cl_jump
24      | JNB _ _ ⇒ cl_jump
25      | JBC _ _ ⇒ cl_jump
26      | CJNE _ _ ⇒ cl_jump
27      | DJNZ _ _ ⇒ cl_jump
28      | _ ⇒ cl_other
29      ]
30   | ACALL _ ⇒ cl_call
31   | LCALL _ ⇒ cl_call
32   | JMP _ ⇒ cl_call
33   | AJMP _ ⇒ cl_jump
34   | LJMP _ ⇒ cl_jump
35   | SJMP _ ⇒ cl_jump
36   | _ ⇒ cl_other
37   ].
38
39definition ASM_classify: Status → status_class ≝
40 λs.ASM_classify0 (current_instruction s).
41
42definition current_instruction_is_labelled ≝
43  λcost_labels: BitVectorTrie costlabel 16.
44  λs: Status.
45  let pc ≝ program_counter … s in
46    match lookup_opt … pc cost_labels with
47    [ None ⇒ False
48    | _    ⇒ True
49    ].
50
51definition label_of_current_instruction:
52 BitVectorTrie costlabel 16 → Status → list costlabel
53 ≝
54  λcost_labels,s.
55  let pc ≝ program_counter … s in
56    match lookup_opt … pc cost_labels with
57    [ None ⇒ []
58    | Some l ⇒ [l]
59    ].
60
61definition next_instruction_properly_relates_program_counters ≝
62  λbefore: Status.
63  λafter : Status.
64  let size ≝ current_instruction_cost before in
65  let pc_before ≝ program_counter … before in
66  let pc_after ≝ program_counter … after in
67  let sum ≝ \snd (half_add … pc_before (bitvector_of_nat … size)) in
68    sum = pc_after.
69
70definition ASM_abstract_status: BitVectorTrie costlabel 16 → abstract_status ≝
71 λcost_labels.
72  mk_abstract_status
73   Status
74   (λs,s'. (execute_1 s) = s')
75   (λs,class. ASM_classify s = class)
76   (current_instruction_is_labelled cost_labels)
77   next_instruction_properly_relates_program_counters.
78
79(* To be moved in ASM/arithmetic.ma *)
80definition addr16_of_addr11: Word → Word11 → Word ≝
81  λpc: Word.
82  λa: Word11.
83  let 〈pc_upper, ignore〉 ≝ split … 8 8 pc in
84  let 〈n1, n2〉 ≝ split … 4 4 pc_upper in
85  let 〈b123, b〉 ≝ split … 3 8 a in
86  let b1 ≝ get_index_v … b123 0 ? in
87  let b2 ≝ get_index_v … b123 1 ? in
88  let b3 ≝ get_index_v … b123 2 ? in
89  let p5 ≝ get_index_v … n2 0 ? in
90    (n1 @@ [[ p5; b1; b2; b3 ]]) @@ b.
91  //
92qed.
93
94let rec fetch_program_counter_n
95  (n: nat) (code_memory: BitVectorTrie Byte 16) (program_counter: Word)
96    on n: option Word ≝
97  match n with
98  [ O ⇒ Some … program_counter
99  | S n ⇒
100    match fetch_program_counter_n n code_memory program_counter with
101    [ None ⇒ None …
102    | Some tail_pc ⇒
103      let 〈instr, program_counter, ticks〉 ≝ fetch code_memory tail_pc in
104        if ltb (nat_of_bitvector … tail_pc) (nat_of_bitvector … program_counter) then
105          Some … program_counter
106        else
107          None Word (* XXX: overflow! *)
108    ]
109  ].
110   
111definition reachable_program_counter: BitVectorTrie Byte 16 → nat → Word → Prop ≝
112  λcode_memory: BitVectorTrie Byte 16.
113  λprogram_size: nat.
114  λprogram_counter: Word.
115    (∃n: nat. Some … program_counter = fetch_program_counter_n n code_memory (zero 16)) ∧
116        nat_of_bitvector 16 program_counter < program_size.
117
118axiom full_add_zero:
119  ∀n: nat.
120  ∀b: BitVector n.
121    \snd (full_add n (zero …) b false) = b.
122
123lemma half_add_zero:
124  ∀n: nat.
125  ∀b: BitVector n.
126    \snd (half_add n (zero …) b) = b.
127  #n #b
128  cases b
129  [1:
130    %
131  |2:
132    #n' #hd #tl
133    cases hd
134    whd in match half_add; normalize nodelta
135    >full_add_zero %
136  ]
137qed.
138   
139definition good_program: ∀code_memory: BitVectorTrie Byte 16. ∀total_program_size: nat. Prop ≝
140  λcode_memory: BitVectorTrie Byte 16.
141  λtotal_program_size: nat.
142  ∀program_counter: Word.
143  ∀good_program_counter_witness: reachable_program_counter code_memory total_program_size program_counter.
144  let 〈instruction, program_counter', ticks〉 ≝ fetch code_memory program_counter in
145    match instruction with
146    [ RealInstruction instr ⇒
147      match instr with
148      [ RET                    ⇒ True
149      | JC   relative          ⇒ True (* XXX: see below *)
150      | JNC  relative          ⇒ True (* XXX: see below *)
151      | JB   bit_addr relative ⇒ True
152      | JNB  bit_addr relative ⇒ True
153      | JBC  bit_addr relative ⇒ True
154      | JZ   relative          ⇒ True
155      | JNZ  relative          ⇒ True
156      | CJNE src_trgt relative ⇒ True
157      | DJNZ src_trgt relative ⇒ True
158      | _                      ⇒
159        nat_of_bitvector … program_counter < nat_of_bitvector … program_counter' ∧
160          nat_of_bitvector … program_counter' < total_program_size
161      ]
162    | LCALL addr         ⇒
163      match addr return λx. bool_to_Prop (is_in … [[ addr16 ]] x) → Prop with
164      [ ADDR16 addr ⇒ λaddr16: True.
165          reachable_program_counter code_memory total_program_size addr ∧
166            nat_of_bitvector … program_counter < nat_of_bitvector … program_counter' ∧
167              nat_of_bitvector … program_counter' < total_program_size
168      | _ ⇒ λother: False. ⊥
169      ] (subaddressing_modein … addr)
170    | ACALL addr         ⇒
171      match addr return λx. bool_to_Prop (is_in … [[ addr11 ]] x) → Prop with
172      [ ADDR11 addr ⇒ λaddr11: True.
173        let 〈pc_bu, pc_bl〉 ≝ split … 8 8 program_counter' in
174        let 〈thr, eig〉 ≝ split … 3 8 addr in
175        let 〈fiv, thr'〉 ≝ split … 5 3 pc_bu in
176        let new_program_counter ≝ (fiv @@ thr) @@ pc_bl in
177          reachable_program_counter code_memory total_program_size new_program_counter ∧
178            nat_of_bitvector … program_counter < nat_of_bitvector … program_counter' ∧
179              nat_of_bitvector … program_counter' < total_program_size
180      | _ ⇒ λother: False. ⊥
181      ] (subaddressing_modein … addr)
182    | AJMP  addr         ⇒
183      match addr return λx. bool_to_Prop (is_in … [[ addr11 ]] x) → Prop with
184      [ ADDR11 addr ⇒ λaddr11: True.
185        let 〈pc_bu, pc_bl〉 ≝ split … 8 8 program_counter' in
186        let 〈nu, nl〉 ≝ split … 4 4 pc_bu in
187        let bit ≝ get_index' … O ? nl in
188        let 〈relevant1, relevant2〉 ≝ split … 3 8 addr in
189        let new_addr ≝ (nu @@ (bit ::: relevant1)) @@ relevant2 in
190        let 〈carry, new_program_counter〉 ≝ half_add 16 program_counter new_addr in
191          reachable_program_counter code_memory total_program_size new_program_counter
192      | _ ⇒ λother: False. ⊥
193      ] (subaddressing_modein … addr)
194    | LJMP  addr         ⇒
195      match addr return λx. bool_to_Prop (is_in … [[ addr16 ]] x) → Prop with
196      [ ADDR16 addr ⇒ λaddr16: True.
197          reachable_program_counter code_memory total_program_size addr
198      | _ ⇒ λother: False. ⊥
199      ] (subaddressing_modein … addr)
200    | SJMP  addr     ⇒
201      match addr return λx. bool_to_Prop (is_in … [[ relative ]] x) → Prop with
202      [ RELATIVE addr ⇒ λrelative: True.
203        let 〈carry, new_program_counter〉 ≝ half_add … program_counter' (sign_extension addr) in
204          reachable_program_counter code_memory total_program_size new_program_counter
205      | _ ⇒ λother: False. ⊥
206      ] (subaddressing_modein … addr)
207    | JMP   addr     ⇒ (* XXX: JMP is used for fptrs and unconstrained *)
208      nat_of_bitvector … program_counter < nat_of_bitvector … program_counter' ∧
209        nat_of_bitvector … program_counter' < total_program_size
210    | MOVC  src trgt ⇒
211        nat_of_bitvector … program_counter < nat_of_bitvector … program_counter' ∧
212          nat_of_bitvector … program_counter' < total_program_size
213    ].
214  cases other
215qed.
216
217lemma is_in_tail_to_is_in_cons_hd_tl:
218  ∀n: nat.
219  ∀the_vect: Vector addressing_mode_tag n.
220  ∀h: addressing_mode_tag.
221  ∀element: addressing_mode.
222    is_in n the_vect element → is_in (S n) (h:::the_vect) element.
223  #n #the_vect #h #element #assm
224  normalize cases (is_a h element) normalize nodelta
225  //
226qed.
227
228lemma is_in_subvector_is_in_supervector:
229  ∀m, n: nat.
230  ∀subvector: Vector addressing_mode_tag m.
231  ∀supervector: Vector addressing_mode_tag n.
232  ∀element: addressing_mode.
233    subvector_with … eq_a subvector supervector →
234      is_in m subvector element → is_in n supervector element.
235  #m #n #subvector #supervector #element
236  elim subvector
237  [1:
238    #subvector_proof #is_in_proof
239    normalize in is_in_proof; cases is_in_proof
240  |2:
241    #n' #addressing_mode_tag #tail #ind_hyp #subvector_proof #is_in_proof
242    @ind_hyp
243    cases daemon (* XXX *)
244  ]
245qed.
246
247let rec member_addressing_mode_tag
248  (n: nat) (v: Vector addressing_mode_tag n) (a: addressing_mode_tag)
249    on v: Prop ≝
250  match v with
251  [ VEmpty ⇒ False
252  | VCons n' hd tl ⇒
253      bool_to_Prop (eq_a hd a) ∨ member_addressing_mode_tag n' tl a
254  ].
255 
256let rec subaddressing_mode_elim_type
257  (T: Type[2]) (m: nat) (fixed_v: Vector addressing_mode_tag m)
258    (Q: addressing_mode → T → Prop)
259      (p_addr11:            ∀w: Word11.      is_in m fixed_v (ADDR11 w)        → T)
260      (p_addr16:            ∀w: Word.        is_in m fixed_v (ADDR16 w)        → T)
261      (p_direct:            ∀w: Byte.        is_in m fixed_v (DIRECT w)        → T)
262      (p_indirect:          ∀w: Bit.         is_in m fixed_v (INDIRECT w)      → T)
263      (p_ext_indirect:      ∀w: Bit.         is_in m fixed_v (EXT_INDIRECT w)  → T)
264      (p_acc_a:                              is_in m fixed_v ACC_A             → T)
265      (p_register:          ∀w: BitVector 3. is_in m fixed_v (REGISTER w)      → T)
266      (p_acc_b:                              is_in m fixed_v ACC_B             → T)
267      (p_dptr:                               is_in m fixed_v DPTR              → T)
268      (p_data:              ∀w: Byte.        is_in m fixed_v (DATA w)          → T)
269      (p_data16:            ∀w: Word.        is_in m fixed_v (DATA16 w)        → T)
270      (p_acc_dptr:                           is_in m fixed_v ACC_DPTR          → T)
271      (p_acc_pc:                             is_in m fixed_v ACC_PC            → T)
272      (p_ext_indirect_dptr:                  is_in m fixed_v EXT_INDIRECT_DPTR → T)
273      (p_indirect_dptr:                      is_in m fixed_v INDIRECT_DPTR     → T)
274      (p_carry:                              is_in m fixed_v CARRY             → T)
275      (p_bit_addr:          ∀w: Byte.        is_in m fixed_v (BIT_ADDR w)      → T)
276      (p_n_bit_addr:        ∀w: Byte.        is_in m fixed_v (N_BIT_ADDR w)    → T)
277      (p_relative:          ∀w: Byte.        is_in m fixed_v (RELATIVE w)      → T)
278        (n: nat) (v: Vector addressing_mode_tag n) (proof: subvector_with … eq_a v fixed_v)
279      on v: Prop ≝
280  match v return λo: nat. λv': Vector addressing_mode_tag o. o = n → v ≃ v' → ? with
281  [ VEmpty         ⇒ λm_refl. λv_refl.
282      ∀addr: addressing_mode. ∀p: is_in m fixed_v addr.
283        Q addr (
284        match addr return λx: addressing_mode. is_in … fixed_v x → T with 
285        [ ADDR11 x          ⇒ p_addr11 x
286        | ADDR16 x          ⇒ p_addr16 x
287        | DIRECT x          ⇒ p_direct x
288        | INDIRECT x        ⇒ p_indirect x
289        | EXT_INDIRECT x    ⇒ p_ext_indirect x
290        | ACC_A             ⇒ p_acc_a
291        | REGISTER x        ⇒ p_register x
292        | ACC_B             ⇒ p_acc_b
293        | DPTR              ⇒ p_dptr
294        | DATA x            ⇒ p_data x
295        | DATA16 x          ⇒ p_data16 x
296        | ACC_DPTR          ⇒ p_acc_dptr
297        | ACC_PC            ⇒ p_acc_pc
298        | EXT_INDIRECT_DPTR ⇒ p_ext_indirect_dptr
299        | INDIRECT_DPTR     ⇒ p_indirect_dptr
300        | CARRY             ⇒ p_carry
301        | BIT_ADDR x        ⇒ p_bit_addr x
302        | N_BIT_ADDR x      ⇒ p_n_bit_addr x
303        | RELATIVE x        ⇒ p_relative x
304        ] p)
305  | VCons n' hd tl ⇒ λm_refl. λv_refl.
306    let tail_call ≝ subaddressing_mode_elim_type T m fixed_v Q p_addr11
307      p_addr16 p_direct p_indirect p_ext_indirect p_acc_a
308        p_register p_acc_b p_dptr p_data p_data16 p_acc_dptr
309          p_acc_pc p_ext_indirect_dptr p_indirect_dptr p_carry
310            p_bit_addr p_n_bit_addr p_relative n' tl ?
311    in
312    match hd return λa: addressing_mode_tag. a = hd → ? with
313    [ addr11            ⇒ λhd_refl. (∀w. Q (ADDR11 w) (p_addr11 w ?)) → tail_call
314    | addr16            ⇒ λhd_refl. (∀w. Q (ADDR16 w) (p_addr16 w ?)) → tail_call
315    | direct            ⇒ λhd_refl. (∀w. Q (DIRECT w) (p_direct w ?)) → tail_call
316    | indirect          ⇒ λhd_refl. (∀w. Q (INDIRECT w) (p_indirect w ?)) → tail_call
317    | ext_indirect      ⇒ λhd_refl. (∀w. Q (EXT_INDIRECT w) (p_ext_indirect w ?)) → tail_call
318    | acc_a             ⇒ λhd_refl. (Q ACC_A (p_acc_a ?)) → tail_call
319    | registr           ⇒ λhd_refl. (∀w. Q (REGISTER w) (p_register w ?)) → tail_call
320    | acc_b             ⇒ λhd_refl. (Q ACC_A (p_acc_b ?)) → tail_call
321    | dptr              ⇒ λhd_refl. (Q DPTR (p_dptr ?)) → tail_call
322    | data              ⇒ λhd_refl. (∀w. Q (DATA w) (p_data w ?)) → tail_call
323    | data16            ⇒ λhd_refl. (∀w. Q (DATA16 w) (p_data16 w ?)) → tail_call
324    | acc_dptr          ⇒ λhd_refl. (Q ACC_DPTR (p_acc_dptr ?)) → tail_call
325    | acc_pc            ⇒ λhd_refl. (Q ACC_PC (p_acc_pc ?)) → tail_call
326    | ext_indirect_dptr ⇒ λhd_refl. (Q EXT_INDIRECT_DPTR (p_ext_indirect_dptr ?)) → tail_call
327    | indirect_dptr     ⇒ λhd_refl. (Q INDIRECT_DPTR (p_indirect_dptr ?)) → tail_call
328    | carry             ⇒ λhd_refl. (Q CARRY (p_carry ?)) → tail_call
329    | bit_addr          ⇒ λhd_refl. (∀w. Q (BIT_ADDR w) (p_bit_addr w ?)) → tail_call
330    | n_bit_addr        ⇒ λhd_refl. (∀w. Q (N_BIT_ADDR w) (p_n_bit_addr w ?)) → tail_call
331    | relative          ⇒ λhd_refl. (∀w. Q (RELATIVE w) (p_relative w ?)) → tail_call
332    ] (refl … hd)
333  ] (refl … n) (refl_jmeq … v).
334  [20:
335    generalize in match proof; destruct
336    whd in match (subvector_with … eq_a (hd:::tl) fixed_v);
337    cases (mem … eq_a m fixed_v hd) normalize nodelta
338    [1:
339      whd in match (subvector_with … eq_a tl fixed_v);
340      #assm assumption
341    |2:
342      normalize in ⊢ (% → ?);
343      #absurd cases absurd
344    ]
345  ]
346  @(is_in_subvector_is_in_supervector n m v fixed_v … proof)
347  destruct @I
348qed.
349
350lemma subaddressing_mode_elim':
351  ∀T: Type[2].
352  ∀n: nat.
353  ∀o: nat.
354  ∀Q: addressing_mode → T → Prop.
355  ∀fixed_v: Vector addressing_mode_tag (n + o).
356  ∀P1,P2,P3,P4,P5,P6,P7,P8,P9,P10,P11,P12,P13,P14,P15,P16,P17,P18,P19.
357  ∀v1: Vector addressing_mode_tag n.
358  ∀v2: Vector addressing_mode_tag o.
359  ∀fixed_v_proof: fixed_v = v1 @@ v2.
360  ∀subaddressing_mode_proof.
361    subaddressing_mode_elim_type T (n + o) fixed_v Q P1 P2 P3 P4 P5 P6 P7
362      P8 P9 P10 P11 P12 P13 P14 P15 P16 P17 P18 P19 (n + o) (v1 @@ v2) subaddressing_mode_proof.
363  #T #n #o #Q #fixed_v #P1 #P2 #P3 #P4 #P5 #P6 #P7 #P8 #P9 #P10
364  #P11 #P12 #P13 #P14 #P15 #P16 #P17 #P18 #P19 #v1 #v2 #fixed_v_proof
365  cases daemon
366qed.
367
368axiom subaddressing_mode_elim:
369  ∀T: Type[2].
370  ∀m: nat.
371  ∀n: nat.
372  ∀Q: addressing_mode → T → Prop.
373  ∀fixed_v: Vector addressing_mode_tag m.
374  ∀P1,P2,P3,P4,P5,P6,P7,P8,P9,P10,P11,P12,P13,P14,P15,P16,P17,P18,P19.
375  ∀v: Vector addressing_mode_tag n.
376  ∀proof.
377    subaddressing_mode_elim_type T m fixed_v Q P1 P2 P3 P4 P5 P6 P7
378      P8 P9 P10 P11 P12 P13 P14 P15 P16 P17 P18 P19 n v proof.
379
380(*
381lemma subaddressing_mode_elim:
382  ∀T:Type[2].
383  ∀P1: Word11 → T.
384  ∀P2,P3,P4,P5,P6,P7,P8,P9,P10,P11,P12,P13,P14,P15,P16,P17,P18,P19: False → T.
385  ∀addr: addressing_mode.
386  ∀p: is_in 1 [[ addr11 ]] addr.
387  ∀Q: addressing_mode → T → Prop.
388    (∀w. Q (ADDR11 w) (P1 w)) →
389      Q addr (
390        match addr return λx:addressing_mode. (is_in 1 [[addr11]] x → T) with 
391        [ ADDR11 (x:Word11) ⇒ λH:True. P1 x
392        | ADDR16 _ ⇒ λH:False. P2 H
393        | DIRECT _ ⇒ λH:False. P3 H
394        | INDIRECT _ ⇒ λH:False. P4 H
395        | EXT_INDIRECT _ ⇒ λH:False. P5 H
396        | ACC_A ⇒ λH:False. P6 H
397        | REGISTER _ ⇒ λH:False. P7 H
398        | ACC_B ⇒ λH:False. P8 H
399        | DPTR ⇒ λH:False. P9 H
400        | DATA _ ⇒ λH:False. P10 H
401        | DATA16 _ ⇒ λH:False. P11 H
402        | ACC_DPTR ⇒ λH:False. P12 H
403        | ACC_PC ⇒ λH:False. P13 H
404        | EXT_INDIRECT_DPTR ⇒ λH:False. P14 H
405        | INDIRECT_DPTR ⇒ λH:False. P15 H
406        | CARRY ⇒ λH:False. P16 H
407        | BIT_ADDR _ ⇒ λH:False. P17 H
408        | N_BIT_ADDR _ ⇒ λH:False. P18 H   
409        | RELATIVE _ ⇒ λH:False. P19 H
410        ] p).
411  #T #P1 #P2 #P3 #P4 #P5 #P6 #P7 #P8 #P9 #P10 #P11 #P12 #P13
412  #P14 #P15 #P16 #P17 #P18 #P19
413  * try #x1 try #x2 try #x3 try #x4
414  try (@⊥ assumption) normalize @x4
415qed. *)
416
417include alias "arithmetics/nat.ma".
418
419lemma lt_n_o_to_plus_m_n_lt_plus_m_o:
420  ∀m, n, o: nat.
421    n < o → m + n < m + o.
422  #m #n #o #assm /2 by monotonic_le_plus_r/
423qed.   
424
425let rec block_cost
426  (code_memory: BitVectorTrie Byte 16) (program_counter: Word)
427    (program_size: nat) (total_program_size: nat) (cost_labels: BitVectorTrie costlabel 16)
428      (reachable_program_counter_witness: reachable_program_counter code_memory total_program_size program_counter)
429        (good_program_witness: good_program code_memory total_program_size)
430          on program_size: total_program_size ≤ program_size + nat_of_bitvector … program_counter → nat ≝
431  match program_size return λprogram_size: nat. total_program_size ≤ program_size + nat_of_bitvector … program_counter → nat with
432  [ O ⇒ λbase_case. ⊥
433  | S program_size' ⇒ λrecursive_case.
434    let 〈instruction, program_counter', ticks〉 as FETCH ≝ fetch code_memory program_counter in
435      match lookup_opt … program_counter' cost_labels return λx: option costlabel. nat with
436      [ None   ⇒
437        match instruction return λx. x = instruction → ? with
438        [ RealInstruction real_instruction ⇒ λreal_instruction_refl.
439          match real_instruction return λx. x = real_instruction → ? with
440          [ RET                    ⇒ λinstr. ticks
441          | JC   relative          ⇒ λinstr. ticks
442          | JNC  relative          ⇒ λinstr. ticks
443          | JB   bit_addr relative ⇒ λinstr. ticks
444          | JNB  bit_addr relative ⇒ λinstr. ticks
445          | JBC  bit_addr relative ⇒ λinstr. ticks
446          | JZ   relative          ⇒ λinstr. ticks
447          | JNZ  relative          ⇒ λinstr. ticks
448          | CJNE src_trgt relative ⇒ λinstr. ticks
449          | DJNZ src_trgt relative ⇒ λinstr. ticks
450          | _                      ⇒ λinstr.
451              ticks + block_cost code_memory program_counter' program_size' total_program_size cost_labels ? good_program_witness ?
452          ] (refl … real_instruction)
453        | ACALL addr     ⇒ λinstr.
454            ticks + block_cost code_memory program_counter' program_size' total_program_size cost_labels ? good_program_witness ?
455        | AJMP  addr     ⇒ λinstr. ticks
456        | LCALL addr     ⇒ λinstr.
457            ticks + block_cost code_memory program_counter' program_size' total_program_size cost_labels ? good_program_witness ?
458        | LJMP  addr     ⇒ λinstr. ticks
459        | SJMP  addr     ⇒ λinstr. ticks
460        | JMP   addr     ⇒ λinstr. (* XXX: actually a call due to use with fptrs *)
461            ticks + block_cost code_memory program_counter' program_size' total_program_size cost_labels ? good_program_witness ?
462        | MOVC  src trgt ⇒ λinstr.
463            ticks + block_cost code_memory program_counter' program_size' total_program_size cost_labels ? good_program_witness ?
464        ] (refl … instruction)
465      | Some _ ⇒ ticks
466      ]
467  ].
468  [1:
469    cases reachable_program_counter_witness #_ #hyp
470    @(absurd (total_program_size < total_program_size) … (not_le_Sn_n …))
471    @(le_to_lt_to_lt … base_case hyp)
472  |2:
473    cases reachable_program_counter_witness * #n #fetch_n_hyp #lt_hyp
474    lapply(good_program_witness program_counter reachable_program_counter_witness)
475      <FETCH normalize nodelta <instr normalize nodelta
476    @(subaddressing_mode_elim … [[addr11]] … [[addr11]]) [1: // ] #new_addr
477    cases (split … 8 8 program_counter') #pc_bu #pc_bl normalize nodelta
478    cases (split … 3 8 new_addr) #thr #eig normalize nodelta
479    cases (split … 5 3 pc_bu) #fiv #thr' normalize nodelta * * * * #n'
480    #_ #_ #program_counter_lt' #program_counter_lt_tps'     
481    @(transitive_le
482      total_program_size
483      ((S program_size') + nat_of_bitvector … program_counter)
484      (program_size' + nat_of_bitvector … program_counter') recursive_case)
485    normalize in match (S program_size' + nat_of_bitvector … program_counter);
486    >plus_n_Sm
487    @monotonic_le_plus_r
488    change with (
489      nat_of_bitvector … program_counter <
490        nat_of_bitvector … program_counter')
491    assumption
492  |3:
493    cases reachable_program_counter_witness * #n #fetch_n_hyp #lt_hyp
494    lapply(good_program_witness program_counter reachable_program_counter_witness)
495      <FETCH normalize nodelta <instr normalize nodelta
496    @(subaddressing_mode_elim … [[addr11]] … [[addr11]]) [1: // ] #new_addr
497    cases (split … 8 8 program_counter') #pc_bu #pc_bl normalize nodelta
498    cases (split … 3 8 new_addr) #thr #eig normalize nodelta
499    cases (split … 5 3 pc_bu) #fiv #thr' normalize nodelta * * * * #n'
500    #_ #_ #program_counter_lt' #program_counter_lt_tps'
501    %
502    [1:
503      %{(S n)} whd in ⊢ (???%); <fetch_n_hyp normalize nodelta
504      <FETCH normalize nodelta whd in match ltb; normalize nodelta
505      >(le_to_leb_true … program_counter_lt') %
506    |2:
507      assumption
508    ]
509  |4:
510    cases reachable_program_counter_witness * #n #fetch_n_hyp #lt_hyp
511    lapply(good_program_witness program_counter reachable_program_counter_witness)
512      <FETCH normalize nodelta <instr normalize nodelta
513    @(subaddressing_mode_elim … [[addr16]] … [[addr16]]) [1: // ] #new_addr
514    * * * * #n'
515    #_ #_ #program_counter_lt' #program_counter_lt_tps'     
516    @(transitive_le
517      total_program_size
518      ((S program_size') + nat_of_bitvector … program_counter)
519      (program_size' + nat_of_bitvector … program_counter') recursive_case)
520    normalize in match (S program_size' + nat_of_bitvector … program_counter);
521    >plus_n_Sm
522    @monotonic_le_plus_r
523    change with (
524      nat_of_bitvector … program_counter <
525        nat_of_bitvector … program_counter')
526    assumption
527  |5:
528    cases reachable_program_counter_witness * #n #fetch_n_hyp #lt_hyp
529    lapply(good_program_witness program_counter reachable_program_counter_witness)
530      <FETCH normalize nodelta <instr normalize nodelta
531    @(subaddressing_mode_elim … [[addr16]] … [[addr16]]) [1: // ] #new_addr
532    * * * * #n'
533    #_ #_ #program_counter_lt' #program_counter_lt_tps'
534    %
535    [1:
536      %{(S n)} whd in ⊢ (???%); <fetch_n_hyp normalize nodelta
537      <FETCH normalize nodelta whd in match ltb; normalize nodelta
538      >(le_to_leb_true … program_counter_lt') %
539    |2:
540      assumption
541    ]
542  |6,8: (* JMP and MOVC *)
543    cases reachable_program_counter_witness * #n #fetch_n_hyp #lt_hyp
544    lapply(good_program_witness program_counter reachable_program_counter_witness)
545    <FETCH normalize nodelta <instr normalize nodelta
546    try(<real_instruction_refl <instr normalize nodelta) *
547    #pc_pc_lt_hyp' #pc_tps_lt_hyp'
548    @(transitive_le
549      total_program_size
550      ((S program_size') + nat_of_bitvector … program_counter)
551      (program_size' + nat_of_bitvector … program_counter') recursive_case)
552    normalize in match (S program_size' + nat_of_bitvector … program_counter);
553    >plus_n_Sm
554    @monotonic_le_plus_r
555    change with (
556      nat_of_bitvector … program_counter <
557        nat_of_bitvector … program_counter')
558    assumption
559  |7,9:
560    cases reachable_program_counter_witness * #n #fetch_n_hyp #lt_hyp
561    lapply(good_program_witness program_counter reachable_program_counter_witness)
562    <FETCH normalize nodelta <instr normalize nodelta *
563    #program_counter_lt' #program_counter_lt_tps' %
564    [1,3:
565      %{(S n)} whd in ⊢ (???%); <fetch_n_hyp normalize nodelta
566      <FETCH normalize nodelta whd in match ltb; normalize nodelta
567      >(le_to_leb_true … program_counter_lt') %
568    |2,4:
569      assumption
570    ]
571  |11,13,15,17,19,21,23,25,27,29,31,33,35,37,39,41,43,45,47,49,51,53,
572    55,57,59,61,63:
573    cases reachable_program_counter_witness * #n #fetch_n_hyp #lt_hyp
574    lapply(good_program_witness program_counter reachable_program_counter_witness)
575    <FETCH normalize nodelta <real_instruction_refl <instr normalize nodelta *
576    #program_counter_lt' #program_counter_lt_tps' %
577    try assumption
578    [*:
579      %{(S n)} whd in ⊢ (???%); <fetch_n_hyp normalize nodelta
580      <FETCH normalize nodelta whd in match ltb; normalize nodelta
581      >(le_to_leb_true … program_counter_lt') %
582    ]
583  |10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,
584    54,56,58,60,62:
585    cases reachable_program_counter_witness * #n #fetch_n_hyp #lt_hyp
586    lapply(good_program_witness program_counter reachable_program_counter_witness)
587    <FETCH normalize nodelta
588    <real_instruction_refl <instr normalize nodelta *
589    #pc_pc_lt_hyp' #pc_tps_lt_hyp'
590    @(transitive_le
591      total_program_size
592      ((S program_size') + nat_of_bitvector … program_counter)
593      (program_size' + nat_of_bitvector … program_counter') recursive_case)
594    normalize in match (S program_size' + nat_of_bitvector … program_counter);
595    >plus_n_Sm
596    @monotonic_le_plus_r
597    change with (
598      nat_of_bitvector … program_counter <
599        nat_of_bitvector … program_counter')
600    assumption
601  ]
602qed.
603
604axiom fetch_program_counter_n_Sn:
605  ∀instruction: instruction.
606  ∀program_counter, program_counter': Word.
607  ∀ticks, n: nat.
608  ∀code_memory: BitVectorTrie Byte 16.
609    Some … program_counter = fetch_program_counter_n n code_memory (zero 16) →
610      〈instruction,program_counter',ticks〉 = fetch code_memory program_counter →
611        Some … program_counter' = fetch_program_counter_n (S n) code_memory (zero …).
612       
613let rec traverse_code_internal
614  (program: list Byte) (code_memory: BitVectorTrie Byte 16)
615    (cost_labels: BitVectorTrie costlabel 16) (program_counter: Word)
616      (program_size: nat) (reachable_program_counter_witness: reachable_program_counter code_memory program_size program_counter)
617        (good_program_witness: good_program code_memory program_size)
618          (n: nat) (fetch_program_counter_proof: Some … program_counter = fetch_program_counter_n n code_memory (zero …))
619        on program: identifier_map CostTag nat ≝
620  let 〈instruction, new_program_counter, ticks〉 as FETCH ≝ fetch … code_memory program_counter in
621  match program with
622  [ nil ⇒ empty_map …
623  | cons hd tl ⇒
624    match lookup_opt … program_counter cost_labels with
625    [ None ⇒ traverse_code_internal tl code_memory cost_labels new_program_counter program_size ? good_program_witness (S n) ?
626    | Some lbl ⇒
627      let cost ≝ block_cost code_memory program_counter program_size program_size cost_labels ? good_program_witness ? in
628      let cost_mapping ≝ traverse_code_internal tl code_memory cost_labels new_program_counter program_size ? good_program_witness (S n) ? in
629        add … cost_mapping lbl cost
630    ]
631  ].
632  [6:
633    //
634  |2,4:
635    @(fetch_program_counter_n_Sn instruction program_counter new_program_counter ticks n)
636    assumption
637  |5:
638    assumption
639  |1,3:
640    whd in match reachable_program_counter; normalize nodelta
641    @conj
642    [1,3:
643      %{(S n)}
644      @(fetch_program_counter_n_Sn instruction program_counter new_program_counter ticks n)
645      assumption
646    |2,4:
647      cases daemon (* XXX ??? *)
648    ]
649  ]
650qed.
651
652definition traverse_code ≝
653  λprogram: list Byte.
654  λcode_memory: BitVectorTrie Byte 16.
655  λcost_labels.
656  λprogram_size: nat.
657  λprogram_not_empty_proof: 0 < program_size.
658  λgood_program_witness: good_program code_memory program_size.
659    traverse_code_internal program code_memory cost_labels (zero …) program_size ? good_program_witness.
660  normalize @conj
661  [2:
662    assumption
663  |1:
664    %{0} %
665  ]
666qed.
667
668definition compute_costs ≝
669  λprogram: list Byte.
670  λcost_labels: BitVectorTrie costlabel 16.
671  λhas_main: bool.
672  λgood_program_witness: good_program (load_code_memory program) (|program| + 1).
673  λprogram_not_empty_proof: 0 < |program|.
674    let program_size ≝ |program| + 1 in
675    let code_memory ≝ load_code_memory program in
676      traverse_code program code_memory cost_labels program_size ?.
677  //
678qed.
Note: See TracBrowser for help on using the repository browser.