[3] | 1 | (* *********************************************************************) |
---|
| 2 | (* *) |
---|
| 3 | (* The Compcert verified compiler *) |
---|
| 4 | (* *) |
---|
| 5 | (* Xavier Leroy, INRIA Paris-Rocquencourt *) |
---|
| 6 | (* *) |
---|
| 7 | (* Copyright Institut National de Recherche en Informatique et en *) |
---|
| 8 | (* Automatique. All rights reserved. This file is distributed *) |
---|
| 9 | (* under the terms of the GNU General Public License as published by *) |
---|
| 10 | (* the Free Software Foundation, either version 2 of the License, or *) |
---|
| 11 | (* (at your option) any later version. This file is also distributed *) |
---|
| 12 | (* under the terms of the INRIA Non-Commercial License Agreement. *) |
---|
| 13 | (* *) |
---|
| 14 | (* *********************************************************************) |
---|
| 15 | |
---|
| 16 | (* * This module defines the type of values that is used in the dynamic |
---|
| 17 | semantics of all our intermediate languages. *) |
---|
| 18 | |
---|
[700] | 19 | include "utilities/Coqlib.ma". |
---|
[747] | 20 | include "common/AST.ma". |
---|
[700] | 21 | include "common/Floats.ma". |
---|
| 22 | include "common/Errors.ma". |
---|
[3] | 23 | |
---|
[744] | 24 | include "ASM/BitVectorZ.ma". |
---|
[636] | 25 | |
---|
[487] | 26 | include "basics/logic.ma". |
---|
[3] | 27 | |
---|
[747] | 28 | include "utilities/extralib.ma". |
---|
[744] | 29 | |
---|
[635] | 30 | (* To define pointers we need a few details about the memory model. |
---|
| 31 | |
---|
| 32 | There are several kinds of pointers, which differ in which regions of |
---|
| 33 | memory they address and the pointer's representation. |
---|
| 34 | |
---|
| 35 | Pointers are given as kind, block, offset triples, where a block identifies |
---|
| 36 | some memory in a given region with an arbitrary concrete address. A proof |
---|
| 37 | is also required that the representation is suitable for the region the |
---|
| 38 | memory resides in. Note that blocks cannot extend out of a region (in |
---|
| 39 | particular, a pdata pointer can address any byte in a pdata block - we never |
---|
| 40 | need to switch to a larger xdata pointer). |
---|
| 41 | *) |
---|
| 42 | |
---|
| 43 | (* blocks - represented by the region the memory resides in and a unique id *) |
---|
| 44 | |
---|
[498] | 45 | record block : Type[0] ≝ |
---|
| 46 | { block_region : region |
---|
| 47 | ; block_id : Z |
---|
| 48 | }. |
---|
[3] | 49 | |
---|
[496] | 50 | definition eq_block ≝ |
---|
| 51 | λb1,b2. |
---|
[498] | 52 | eq_region (block_region b1) (block_region b2) ∧ |
---|
| 53 | eqZb (block_id b1) (block_id b2) |
---|
| 54 | . |
---|
[496] | 55 | |
---|
| 56 | lemma eq_block_elim : ∀P:bool → Prop. ∀b1,b2. |
---|
| 57 | (b1 = b2 → P true) → (b1 ≠ b2 → P false) → |
---|
| 58 | P (eq_block b1 b2). |
---|
| 59 | #P * #r1 #i1 * #r2 #i2 #H1 #H2 |
---|
| 60 | whd in ⊢ (?%) @eq_region_elim #H3 |
---|
| 61 | [ whd in ⊢ (?%) @eqZb_elim [ /2/ | * #NE @H2 % #E @NE destruct % ] |
---|
| 62 | | @H2 % #E destruct elim H3 /2/ |
---|
| 63 | ] qed. |
---|
| 64 | |
---|
[891] | 65 | lemma eq_block_b_b : ∀b. eq_block b b = true. |
---|
| 66 | * * #z whd in ⊢ (??%?) >eqZb_z_z @refl |
---|
| 67 | qed. |
---|
| 68 | |
---|
[635] | 69 | (* Characterise the memory regions which the pointer representations can |
---|
| 70 | address. |
---|
[500] | 71 | |
---|
[635] | 72 | pointer_compat <block> <pointer representation> *) |
---|
| 73 | |
---|
[500] | 74 | inductive pointer_compat : block → region → Prop ≝ |
---|
| 75 | | same_compat : ∀s,id. pointer_compat (mk_block s id) s |
---|
| 76 | | pxdata_compat : ∀id. pointer_compat (mk_block PData id) XData |
---|
| 77 | | universal_compat : ∀r,id. pointer_compat (mk_block r id) Any. |
---|
| 78 | |
---|
| 79 | lemma pointer_compat_dec : ∀b,p. pointer_compat b p + ¬pointer_compat b p. |
---|
| 80 | * * #id *; |
---|
| 81 | try ( %1 // ) |
---|
| 82 | %2 % #H inversion H #e1 #e2 try #e3 try #e4 destruct |
---|
| 83 | qed. |
---|
| 84 | |
---|
| 85 | definition is_pointer_compat : block → region → bool ≝ |
---|
| 86 | λb,p. match pointer_compat_dec b p with [ inl _ ⇒ true | inr _ ⇒ false ]. |
---|
| 87 | |
---|
[635] | 88 | (* Offsets into the block. We allow integers like CompCert so that we have |
---|
| 89 | the option of extending blocks backwards. *) |
---|
| 90 | |
---|
[583] | 91 | record offset : Type[0] ≝ { offv : Z }. |
---|
| 92 | |
---|
| 93 | definition eq_offset ≝ λx,y. eqZb (offv x) (offv y). |
---|
[961] | 94 | definition shift_offset : ∀n. offset → BitVector n → offset ≝ |
---|
| 95 | λn,o,i. mk_offset (offv o + Z_of_signed_bitvector ? i). |
---|
| 96 | (* A version of shift_offset_n for multiplied addresses which avoids overflow. *) |
---|
| 97 | definition shift_offset_n : ∀n. offset → nat → BitVector n → offset ≝ |
---|
| 98 | λn,o,i,j. mk_offset (offv o + (Z_of_nat i)*(Z_of_signed_bitvector ? j)). |
---|
| 99 | definition neg_shift_offset : ∀n. offset → BitVector n → offset ≝ |
---|
| 100 | λn,o,i. mk_offset (offv o - Z_of_signed_bitvector ? i). |
---|
| 101 | definition neg_shift_offset_n : ∀n. offset → nat → BitVector n → offset ≝ |
---|
| 102 | λn,o,i,j. mk_offset (offv o - (Z_of_nat i) * (Z_of_signed_bitvector ? j)). |
---|
| 103 | definition sub_offset : ∀n. offset → offset → BitVector n ≝ |
---|
| 104 | λn,x,y. bitvector_of_Z ? (offv x - offv y). |
---|
[583] | 105 | definition zero_offset ≝ mk_offset OZ. |
---|
| 106 | definition lt_offset : offset → offset → bool ≝ |
---|
| 107 | λx,y. Zltb (offv x) (offv y). |
---|
| 108 | |
---|
[3] | 109 | (* * A value is either: |
---|
| 110 | - a machine integer; |
---|
| 111 | - a floating-point number; |
---|
[482] | 112 | - a pointer: a triple giving the representation of the pointer (in terms of the |
---|
| 113 | memory regions such a pointer could address), a memory address and |
---|
| 114 | an integer offset with respect to this address; |
---|
[484] | 115 | - a null pointer: the region denotes the representation (i.e., pointer size) |
---|
[3] | 116 | - the [Vundef] value denoting an arbitrary bit pattern, such as the |
---|
| 117 | value of an uninitialized variable. |
---|
| 118 | *) |
---|
| 119 | |
---|
[487] | 120 | inductive val: Type[0] ≝ |
---|
[3] | 121 | | Vundef: val |
---|
[961] | 122 | | Vint: ∀sz:intsize. bvint sz → val |
---|
[482] | 123 | | Vfloat: float → val |
---|
[484] | 124 | | Vnull: region → val |
---|
[583] | 125 | | Vptr: ∀r:region. ∀b:block. pointer_compat b r → offset → val. |
---|
[3] | 126 | |
---|
[961] | 127 | definition Vzero : intsize → val ≝ λsz. Vint sz (zero ?). |
---|
| 128 | definition Vone: intsize → val ≝ λsz. Vint sz (repr sz 1). |
---|
| 129 | definition mone ≝ λsz. bitvector_of_Z (bitsize_of_intsize sz) (neg one). |
---|
| 130 | definition Vmone: intsize → val ≝ λsz. Vint sz (mone ?). |
---|
[3] | 131 | |
---|
[961] | 132 | (* XXX 32bit booleans are Clight specific. *) |
---|
| 133 | definition Vtrue: val ≝ Vone I32. |
---|
| 134 | definition Vfalse: val ≝ Vzero I32. |
---|
[3] | 135 | |
---|
[636] | 136 | (* Values split into bytes. Ideally we'd use some kind of sizeof for the |
---|
| 137 | predicates here, but we don't (currently) have a single sizeof for Vundef. |
---|
| 138 | We only split in stages of the compiler where all Vint values are byte sized. |
---|
| 139 | *) |
---|
| 140 | |
---|
| 141 | definition ptr_may_be_single : region → bool ≝ |
---|
| 142 | λr.match r with [ Data ⇒ true | IData ⇒ true | _ ⇒ false ]. |
---|
| 143 | |
---|
| 144 | definition may_be_single : val → Prop ≝ |
---|
| 145 | λv. match v with |
---|
| 146 | [ Vundef ⇒ True |
---|
[961] | 147 | | Vint _ _ ⇒ True |
---|
[636] | 148 | | Vfloat _ ⇒ False |
---|
| 149 | | Vnull r ⇒ ptr_may_be_single r = true |
---|
| 150 | | Vptr r _ _ _ ⇒ ptr_may_be_single r = true |
---|
| 151 | ]. |
---|
| 152 | |
---|
| 153 | definition may_be_split : val → Prop ≝ |
---|
| 154 | λv.match v with |
---|
[961] | 155 | [ Vint _ _ ⇒ False |
---|
[636] | 156 | | Vnull r ⇒ ptr_may_be_single r = false |
---|
| 157 | | Vptr r _ _ _ ⇒ ptr_may_be_single r = false |
---|
| 158 | | _ ⇒ True |
---|
| 159 | ]. |
---|
| 160 | |
---|
| 161 | inductive split_val : Type[0] ≝ |
---|
| 162 | | Single : ∀v:val. may_be_single v → split_val |
---|
| 163 | | High : ∀v:val. may_be_split v → split_val |
---|
| 164 | | Low : ∀v:val. may_be_split v → split_val. |
---|
| 165 | |
---|
| 166 | notation > "vbox('do' _ ← e; break e')" with precedence 40 for @{'bind ${e} (λ_.${e'})}. |
---|
[797] | 167 | (* |
---|
[636] | 168 | let rec assert_nat_eq (m,n:nat) : res (m = n) ≝ |
---|
| 169 | match m return λx.res (x = n) with |
---|
| 170 | [ O ⇒ match n return λx. res (O = x) with [ O ⇒ OK ? (refl ??) | _ ⇒ Error ? ] |
---|
| 171 | | S m' ⇒ match n return λx.res (S m' = x) with [ O ⇒ Error ? | S n' ⇒ |
---|
| 172 | do E ← assert_nat_eq m' n'; |
---|
| 173 | match E return λx.λ_. res (S m' = S x) with [ refl ⇒ OK ? (refl ??) ] ] |
---|
| 174 | ]. |
---|
| 175 | |
---|
| 176 | definition res_eq_nat : ∀m,n:nat. ∀P:nat → Type[0]. P m → res (P n) ≝ |
---|
| 177 | λm,n,P,p. |
---|
| 178 | do E ← assert_nat_eq m n; |
---|
| 179 | match E return λx.λ_. res (P x) with [ refl ⇒ OK ? p ]. |
---|
| 180 | |
---|
| 181 | definition break : ∀n:nat. val → res (Vector split_val n) ≝ |
---|
| 182 | λn,v. match v return λv'. (may_be_single v' → ?) → (may_be_split v' → ?) → ? with |
---|
| 183 | [ Vundef ⇒ λs.λt. res_eq_nat 1 n ? (s I) |
---|
| 184 | | Vint i ⇒ λs.λt. res_eq_nat 1 n ? (s I) |
---|
| 185 | | Vfloat f ⇒ λs.λt. res_eq_nat 2 n ? (t I) |
---|
| 186 | | Vnull r ⇒ |
---|
| 187 | match ptr_may_be_single r return λx. (x = true → ?) → (x = false → ?) → ? with |
---|
| 188 | [ true ⇒ λs.λt. res_eq_nat 1 n ? (s (refl ??)) |
---|
| 189 | | false ⇒ λs.λt. ? |
---|
| 190 | ] |
---|
| 191 | | Vptr r b p o ⇒ |
---|
| 192 | match ptr_may_be_single r return λx. (x = true → ?) → (x = false → ?) → ? with |
---|
| 193 | [ true ⇒ λs.λt. res_eq_nat 1 n ? (s (refl ??)) |
---|
| 194 | | false ⇒ λs.λt. ? |
---|
| 195 | ] |
---|
| 196 | ] (λp. [[ Single v p ]]) (λp. [[ Low v p; High v p ]]). |
---|
| 197 | @(res_eq_nat 2 n ? (t (refl ??))) qed. (* XXX: I have no idea why this fails if you do it directly. *) |
---|
| 198 | |
---|
| 199 | definition val_eq : val → val → bool ≝ |
---|
| 200 | λx,y. |
---|
| 201 | match x with |
---|
| 202 | [ Vundef ⇒ match y with [ Vundef ⇒ true | _ ⇒ false ] |
---|
| 203 | | Vint i ⇒ match y with [ Vint j ⇒ eq i j | _ ⇒ false ] |
---|
| 204 | | Vfloat f ⇒ match y with [ Vfloat f' ⇒ match eq_dec f f' with [ inl _ ⇒ true | _ ⇒ false ] | _ ⇒ false ] |
---|
| 205 | | Vnull r ⇒ match y with [ Vnull r' ⇒ eq_region r r' | _ ⇒ false ] |
---|
| 206 | | Vptr r b p o ⇒ match y with [ Vptr r' b' p' o' ⇒ eq_region r r' ∧ eq_block b b' ∧ eq_offset o o' | _ ⇒ false ] |
---|
| 207 | ]. |
---|
| 208 | |
---|
| 209 | definition merge : ∀n:nat. Vector split_val n → res val ≝ |
---|
| 210 | λn,s. match s with |
---|
| 211 | [ VEmpty ⇒ Error ? |
---|
| 212 | | VCons _ h1 t1 ⇒ |
---|
| 213 | match t1 with |
---|
| 214 | [ VEmpty ⇒ match h1 with [ Single v _ ⇒ OK ? v | _ ⇒ Error ? ] |
---|
| 215 | | VCons _ h2 t2 ⇒ |
---|
| 216 | match t2 with |
---|
| 217 | [ VEmpty ⇒ match h1 with [ Low v _ ⇒ match h2 with [ High v' _ ⇒ if val_eq v v' then OK ? v else Error ? | _ ⇒ Error ? ] | _ ⇒ Error ? ] |
---|
| 218 | | VCons _ _ _ ⇒ Error ? |
---|
| 219 | ] |
---|
| 220 | ] |
---|
| 221 | ]. |
---|
| 222 | |
---|
[797] | 223 | *) |
---|
[3] | 224 | (* |
---|
| 225 | (** The module [Val] defines a number of arithmetic and logical operations |
---|
| 226 | over type [val]. Most of these operations are straightforward extensions |
---|
| 227 | of the corresponding integer or floating-point operations. *) |
---|
| 228 | |
---|
| 229 | Module Val. |
---|
| 230 | *) |
---|
[487] | 231 | definition of_bool : bool → val ≝ λb. if b then Vtrue else Vfalse. |
---|
[484] | 232 | (* |
---|
[487] | 233 | definition has_type ≝ λv: val. λt: typ. |
---|
[3] | 234 | match v with |
---|
| 235 | [ Vundef ⇒ True |
---|
[478] | 236 | | Vint _ ⇒ match t with [ ASTint ⇒ True | _ ⇒ False ] |
---|
| 237 | | Vfloat _ ⇒ match t with [ ASTfloat ⇒ True | _ ⇒ False ] |
---|
[718] | 238 | | Vptr _ _ _ ⇒ match t with [ ASTptr ⇒ True | _ ⇒ False ] |
---|
[3] | 239 | | _ ⇒ False |
---|
| 240 | ]. |
---|
| 241 | |
---|
[487] | 242 | let rec has_type_list (vl: list val) (tl: list typ) on vl : Prop ≝ |
---|
[3] | 243 | match vl with |
---|
| 244 | [ nil ⇒ match tl with [ nil ⇒ True | _ ⇒ False ] |
---|
| 245 | | cons v1 vs ⇒ match tl with [ nil ⇒ False | cons t1 ts ⇒ |
---|
| 246 | has_type v1 t1 ∧ has_type_list vs ts ] |
---|
| 247 | ]. |
---|
[484] | 248 | *) |
---|
[3] | 249 | (* * Truth values. Pointers and non-zero integers are treated as [True]. |
---|
| 250 | The integer 0 (also used to represent the null pointer) is [False]. |
---|
| 251 | [Vundef] and floats are neither true nor false. *) |
---|
| 252 | |
---|
[487] | 253 | definition is_true : val → Prop ≝ λv. |
---|
[3] | 254 | match v with |
---|
[961] | 255 | [ Vint _ n ⇒ n ≠ (zero ?) |
---|
[500] | 256 | | Vptr _ b _ ofs ⇒ True |
---|
[3] | 257 | | _ ⇒ False |
---|
| 258 | ]. |
---|
| 259 | |
---|
[487] | 260 | definition is_false : val → Prop ≝ λv. |
---|
[3] | 261 | match v with |
---|
[961] | 262 | [ Vint _ n ⇒ n = (zero ?) |
---|
[484] | 263 | | Vnull _ ⇒ True |
---|
[3] | 264 | | _ ⇒ False |
---|
| 265 | ]. |
---|
| 266 | |
---|
[487] | 267 | inductive bool_of_val: val → bool → Prop ≝ |
---|
[3] | 268 | | bool_of_val_int_true: |
---|
[961] | 269 | ∀sz,n. n ≠ zero ? → bool_of_val (Vint sz n) true |
---|
[3] | 270 | | bool_of_val_int_false: |
---|
[961] | 271 | ∀sz. bool_of_val (Vzero sz) false |
---|
[3] | 272 | | bool_of_val_ptr: |
---|
[500] | 273 | ∀r,b,p,ofs. bool_of_val (Vptr r b p ofs) true |
---|
[484] | 274 | | bool_of_val_null: |
---|
| 275 | ∀r. bool_of_val (Vnull r) true. |
---|
[3] | 276 | |
---|
[797] | 277 | axiom ValueNotABoolean : String. |
---|
| 278 | |
---|
[751] | 279 | definition eval_bool_of_val : val → res bool ≝ |
---|
| 280 | λv. match v with |
---|
[961] | 281 | [ Vint _ i ⇒ OK ? (notb (eq_bv ? i (zero ?))) |
---|
[751] | 282 | | Vnull _ ⇒ OK ? false |
---|
| 283 | | Vptr _ _ _ _ ⇒ OK ? true |
---|
[797] | 284 | | _ ⇒ Error ? (msg ValueNotABoolean) |
---|
[751] | 285 | ]. |
---|
| 286 | |
---|
[487] | 287 | definition neg : val → val ≝ λv. |
---|
[3] | 288 | match v with |
---|
[961] | 289 | [ Vint sz n ⇒ Vint sz (two_complement_negation ? n) |
---|
[3] | 290 | | _ ⇒ Vundef |
---|
| 291 | ]. |
---|
| 292 | |
---|
[487] | 293 | definition negf : val → val ≝ λv. |
---|
[3] | 294 | match v with |
---|
| 295 | [ Vfloat f ⇒ Vfloat (Fneg f) |
---|
| 296 | | _ => Vundef |
---|
| 297 | ]. |
---|
| 298 | |
---|
[487] | 299 | definition absf : val → val ≝ λv. |
---|
[3] | 300 | match v with |
---|
| 301 | [ Vfloat f ⇒ Vfloat (Fabs f) |
---|
| 302 | | _ ⇒ Vundef |
---|
| 303 | ]. |
---|
| 304 | |
---|
[961] | 305 | definition intoffloat : intsize → val → val ≝ λsz,v. |
---|
[3] | 306 | match v with |
---|
[961] | 307 | [ Vfloat f ⇒ Vint sz (intoffloat ? f) |
---|
[3] | 308 | | _ ⇒ Vundef |
---|
| 309 | ]. |
---|
| 310 | |
---|
[961] | 311 | definition intuoffloat : intsize → val → val ≝ λsz,v. |
---|
[3] | 312 | match v with |
---|
[961] | 313 | [ Vfloat f ⇒ Vint sz (intuoffloat ? f) |
---|
[3] | 314 | | _ ⇒ Vundef |
---|
| 315 | ]. |
---|
| 316 | |
---|
[487] | 317 | definition floatofint : val → val ≝ λv. |
---|
[3] | 318 | match v with |
---|
[961] | 319 | [ Vint sz n ⇒ Vfloat (floatofint ? n) |
---|
[3] | 320 | | _ ⇒ Vundef |
---|
| 321 | ]. |
---|
| 322 | |
---|
[487] | 323 | definition floatofintu : val → val ≝ λv. |
---|
[3] | 324 | match v with |
---|
[961] | 325 | [ Vint sz n ⇒ Vfloat (floatofintu ? n) |
---|
[3] | 326 | | _ ⇒ Vundef |
---|
| 327 | ]. |
---|
| 328 | |
---|
[487] | 329 | definition notint : val → val ≝ λv. |
---|
[3] | 330 | match v with |
---|
[961] | 331 | [ Vint sz n ⇒ Vint sz (exclusive_disjunction_bv ? n (mone ?)) |
---|
[3] | 332 | | _ ⇒ Vundef |
---|
| 333 | ]. |
---|
| 334 | |
---|
[487] | 335 | definition notbool : val → val ≝ λv. |
---|
[3] | 336 | match v with |
---|
[961] | 337 | [ Vint sz n ⇒ of_bool (eq_bv ? n (zero ?)) |
---|
[500] | 338 | | Vptr _ b _ ofs ⇒ Vfalse |
---|
[484] | 339 | | Vnull _ ⇒ Vtrue |
---|
[3] | 340 | | _ ⇒ Vundef |
---|
| 341 | ]. |
---|
| 342 | |
---|
[961] | 343 | definition zero_ext ≝ λrsz: intsize. λv: val. |
---|
[3] | 344 | match v with |
---|
[961] | 345 | [ Vint sz n ⇒ Vint rsz (zero_ext … n) |
---|
[3] | 346 | | _ ⇒ Vundef |
---|
| 347 | ]. |
---|
| 348 | |
---|
[961] | 349 | definition sign_ext ≝ λrsz:intsize. λv:val. |
---|
[3] | 350 | match v with |
---|
[961] | 351 | [ Vint sz i ⇒ Vint rsz (sign_ext … i) |
---|
[3] | 352 | | _ ⇒ Vundef |
---|
| 353 | ]. |
---|
| 354 | |
---|
[487] | 355 | definition singleoffloat : val → val ≝ λv. |
---|
[3] | 356 | match v with |
---|
| 357 | [ Vfloat f ⇒ Vfloat (singleoffloat f) |
---|
| 358 | | _ ⇒ Vundef |
---|
| 359 | ]. |
---|
| 360 | |
---|
[484] | 361 | (* TODO: add zero to null? *) |
---|
[487] | 362 | definition add ≝ λv1,v2: val. |
---|
[3] | 363 | match v1 with |
---|
[961] | 364 | [ Vint sz1 n1 ⇒ match v2 with |
---|
| 365 | [ Vint sz2 n2 ⇒ intsize_eq_elim ? sz1 sz2 ? n1 |
---|
| 366 | (λn1. Vint sz2 (addition_n ? n1 n2)) |
---|
| 367 | Vundef |
---|
| 368 | | Vptr r b2 p ofs2 ⇒ Vptr r b2 p (shift_offset ? ofs2 n1) |
---|
[3] | 369 | | _ ⇒ Vundef ] |
---|
[500] | 370 | | Vptr r b1 p ofs1 ⇒ match v2 with |
---|
[961] | 371 | [ Vint _ n2 ⇒ Vptr r b1 p (shift_offset ? ofs1 n2) |
---|
[3] | 372 | | _ ⇒ Vundef ] |
---|
| 373 | | _ ⇒ Vundef ]. |
---|
| 374 | |
---|
[961] | 375 | (* XXX Is I32 the best answer for ptr subtraction? *) |
---|
| 376 | |
---|
[487] | 377 | definition sub ≝ λv1,v2: val. |
---|
[3] | 378 | match v1 with |
---|
[961] | 379 | [ Vint sz1 n1 ⇒ match v2 with |
---|
| 380 | [ Vint sz2 n2 ⇒ intsize_eq_elim ? sz1 sz2 ? n1 |
---|
| 381 | (λn1. Vint sz2 (subtraction ? n1 n2)) |
---|
| 382 | Vundef |
---|
[3] | 383 | | _ ⇒ Vundef ] |
---|
[500] | 384 | | Vptr r1 b1 p1 ofs1 ⇒ match v2 with |
---|
[961] | 385 | [ Vint sz2 n2 ⇒ Vptr r1 b1 p1 (neg_shift_offset ? ofs1 n2) |
---|
[500] | 386 | | Vptr r2 b2 p2 ofs2 ⇒ |
---|
[961] | 387 | if eq_block b1 b2 then Vint I32 (sub_offset ? ofs1 ofs2) else Vundef |
---|
[3] | 388 | | _ ⇒ Vundef ] |
---|
[961] | 389 | | Vnull r ⇒ match v2 with [ Vnull r' ⇒ Vzero I32 | _ ⇒ Vundef ] |
---|
[3] | 390 | | _ ⇒ Vundef ]. |
---|
| 391 | |
---|
[487] | 392 | definition mul ≝ λv1, v2: val. |
---|
[3] | 393 | match v1 with |
---|
[961] | 394 | [ Vint sz1 n1 ⇒ match v2 with |
---|
| 395 | [ Vint sz2 n2 ⇒ intsize_eq_elim ? sz1 sz2 ? n1 |
---|
| 396 | (λn1. Vint sz2 (\snd (split … (multiplication ? n1 n2)))) |
---|
| 397 | Vundef |
---|
[3] | 398 | | _ ⇒ Vundef ] |
---|
| 399 | | _ ⇒ Vundef ]. |
---|
| 400 | (* |
---|
[487] | 401 | definition divs ≝ λv1, v2: val. |
---|
[3] | 402 | match v1 with |
---|
| 403 | [ Vint n1 ⇒ match v2 with |
---|
| 404 | [ Vint n2 ⇒ Vint (divs n1 n2) |
---|
| 405 | | _ ⇒ Vundef ] |
---|
| 406 | | _ ⇒ Vundef ]. |
---|
| 407 | |
---|
| 408 | Definition mods (v1 v2: val): val := |
---|
| 409 | match v1, v2 with |
---|
| 410 | | Vint n1, Vint n2 => |
---|
| 411 | if Int.eq n2 Int.zero then Vundef else Vint(Int.mods n1 n2) |
---|
| 412 | | _, _ => Vundef |
---|
| 413 | end. |
---|
| 414 | |
---|
| 415 | Definition divu (v1 v2: val): val := |
---|
| 416 | match v1, v2 with |
---|
| 417 | | Vint n1, Vint n2 => |
---|
| 418 | if Int.eq n2 Int.zero then Vundef else Vint(Int.divu n1 n2) |
---|
| 419 | | _, _ => Vundef |
---|
| 420 | end. |
---|
| 421 | |
---|
| 422 | Definition modu (v1 v2: val): val := |
---|
| 423 | match v1, v2 with |
---|
| 424 | | Vint n1, Vint n2 => |
---|
| 425 | if Int.eq n2 Int.zero then Vundef else Vint(Int.modu n1 n2) |
---|
| 426 | | _, _ => Vundef |
---|
| 427 | end. |
---|
| 428 | *) |
---|
[487] | 429 | definition v_and ≝ λv1, v2: val. |
---|
[3] | 430 | match v1 with |
---|
[961] | 431 | [ Vint sz1 n1 ⇒ match v2 with |
---|
| 432 | [ Vint sz2 n2 ⇒ intsize_eq_elim ? sz1 sz2 ? n1 |
---|
| 433 | (λn1. Vint ? (conjunction_bv ? n1 n2)) |
---|
| 434 | Vundef |
---|
[3] | 435 | | _ ⇒ Vundef ] |
---|
| 436 | | _ ⇒ Vundef ]. |
---|
| 437 | |
---|
[487] | 438 | definition or ≝ λv1, v2: val. |
---|
[3] | 439 | match v1 with |
---|
[961] | 440 | [ Vint sz1 n1 ⇒ match v2 with |
---|
| 441 | [ Vint sz2 n2 ⇒ intsize_eq_elim ? sz1 sz2 ? n1 |
---|
| 442 | (λn1. Vint ? (inclusive_disjunction_bv ? n1 n2)) |
---|
| 443 | Vundef |
---|
[3] | 444 | | _ ⇒ Vundef ] |
---|
| 445 | | _ ⇒ Vundef ]. |
---|
| 446 | |
---|
[487] | 447 | definition xor ≝ λv1, v2: val. |
---|
[3] | 448 | match v1 with |
---|
[961] | 449 | [ Vint sz1 n1 ⇒ match v2 with |
---|
| 450 | [ Vint sz2 n2 ⇒ intsize_eq_elim ? sz1 sz2 ? n1 |
---|
| 451 | (λn1. Vint ? (exclusive_disjunction_bv ? n1 n2)) |
---|
| 452 | Vundef |
---|
[3] | 453 | | _ ⇒ Vundef ] |
---|
| 454 | | _ ⇒ Vundef ]. |
---|
| 455 | (* |
---|
| 456 | Definition shl (v1 v2: val): val := |
---|
| 457 | match v1, v2 with |
---|
| 458 | | Vint n1, Vint n2 => |
---|
| 459 | if Int.ltu n2 Int.iwordsize |
---|
| 460 | then Vint(Int.shl n1 n2) |
---|
| 461 | else Vundef |
---|
| 462 | | _, _ => Vundef |
---|
| 463 | end. |
---|
| 464 | |
---|
| 465 | Definition shr (v1 v2: val): val := |
---|
| 466 | match v1, v2 with |
---|
| 467 | | Vint n1, Vint n2 => |
---|
| 468 | if Int.ltu n2 Int.iwordsize |
---|
| 469 | then Vint(Int.shr n1 n2) |
---|
| 470 | else Vundef |
---|
| 471 | | _, _ => Vundef |
---|
| 472 | end. |
---|
| 473 | |
---|
| 474 | Definition shr_carry (v1 v2: val): val := |
---|
| 475 | match v1, v2 with |
---|
| 476 | | Vint n1, Vint n2 => |
---|
| 477 | if Int.ltu n2 Int.iwordsize |
---|
| 478 | then Vint(Int.shr_carry n1 n2) |
---|
| 479 | else Vundef |
---|
| 480 | | _, _ => Vundef |
---|
| 481 | end. |
---|
| 482 | |
---|
| 483 | Definition shrx (v1 v2: val): val := |
---|
| 484 | match v1, v2 with |
---|
| 485 | | Vint n1, Vint n2 => |
---|
| 486 | if Int.ltu n2 Int.iwordsize |
---|
| 487 | then Vint(Int.shrx n1 n2) |
---|
| 488 | else Vundef |
---|
| 489 | | _, _ => Vundef |
---|
| 490 | end. |
---|
| 491 | |
---|
| 492 | Definition shru (v1 v2: val): val := |
---|
| 493 | match v1, v2 with |
---|
| 494 | | Vint n1, Vint n2 => |
---|
| 495 | if Int.ltu n2 Int.iwordsize |
---|
| 496 | then Vint(Int.shru n1 n2) |
---|
| 497 | else Vundef |
---|
| 498 | | _, _ => Vundef |
---|
| 499 | end. |
---|
| 500 | |
---|
| 501 | Definition rolm (v: val) (amount mask: int): val := |
---|
| 502 | match v with |
---|
| 503 | | Vint n => Vint(Int.rolm n amount mask) |
---|
| 504 | | _ => Vundef |
---|
| 505 | end. |
---|
| 506 | |
---|
| 507 | Definition ror (v1 v2: val): val := |
---|
| 508 | match v1, v2 with |
---|
| 509 | | Vint n1, Vint n2 => |
---|
| 510 | if Int.ltu n2 Int.iwordsize |
---|
| 511 | then Vint(Int.ror n1 n2) |
---|
| 512 | else Vundef |
---|
| 513 | | _, _ => Vundef |
---|
| 514 | end. |
---|
| 515 | *) |
---|
[487] | 516 | definition addf ≝ λv1,v2: val. |
---|
[3] | 517 | match v1 with |
---|
| 518 | [ Vfloat f1 ⇒ match v2 with |
---|
| 519 | [ Vfloat f2 ⇒ Vfloat (Fadd f1 f2) |
---|
| 520 | | _ ⇒ Vundef ] |
---|
| 521 | | _ ⇒ Vundef ]. |
---|
| 522 | |
---|
[487] | 523 | definition subf ≝ λv1,v2: val. |
---|
[3] | 524 | match v1 with |
---|
| 525 | [ Vfloat f1 ⇒ match v2 with |
---|
| 526 | [ Vfloat f2 ⇒ Vfloat (Fsub f1 f2) |
---|
| 527 | | _ ⇒ Vundef ] |
---|
| 528 | | _ ⇒ Vundef ]. |
---|
| 529 | |
---|
[487] | 530 | definition mulf ≝ λv1,v2: val. |
---|
[3] | 531 | match v1 with |
---|
| 532 | [ Vfloat f1 ⇒ match v2 with |
---|
| 533 | [ Vfloat f2 ⇒ Vfloat (Fmul f1 f2) |
---|
| 534 | | _ ⇒ Vundef ] |
---|
| 535 | | _ ⇒ Vundef ]. |
---|
| 536 | |
---|
[487] | 537 | definition divf ≝ λv1,v2: val. |
---|
[3] | 538 | match v1 with |
---|
| 539 | [ Vfloat f1 ⇒ match v2 with |
---|
| 540 | [ Vfloat f2 ⇒ Vfloat (Fdiv f1 f2) |
---|
| 541 | | _ ⇒ Vundef ] |
---|
| 542 | | _ ⇒ Vundef ]. |
---|
| 543 | |
---|
[487] | 544 | definition cmp_match : comparison → val ≝ λc. |
---|
[484] | 545 | match c with |
---|
| 546 | [ Ceq ⇒ Vtrue |
---|
| 547 | | Cne ⇒ Vfalse |
---|
| 548 | | _ ⇒ Vundef |
---|
| 549 | ]. |
---|
| 550 | |
---|
[487] | 551 | definition cmp_mismatch : comparison → val ≝ λc. |
---|
[3] | 552 | match c with |
---|
| 553 | [ Ceq ⇒ Vfalse |
---|
| 554 | | Cne ⇒ Vtrue |
---|
| 555 | | _ ⇒ Vundef |
---|
| 556 | ]. |
---|
| 557 | |
---|
[583] | 558 | definition cmp_offset ≝ |
---|
| 559 | λc: comparison. λx,y:offset. |
---|
| 560 | match c with |
---|
| 561 | [ Ceq ⇒ eq_offset x y |
---|
| 562 | | Cne ⇒ ¬eq_offset x y |
---|
| 563 | | Clt ⇒ lt_offset x y |
---|
| 564 | | Cle ⇒ ¬lt_offset y x |
---|
| 565 | | Cgt ⇒ lt_offset y x |
---|
| 566 | | Cge ⇒ ¬lt_offset x y |
---|
| 567 | ]. |
---|
| 568 | |
---|
[961] | 569 | definition cmp_int : ∀n. comparison → BitVector n → BitVector n → bool ≝ |
---|
| 570 | λn,c,x,y. |
---|
| 571 | match c with |
---|
| 572 | [ Ceq ⇒ eq_bv ? x y |
---|
| 573 | | Cne ⇒ notb (eq_bv ? x y) |
---|
| 574 | | Clt ⇒ lt_s ? x y |
---|
| 575 | | Cle ⇒ notb (lt_s ? y x) |
---|
| 576 | | Cgt ⇒ lt_s ? y x |
---|
| 577 | | Cge ⇒ notb (lt_s ? x y) |
---|
| 578 | ]. |
---|
| 579 | |
---|
| 580 | definition cmpu_int : ∀n. comparison → BitVector n → BitVector n → bool ≝ |
---|
| 581 | λn,c,x,y. |
---|
| 582 | match c with |
---|
| 583 | [ Ceq ⇒ eq_bv ? x y |
---|
| 584 | | Cne ⇒ notb (eq_bv ? x y) |
---|
| 585 | | Clt ⇒ lt_u ? x y |
---|
| 586 | | Cle ⇒ notb (lt_u ? y x) |
---|
| 587 | | Cgt ⇒ lt_u ? y x |
---|
| 588 | | Cge ⇒ notb (lt_u ? x y) |
---|
| 589 | ]. |
---|
| 590 | |
---|
[487] | 591 | definition cmp ≝ λc: comparison. λv1,v2: val. |
---|
[3] | 592 | match v1 with |
---|
[961] | 593 | [ Vint sz1 n1 ⇒ match v2 with |
---|
| 594 | [ Vint sz2 n2 ⇒ intsize_eq_elim ? sz1 sz2 ? n1 |
---|
| 595 | (λn1. of_bool (cmp_int ? c n1 n2)) |
---|
| 596 | Vundef |
---|
[3] | 597 | | _ ⇒ Vundef ] |
---|
[500] | 598 | | Vptr r1 b1 p1 ofs1 ⇒ match v2 with |
---|
| 599 | [ Vptr r2 b2 p2 ofs2 ⇒ |
---|
[496] | 600 | if eq_block b1 b2 |
---|
[583] | 601 | then of_bool (cmp_offset c ofs1 ofs2) |
---|
[3] | 602 | else cmp_mismatch c |
---|
[484] | 603 | | Vnull r2 ⇒ cmp_mismatch c |
---|
[3] | 604 | | _ ⇒ Vundef ] |
---|
[484] | 605 | | Vnull r1 ⇒ match v2 with |
---|
[500] | 606 | [ Vptr _ _ _ _ ⇒ cmp_mismatch c |
---|
[484] | 607 | | Vnull r2 ⇒ cmp_match c |
---|
| 608 | | _ ⇒ Vundef |
---|
| 609 | ] |
---|
[3] | 610 | | _ ⇒ Vundef ]. |
---|
| 611 | |
---|
[487] | 612 | definition cmpu ≝ λc: comparison. λv1,v2: val. |
---|
[3] | 613 | match v1 with |
---|
[961] | 614 | [ Vint sz1 n1 ⇒ match v2 with |
---|
| 615 | [ Vint sz2 n2 ⇒ intsize_eq_elim ? sz1 sz2 ? n1 |
---|
| 616 | (λn1. of_bool (cmpu_int ? c n1 n2)) |
---|
| 617 | Vundef |
---|
[3] | 618 | | _ ⇒ Vundef ] |
---|
[500] | 619 | | Vptr r1 b1 p1 ofs1 ⇒ match v2 with |
---|
| 620 | [ Vptr r2 b2 p2 ofs2 ⇒ |
---|
[496] | 621 | if eq_block b1 b2 |
---|
[583] | 622 | then of_bool (cmp_offset c ofs1 ofs2) |
---|
[3] | 623 | else cmp_mismatch c |
---|
[484] | 624 | | Vnull r2 ⇒ cmp_mismatch c |
---|
[3] | 625 | | _ ⇒ Vundef ] |
---|
[484] | 626 | | Vnull r1 ⇒ match v2 with |
---|
[500] | 627 | [ Vptr _ _ _ _ ⇒ cmp_mismatch c |
---|
[484] | 628 | | Vnull r2 ⇒ cmp_match c |
---|
| 629 | | _ ⇒ Vundef |
---|
| 630 | ] |
---|
[3] | 631 | | _ ⇒ Vundef ]. |
---|
| 632 | |
---|
[961] | 633 | definition cmpf ≝ λc: comparison. λsz:intsize. λv1,v2: val. |
---|
[3] | 634 | match v1 with |
---|
| 635 | [ Vfloat f1 ⇒ match v2 with |
---|
| 636 | [ Vfloat f2 ⇒ of_bool (Fcmp c f1 f2) |
---|
| 637 | | _ ⇒ Vundef ] |
---|
| 638 | | _ ⇒ Vundef ]. |
---|
| 639 | |
---|
| 640 | (* * [load_result] is used in the memory model (library [Mem]) |
---|
| 641 | to post-process the results of a memory read. For instance, |
---|
| 642 | consider storing the integer value [0xFFF] on 1 byte at a |
---|
| 643 | given address, and reading it back. If it is read back with |
---|
| 644 | chunk [Mint8unsigned], zero-extension must be performed, resulting |
---|
| 645 | in [0xFF]. If it is read back as a [Mint8signed], sign-extension |
---|
| 646 | is performed and [0xFFFFFFFF] is returned. Type mismatches |
---|
| 647 | (e.g. reading back a float as a [Mint32]) read back as [Vundef]. *) |
---|
[961] | 648 | (* XXX update comment *) |
---|
| 649 | (* XXX is this even necessary now? |
---|
| 650 | should we be able to extract bytes? *) |
---|
[3] | 651 | |
---|
[487] | 652 | let rec load_result (chunk: memory_chunk) (v: val) ≝ |
---|
[3] | 653 | match v with |
---|
[961] | 654 | [ Vint sz n ⇒ |
---|
[3] | 655 | match chunk with |
---|
[961] | 656 | [ Mint8signed ⇒ match sz with [ I8 ⇒ v | _ ⇒ Vundef ] |
---|
| 657 | | Mint8unsigned ⇒ match sz with [ I8 ⇒ v | _ ⇒ Vundef ] |
---|
| 658 | | Mint16signed ⇒ match sz with [ I16 ⇒ v | _ ⇒ Vundef ] |
---|
| 659 | | Mint16unsigned ⇒ match sz with [ I16 ⇒ v | _ ⇒ Vundef ] |
---|
| 660 | | Mint32 ⇒ match sz with [ I32 ⇒ v | _ ⇒ Vundef ] |
---|
[3] | 661 | | _ ⇒ Vundef |
---|
| 662 | ] |
---|
[500] | 663 | | Vptr r b p ofs ⇒ |
---|
[483] | 664 | match chunk with |
---|
[500] | 665 | [ Mpointer r' ⇒ if eq_region r r' then Vptr r b p ofs else Vundef |
---|
[483] | 666 | | _ ⇒ Vundef |
---|
[3] | 667 | ] |
---|
[484] | 668 | | Vnull r ⇒ |
---|
| 669 | match chunk with |
---|
| 670 | [ Mpointer r' ⇒ if eq_region r r' then Vnull r else Vundef |
---|
| 671 | | _ ⇒ Vundef |
---|
| 672 | ] |
---|
[3] | 673 | | Vfloat f ⇒ |
---|
| 674 | match chunk with |
---|
| 675 | [ Mfloat32 ⇒ Vfloat(singleoffloat f) |
---|
| 676 | | Mfloat64 ⇒ Vfloat f |
---|
| 677 | | _ ⇒ Vundef |
---|
| 678 | ] |
---|
| 679 | | _ ⇒ Vundef |
---|
| 680 | ]. |
---|
| 681 | |
---|
| 682 | (* |
---|
| 683 | (** Theorems on arithmetic operations. *) |
---|
| 684 | |
---|
| 685 | Theorem cast8unsigned_and: |
---|
| 686 | forall x, zero_ext 8 x = and x (Vint(Int.repr 255)). |
---|
| 687 | Proof. |
---|
| 688 | destruct x; simpl; auto. decEq. |
---|
| 689 | change 255 with (two_p 8 - 1). apply Int.zero_ext_and. vm_compute; auto. |
---|
| 690 | Qed. |
---|
| 691 | |
---|
| 692 | Theorem cast16unsigned_and: |
---|
| 693 | forall x, zero_ext 16 x = and x (Vint(Int.repr 65535)). |
---|
| 694 | Proof. |
---|
| 695 | destruct x; simpl; auto. decEq. |
---|
| 696 | change 65535 with (two_p 16 - 1). apply Int.zero_ext_and. vm_compute; auto. |
---|
| 697 | Qed. |
---|
| 698 | |
---|
| 699 | Theorem istrue_not_isfalse: |
---|
| 700 | forall v, is_false v -> is_true (notbool v). |
---|
| 701 | Proof. |
---|
| 702 | destruct v; simpl; try contradiction. |
---|
| 703 | intros. subst i. simpl. discriminate. |
---|
| 704 | Qed. |
---|
| 705 | |
---|
| 706 | Theorem isfalse_not_istrue: |
---|
| 707 | forall v, is_true v -> is_false (notbool v). |
---|
| 708 | Proof. |
---|
| 709 | destruct v; simpl; try contradiction. |
---|
| 710 | intros. generalize (Int.eq_spec i Int.zero). |
---|
| 711 | case (Int.eq i Int.zero); intro. |
---|
| 712 | contradiction. simpl. auto. |
---|
| 713 | auto. |
---|
| 714 | Qed. |
---|
| 715 | |
---|
| 716 | Theorem bool_of_true_val: |
---|
| 717 | forall v, is_true v -> bool_of_val v true. |
---|
| 718 | Proof. |
---|
| 719 | intro. destruct v; simpl; intros; try contradiction. |
---|
| 720 | constructor; auto. constructor. |
---|
| 721 | Qed. |
---|
| 722 | |
---|
| 723 | Theorem bool_of_true_val2: |
---|
| 724 | forall v, bool_of_val v true -> is_true v. |
---|
| 725 | Proof. |
---|
| 726 | intros. inversion H; simpl; auto. |
---|
| 727 | Qed. |
---|
| 728 | |
---|
| 729 | Theorem bool_of_true_val_inv: |
---|
| 730 | forall v b, is_true v -> bool_of_val v b -> b = true. |
---|
| 731 | Proof. |
---|
| 732 | intros. inversion H0; subst v b; simpl in H; auto. |
---|
| 733 | Qed. |
---|
| 734 | |
---|
| 735 | Theorem bool_of_false_val: |
---|
| 736 | forall v, is_false v -> bool_of_val v false. |
---|
| 737 | Proof. |
---|
| 738 | intro. destruct v; simpl; intros; try contradiction. |
---|
| 739 | subst i; constructor. |
---|
| 740 | Qed. |
---|
| 741 | |
---|
| 742 | Theorem bool_of_false_val2: |
---|
| 743 | forall v, bool_of_val v false -> is_false v. |
---|
| 744 | Proof. |
---|
| 745 | intros. inversion H; simpl; auto. |
---|
| 746 | Qed. |
---|
| 747 | |
---|
| 748 | Theorem bool_of_false_val_inv: |
---|
| 749 | forall v b, is_false v -> bool_of_val v b -> b = false. |
---|
| 750 | Proof. |
---|
| 751 | intros. inversion H0; subst v b; simpl in H. |
---|
| 752 | congruence. auto. contradiction. |
---|
| 753 | Qed. |
---|
| 754 | |
---|
| 755 | Theorem notbool_negb_1: |
---|
| 756 | forall b, of_bool (negb b) = notbool (of_bool b). |
---|
| 757 | Proof. |
---|
| 758 | destruct b; reflexivity. |
---|
| 759 | Qed. |
---|
| 760 | |
---|
| 761 | Theorem notbool_negb_2: |
---|
| 762 | forall b, of_bool b = notbool (of_bool (negb b)). |
---|
| 763 | Proof. |
---|
| 764 | destruct b; reflexivity. |
---|
| 765 | Qed. |
---|
| 766 | |
---|
| 767 | Theorem notbool_idem2: |
---|
| 768 | forall b, notbool(notbool(of_bool b)) = of_bool b. |
---|
| 769 | Proof. |
---|
| 770 | destruct b; reflexivity. |
---|
| 771 | Qed. |
---|
| 772 | |
---|
| 773 | Theorem notbool_idem3: |
---|
| 774 | forall x, notbool(notbool(notbool x)) = notbool x. |
---|
| 775 | Proof. |
---|
| 776 | destruct x; simpl; auto. |
---|
| 777 | case (Int.eq i Int.zero); reflexivity. |
---|
| 778 | Qed. |
---|
| 779 | |
---|
| 780 | Theorem add_commut: forall x y, add x y = add y x. |
---|
| 781 | Proof. |
---|
| 782 | destruct x; destruct y; simpl; auto. |
---|
| 783 | decEq. apply Int.add_commut. |
---|
| 784 | Qed. |
---|
| 785 | |
---|
| 786 | Theorem add_assoc: forall x y z, add (add x y) z = add x (add y z). |
---|
| 787 | Proof. |
---|
| 788 | destruct x; destruct y; destruct z; simpl; auto. |
---|
| 789 | rewrite Int.add_assoc; auto. |
---|
| 790 | rewrite Int.add_assoc; auto. |
---|
| 791 | decEq. decEq. apply Int.add_commut. |
---|
| 792 | decEq. rewrite Int.add_commut. rewrite <- Int.add_assoc. |
---|
| 793 | decEq. apply Int.add_commut. |
---|
| 794 | decEq. rewrite Int.add_assoc. auto. |
---|
| 795 | Qed. |
---|
| 796 | |
---|
| 797 | Theorem add_permut: forall x y z, add x (add y z) = add y (add x z). |
---|
| 798 | Proof. |
---|
| 799 | intros. rewrite (add_commut y z). rewrite <- add_assoc. apply add_commut. |
---|
| 800 | Qed. |
---|
| 801 | |
---|
| 802 | Theorem add_permut_4: |
---|
| 803 | forall x y z t, add (add x y) (add z t) = add (add x z) (add y t). |
---|
| 804 | Proof. |
---|
| 805 | intros. rewrite add_permut. rewrite add_assoc. |
---|
| 806 | rewrite add_permut. symmetry. apply add_assoc. |
---|
| 807 | Qed. |
---|
| 808 | |
---|
| 809 | Theorem neg_zero: neg Vzero = Vzero. |
---|
| 810 | Proof. |
---|
| 811 | reflexivity. |
---|
| 812 | Qed. |
---|
| 813 | |
---|
| 814 | Theorem neg_add_distr: forall x y, neg(add x y) = add (neg x) (neg y). |
---|
| 815 | Proof. |
---|
| 816 | destruct x; destruct y; simpl; auto. decEq. apply Int.neg_add_distr. |
---|
| 817 | Qed. |
---|
| 818 | |
---|
| 819 | Theorem sub_zero_r: forall x, sub Vzero x = neg x. |
---|
| 820 | Proof. |
---|
| 821 | destruct x; simpl; auto. |
---|
| 822 | Qed. |
---|
| 823 | |
---|
| 824 | Theorem sub_add_opp: forall x y, sub x (Vint y) = add x (Vint (Int.neg y)). |
---|
| 825 | Proof. |
---|
| 826 | destruct x; intro y; simpl; auto; rewrite Int.sub_add_opp; auto. |
---|
| 827 | Qed. |
---|
| 828 | |
---|
| 829 | Theorem sub_opp_add: forall x y, sub x (Vint (Int.neg y)) = add x (Vint y). |
---|
| 830 | Proof. |
---|
| 831 | intros. unfold sub, add. |
---|
| 832 | destruct x; auto; rewrite Int.sub_add_opp; rewrite Int.neg_involutive; auto. |
---|
| 833 | Qed. |
---|
| 834 | |
---|
| 835 | Theorem sub_add_l: |
---|
| 836 | forall v1 v2 i, sub (add v1 (Vint i)) v2 = add (sub v1 v2) (Vint i). |
---|
| 837 | Proof. |
---|
| 838 | destruct v1; destruct v2; intros; simpl; auto. |
---|
| 839 | rewrite Int.sub_add_l. auto. |
---|
| 840 | rewrite Int.sub_add_l. auto. |
---|
| 841 | case (zeq b b0); intro. rewrite Int.sub_add_l. auto. reflexivity. |
---|
| 842 | Qed. |
---|
| 843 | |
---|
| 844 | Theorem sub_add_r: |
---|
| 845 | forall v1 v2 i, sub v1 (add v2 (Vint i)) = add (sub v1 v2) (Vint (Int.neg i)). |
---|
| 846 | Proof. |
---|
| 847 | destruct v1; destruct v2; intros; simpl; auto. |
---|
| 848 | rewrite Int.sub_add_r. auto. |
---|
| 849 | repeat rewrite Int.sub_add_opp. decEq. |
---|
| 850 | repeat rewrite Int.add_assoc. decEq. apply Int.add_commut. |
---|
| 851 | decEq. repeat rewrite Int.sub_add_opp. |
---|
| 852 | rewrite Int.add_assoc. decEq. apply Int.neg_add_distr. |
---|
| 853 | case (zeq b b0); intro. simpl. decEq. |
---|
| 854 | repeat rewrite Int.sub_add_opp. rewrite Int.add_assoc. decEq. |
---|
| 855 | apply Int.neg_add_distr. |
---|
| 856 | reflexivity. |
---|
| 857 | Qed. |
---|
| 858 | |
---|
| 859 | Theorem mul_commut: forall x y, mul x y = mul y x. |
---|
| 860 | Proof. |
---|
| 861 | destruct x; destruct y; simpl; auto. decEq. apply Int.mul_commut. |
---|
| 862 | Qed. |
---|
| 863 | |
---|
| 864 | Theorem mul_assoc: forall x y z, mul (mul x y) z = mul x (mul y z). |
---|
| 865 | Proof. |
---|
| 866 | destruct x; destruct y; destruct z; simpl; auto. |
---|
| 867 | decEq. apply Int.mul_assoc. |
---|
| 868 | Qed. |
---|
| 869 | |
---|
| 870 | Theorem mul_add_distr_l: |
---|
| 871 | forall x y z, mul (add x y) z = add (mul x z) (mul y z). |
---|
| 872 | Proof. |
---|
| 873 | destruct x; destruct y; destruct z; simpl; auto. |
---|
| 874 | decEq. apply Int.mul_add_distr_l. |
---|
| 875 | Qed. |
---|
| 876 | |
---|
| 877 | |
---|
| 878 | Theorem mul_add_distr_r: |
---|
| 879 | forall x y z, mul x (add y z) = add (mul x y) (mul x z). |
---|
| 880 | Proof. |
---|
| 881 | destruct x; destruct y; destruct z; simpl; auto. |
---|
| 882 | decEq. apply Int.mul_add_distr_r. |
---|
| 883 | Qed. |
---|
| 884 | |
---|
| 885 | Theorem mul_pow2: |
---|
| 886 | forall x n logn, |
---|
| 887 | Int.is_power2 n = Some logn -> |
---|
| 888 | mul x (Vint n) = shl x (Vint logn). |
---|
| 889 | Proof. |
---|
| 890 | intros; destruct x; simpl; auto. |
---|
| 891 | change 32 with (Z_of_nat Int.wordsize). |
---|
| 892 | rewrite (Int.is_power2_range _ _ H). decEq. apply Int.mul_pow2. auto. |
---|
| 893 | Qed. |
---|
| 894 | |
---|
| 895 | Theorem mods_divs: |
---|
| 896 | forall x y, mods x y = sub x (mul (divs x y) y). |
---|
| 897 | Proof. |
---|
| 898 | destruct x; destruct y; simpl; auto. |
---|
| 899 | case (Int.eq i0 Int.zero); simpl. auto. decEq. apply Int.mods_divs. |
---|
| 900 | Qed. |
---|
| 901 | |
---|
| 902 | Theorem modu_divu: |
---|
| 903 | forall x y, modu x y = sub x (mul (divu x y) y). |
---|
| 904 | Proof. |
---|
| 905 | destruct x; destruct y; simpl; auto. |
---|
| 906 | generalize (Int.eq_spec i0 Int.zero); |
---|
| 907 | case (Int.eq i0 Int.zero); simpl. auto. |
---|
| 908 | intro. decEq. apply Int.modu_divu. auto. |
---|
| 909 | Qed. |
---|
| 910 | |
---|
| 911 | Theorem divs_pow2: |
---|
| 912 | forall x n logn, |
---|
| 913 | Int.is_power2 n = Some logn -> |
---|
| 914 | divs x (Vint n) = shrx x (Vint logn). |
---|
| 915 | Proof. |
---|
| 916 | intros; destruct x; simpl; auto. |
---|
| 917 | change 32 with (Z_of_nat Int.wordsize). |
---|
| 918 | rewrite (Int.is_power2_range _ _ H). |
---|
| 919 | generalize (Int.eq_spec n Int.zero); |
---|
| 920 | case (Int.eq n Int.zero); intro. |
---|
| 921 | subst n. compute in H. discriminate. |
---|
| 922 | decEq. apply Int.divs_pow2. auto. |
---|
| 923 | Qed. |
---|
| 924 | |
---|
| 925 | Theorem divu_pow2: |
---|
| 926 | forall x n logn, |
---|
| 927 | Int.is_power2 n = Some logn -> |
---|
| 928 | divu x (Vint n) = shru x (Vint logn). |
---|
| 929 | Proof. |
---|
| 930 | intros; destruct x; simpl; auto. |
---|
| 931 | change 32 with (Z_of_nat Int.wordsize). |
---|
| 932 | rewrite (Int.is_power2_range _ _ H). |
---|
| 933 | generalize (Int.eq_spec n Int.zero); |
---|
| 934 | case (Int.eq n Int.zero); intro. |
---|
| 935 | subst n. compute in H. discriminate. |
---|
| 936 | decEq. apply Int.divu_pow2. auto. |
---|
| 937 | Qed. |
---|
| 938 | |
---|
| 939 | Theorem modu_pow2: |
---|
| 940 | forall x n logn, |
---|
| 941 | Int.is_power2 n = Some logn -> |
---|
| 942 | modu x (Vint n) = and x (Vint (Int.sub n Int.one)). |
---|
| 943 | Proof. |
---|
| 944 | intros; destruct x; simpl; auto. |
---|
| 945 | generalize (Int.eq_spec n Int.zero); |
---|
| 946 | case (Int.eq n Int.zero); intro. |
---|
| 947 | subst n. compute in H. discriminate. |
---|
| 948 | decEq. eapply Int.modu_and; eauto. |
---|
| 949 | Qed. |
---|
| 950 | |
---|
| 951 | Theorem and_commut: forall x y, and x y = and y x. |
---|
| 952 | Proof. |
---|
| 953 | destruct x; destruct y; simpl; auto. decEq. apply Int.and_commut. |
---|
| 954 | Qed. |
---|
| 955 | |
---|
| 956 | Theorem and_assoc: forall x y z, and (and x y) z = and x (and y z). |
---|
| 957 | Proof. |
---|
| 958 | destruct x; destruct y; destruct z; simpl; auto. |
---|
| 959 | decEq. apply Int.and_assoc. |
---|
| 960 | Qed. |
---|
| 961 | |
---|
| 962 | Theorem or_commut: forall x y, or x y = or y x. |
---|
| 963 | Proof. |
---|
| 964 | destruct x; destruct y; simpl; auto. decEq. apply Int.or_commut. |
---|
| 965 | Qed. |
---|
| 966 | |
---|
| 967 | Theorem or_assoc: forall x y z, or (or x y) z = or x (or y z). |
---|
| 968 | Proof. |
---|
| 969 | destruct x; destruct y; destruct z; simpl; auto. |
---|
| 970 | decEq. apply Int.or_assoc. |
---|
| 971 | Qed. |
---|
| 972 | |
---|
| 973 | Theorem xor_commut: forall x y, xor x y = xor y x. |
---|
| 974 | Proof. |
---|
| 975 | destruct x; destruct y; simpl; auto. decEq. apply Int.xor_commut. |
---|
| 976 | Qed. |
---|
| 977 | |
---|
| 978 | Theorem xor_assoc: forall x y z, xor (xor x y) z = xor x (xor y z). |
---|
| 979 | Proof. |
---|
| 980 | destruct x; destruct y; destruct z; simpl; auto. |
---|
| 981 | decEq. apply Int.xor_assoc. |
---|
| 982 | Qed. |
---|
| 983 | |
---|
| 984 | Theorem shl_mul: forall x y, Val.mul x (Val.shl Vone y) = Val.shl x y. |
---|
| 985 | Proof. |
---|
| 986 | destruct x; destruct y; simpl; auto. |
---|
| 987 | case (Int.ltu i0 Int.iwordsize); auto. |
---|
| 988 | decEq. symmetry. apply Int.shl_mul. |
---|
| 989 | Qed. |
---|
| 990 | |
---|
| 991 | Theorem shl_rolm: |
---|
| 992 | forall x n, |
---|
| 993 | Int.ltu n Int.iwordsize = true -> |
---|
| 994 | shl x (Vint n) = rolm x n (Int.shl Int.mone n). |
---|
| 995 | Proof. |
---|
| 996 | intros; destruct x; simpl; auto. |
---|
| 997 | rewrite H. decEq. apply Int.shl_rolm. exact H. |
---|
| 998 | Qed. |
---|
| 999 | |
---|
| 1000 | Theorem shru_rolm: |
---|
| 1001 | forall x n, |
---|
| 1002 | Int.ltu n Int.iwordsize = true -> |
---|
| 1003 | shru x (Vint n) = rolm x (Int.sub Int.iwordsize n) (Int.shru Int.mone n). |
---|
| 1004 | Proof. |
---|
| 1005 | intros; destruct x; simpl; auto. |
---|
| 1006 | rewrite H. decEq. apply Int.shru_rolm. exact H. |
---|
| 1007 | Qed. |
---|
| 1008 | |
---|
| 1009 | Theorem shrx_carry: |
---|
| 1010 | forall x y, |
---|
| 1011 | add (shr x y) (shr_carry x y) = shrx x y. |
---|
| 1012 | Proof. |
---|
| 1013 | destruct x; destruct y; simpl; auto. |
---|
| 1014 | case (Int.ltu i0 Int.iwordsize); auto. |
---|
| 1015 | simpl. decEq. apply Int.shrx_carry. |
---|
| 1016 | Qed. |
---|
| 1017 | |
---|
| 1018 | Theorem or_rolm: |
---|
| 1019 | forall x n m1 m2, |
---|
| 1020 | or (rolm x n m1) (rolm x n m2) = rolm x n (Int.or m1 m2). |
---|
| 1021 | Proof. |
---|
| 1022 | intros; destruct x; simpl; auto. |
---|
| 1023 | decEq. apply Int.or_rolm. |
---|
| 1024 | Qed. |
---|
| 1025 | |
---|
| 1026 | Theorem rolm_rolm: |
---|
| 1027 | forall x n1 m1 n2 m2, |
---|
| 1028 | rolm (rolm x n1 m1) n2 m2 = |
---|
| 1029 | rolm x (Int.modu (Int.add n1 n2) Int.iwordsize) |
---|
| 1030 | (Int.and (Int.rol m1 n2) m2). |
---|
| 1031 | Proof. |
---|
| 1032 | intros; destruct x; simpl; auto. |
---|
| 1033 | decEq. |
---|
| 1034 | apply Int.rolm_rolm. apply int_wordsize_divides_modulus. |
---|
| 1035 | Qed. |
---|
| 1036 | |
---|
| 1037 | Theorem rolm_zero: |
---|
| 1038 | forall x m, |
---|
| 1039 | rolm x Int.zero m = and x (Vint m). |
---|
| 1040 | Proof. |
---|
| 1041 | intros; destruct x; simpl; auto. decEq. apply Int.rolm_zero. |
---|
| 1042 | Qed. |
---|
| 1043 | |
---|
| 1044 | Theorem addf_commut: forall x y, addf x y = addf y x. |
---|
| 1045 | Proof. |
---|
| 1046 | destruct x; destruct y; simpl; auto. decEq. apply Float.addf_commut. |
---|
| 1047 | Qed. |
---|
| 1048 | |
---|
| 1049 | Lemma negate_cmp_mismatch: |
---|
| 1050 | forall c, |
---|
| 1051 | cmp_mismatch (negate_comparison c) = notbool(cmp_mismatch c). |
---|
| 1052 | Proof. |
---|
| 1053 | destruct c; reflexivity. |
---|
| 1054 | Qed. |
---|
| 1055 | |
---|
| 1056 | Theorem negate_cmp: |
---|
| 1057 | forall c x y, |
---|
| 1058 | cmp (negate_comparison c) x y = notbool (cmp c x y). |
---|
| 1059 | Proof. |
---|
| 1060 | destruct x; destruct y; simpl; auto. |
---|
| 1061 | rewrite Int.negate_cmp. apply notbool_negb_1. |
---|
| 1062 | case (Int.eq i Int.zero). apply negate_cmp_mismatch. reflexivity. |
---|
| 1063 | case (Int.eq i0 Int.zero). apply negate_cmp_mismatch. reflexivity. |
---|
| 1064 | case (zeq b b0); intro. |
---|
| 1065 | rewrite Int.negate_cmp. apply notbool_negb_1. |
---|
| 1066 | apply negate_cmp_mismatch. |
---|
| 1067 | Qed. |
---|
| 1068 | |
---|
| 1069 | Theorem negate_cmpu: |
---|
| 1070 | forall c x y, |
---|
| 1071 | cmpu (negate_comparison c) x y = notbool (cmpu c x y). |
---|
| 1072 | Proof. |
---|
| 1073 | destruct x; destruct y; simpl; auto. |
---|
| 1074 | rewrite Int.negate_cmpu. apply notbool_negb_1. |
---|
| 1075 | case (Int.eq i Int.zero). apply negate_cmp_mismatch. reflexivity. |
---|
| 1076 | case (Int.eq i0 Int.zero). apply negate_cmp_mismatch. reflexivity. |
---|
| 1077 | case (zeq b b0); intro. |
---|
| 1078 | rewrite Int.negate_cmpu. apply notbool_negb_1. |
---|
| 1079 | apply negate_cmp_mismatch. |
---|
| 1080 | Qed. |
---|
| 1081 | |
---|
| 1082 | Lemma swap_cmp_mismatch: |
---|
| 1083 | forall c, cmp_mismatch (swap_comparison c) = cmp_mismatch c. |
---|
| 1084 | Proof. |
---|
| 1085 | destruct c; reflexivity. |
---|
| 1086 | Qed. |
---|
| 1087 | |
---|
| 1088 | Theorem swap_cmp: |
---|
| 1089 | forall c x y, |
---|
| 1090 | cmp (swap_comparison c) x y = cmp c y x. |
---|
| 1091 | Proof. |
---|
| 1092 | destruct x; destruct y; simpl; auto. |
---|
| 1093 | rewrite Int.swap_cmp. auto. |
---|
| 1094 | case (Int.eq i Int.zero). apply swap_cmp_mismatch. auto. |
---|
| 1095 | case (Int.eq i0 Int.zero). apply swap_cmp_mismatch. auto. |
---|
| 1096 | case (zeq b b0); intro. |
---|
| 1097 | subst b0. rewrite zeq_true. rewrite Int.swap_cmp. auto. |
---|
| 1098 | rewrite zeq_false. apply swap_cmp_mismatch. auto. |
---|
| 1099 | Qed. |
---|
| 1100 | |
---|
| 1101 | Theorem swap_cmpu: |
---|
| 1102 | forall c x y, |
---|
| 1103 | cmpu (swap_comparison c) x y = cmpu c y x. |
---|
| 1104 | Proof. |
---|
| 1105 | destruct x; destruct y; simpl; auto. |
---|
| 1106 | rewrite Int.swap_cmpu. auto. |
---|
| 1107 | case (Int.eq i Int.zero). apply swap_cmp_mismatch. auto. |
---|
| 1108 | case (Int.eq i0 Int.zero). apply swap_cmp_mismatch. auto. |
---|
| 1109 | case (zeq b b0); intro. |
---|
| 1110 | subst b0. rewrite zeq_true. rewrite Int.swap_cmpu. auto. |
---|
| 1111 | rewrite zeq_false. apply swap_cmp_mismatch. auto. |
---|
| 1112 | Qed. |
---|
| 1113 | |
---|
| 1114 | Theorem negate_cmpf_eq: |
---|
| 1115 | forall v1 v2, notbool (cmpf Cne v1 v2) = cmpf Ceq v1 v2. |
---|
| 1116 | Proof. |
---|
| 1117 | destruct v1; destruct v2; simpl; auto. |
---|
| 1118 | rewrite Float.cmp_ne_eq. rewrite notbool_negb_1. |
---|
| 1119 | apply notbool_idem2. |
---|
| 1120 | Qed. |
---|
| 1121 | |
---|
| 1122 | Theorem negate_cmpf_ne: |
---|
| 1123 | forall v1 v2, notbool (cmpf Ceq v1 v2) = cmpf Cne v1 v2. |
---|
| 1124 | Proof. |
---|
| 1125 | destruct v1; destruct v2; simpl; auto. |
---|
| 1126 | rewrite Float.cmp_ne_eq. rewrite notbool_negb_1. auto. |
---|
| 1127 | Qed. |
---|
| 1128 | |
---|
| 1129 | Lemma or_of_bool: |
---|
| 1130 | forall b1 b2, or (of_bool b1) (of_bool b2) = of_bool (b1 || b2). |
---|
| 1131 | Proof. |
---|
| 1132 | destruct b1; destruct b2; reflexivity. |
---|
| 1133 | Qed. |
---|
| 1134 | |
---|
| 1135 | Theorem cmpf_le: |
---|
| 1136 | forall v1 v2, cmpf Cle v1 v2 = or (cmpf Clt v1 v2) (cmpf Ceq v1 v2). |
---|
| 1137 | Proof. |
---|
| 1138 | destruct v1; destruct v2; simpl; auto. |
---|
| 1139 | rewrite or_of_bool. decEq. apply Float.cmp_le_lt_eq. |
---|
| 1140 | Qed. |
---|
| 1141 | |
---|
| 1142 | Theorem cmpf_ge: |
---|
| 1143 | forall v1 v2, cmpf Cge v1 v2 = or (cmpf Cgt v1 v2) (cmpf Ceq v1 v2). |
---|
| 1144 | Proof. |
---|
| 1145 | destruct v1; destruct v2; simpl; auto. |
---|
| 1146 | rewrite or_of_bool. decEq. apply Float.cmp_ge_gt_eq. |
---|
| 1147 | Qed. |
---|
| 1148 | |
---|
| 1149 | Definition is_bool (v: val) := |
---|
| 1150 | v = Vundef \/ v = Vtrue \/ v = Vfalse. |
---|
| 1151 | |
---|
| 1152 | Lemma of_bool_is_bool: |
---|
| 1153 | forall b, is_bool (of_bool b). |
---|
| 1154 | Proof. |
---|
| 1155 | destruct b; unfold is_bool; simpl; tauto. |
---|
| 1156 | Qed. |
---|
| 1157 | |
---|
| 1158 | Lemma undef_is_bool: is_bool Vundef. |
---|
| 1159 | Proof. |
---|
| 1160 | unfold is_bool; tauto. |
---|
| 1161 | Qed. |
---|
| 1162 | |
---|
| 1163 | Lemma cmp_mismatch_is_bool: |
---|
| 1164 | forall c, is_bool (cmp_mismatch c). |
---|
| 1165 | Proof. |
---|
| 1166 | destruct c; simpl; unfold is_bool; tauto. |
---|
| 1167 | Qed. |
---|
| 1168 | |
---|
| 1169 | Lemma cmp_is_bool: |
---|
| 1170 | forall c v1 v2, is_bool (cmp c v1 v2). |
---|
| 1171 | Proof. |
---|
| 1172 | destruct v1; destruct v2; simpl; try apply undef_is_bool. |
---|
| 1173 | apply of_bool_is_bool. |
---|
| 1174 | case (Int.eq i Int.zero). apply cmp_mismatch_is_bool. apply undef_is_bool. |
---|
| 1175 | case (Int.eq i0 Int.zero). apply cmp_mismatch_is_bool. apply undef_is_bool. |
---|
| 1176 | case (zeq b b0); intro. apply of_bool_is_bool. apply cmp_mismatch_is_bool. |
---|
| 1177 | Qed. |
---|
| 1178 | |
---|
| 1179 | Lemma cmpu_is_bool: |
---|
| 1180 | forall c v1 v2, is_bool (cmpu c v1 v2). |
---|
| 1181 | Proof. |
---|
| 1182 | destruct v1; destruct v2; simpl; try apply undef_is_bool. |
---|
| 1183 | apply of_bool_is_bool. |
---|
| 1184 | case (Int.eq i Int.zero). apply cmp_mismatch_is_bool. apply undef_is_bool. |
---|
| 1185 | case (Int.eq i0 Int.zero). apply cmp_mismatch_is_bool. apply undef_is_bool. |
---|
| 1186 | case (zeq b b0); intro. apply of_bool_is_bool. apply cmp_mismatch_is_bool. |
---|
| 1187 | Qed. |
---|
| 1188 | |
---|
| 1189 | Lemma cmpf_is_bool: |
---|
| 1190 | forall c v1 v2, is_bool (cmpf c v1 v2). |
---|
| 1191 | Proof. |
---|
| 1192 | destruct v1; destruct v2; simpl; |
---|
| 1193 | apply undef_is_bool || apply of_bool_is_bool. |
---|
| 1194 | Qed. |
---|
| 1195 | |
---|
| 1196 | Lemma notbool_is_bool: |
---|
| 1197 | forall v, is_bool (notbool v). |
---|
| 1198 | Proof. |
---|
| 1199 | destruct v; simpl. |
---|
| 1200 | apply undef_is_bool. apply of_bool_is_bool. |
---|
| 1201 | apply undef_is_bool. unfold is_bool; tauto. |
---|
| 1202 | Qed. |
---|
| 1203 | |
---|
| 1204 | Lemma notbool_xor: |
---|
| 1205 | forall v, is_bool v -> v = xor (notbool v) Vone. |
---|
| 1206 | Proof. |
---|
| 1207 | intros. elim H; intro. |
---|
| 1208 | subst v. reflexivity. |
---|
| 1209 | elim H0; intro; subst v; reflexivity. |
---|
| 1210 | Qed. |
---|
| 1211 | |
---|
| 1212 | Lemma rolm_lt_zero: |
---|
| 1213 | forall v, rolm v Int.one Int.one = cmp Clt v (Vint Int.zero). |
---|
| 1214 | Proof. |
---|
| 1215 | intros. destruct v; simpl; auto. |
---|
| 1216 | transitivity (Vint (Int.shru i (Int.repr (Z_of_nat Int.wordsize - 1)))). |
---|
| 1217 | decEq. symmetry. rewrite Int.shru_rolm. auto. auto. |
---|
| 1218 | rewrite Int.shru_lt_zero. destruct (Int.lt i Int.zero); auto. |
---|
| 1219 | Qed. |
---|
| 1220 | |
---|
| 1221 | Lemma rolm_ge_zero: |
---|
| 1222 | forall v, |
---|
| 1223 | xor (rolm v Int.one Int.one) (Vint Int.one) = cmp Cge v (Vint Int.zero). |
---|
| 1224 | Proof. |
---|
| 1225 | intros. rewrite rolm_lt_zero. destruct v; simpl; auto. |
---|
| 1226 | destruct (Int.lt i Int.zero); auto. |
---|
| 1227 | Qed. |
---|
| 1228 | *) |
---|
| 1229 | (* * The ``is less defined'' relation between values. |
---|
| 1230 | A value is less defined than itself, and [Vundef] is |
---|
| 1231 | less defined than any value. *) |
---|
| 1232 | |
---|
[487] | 1233 | inductive Val_lessdef: val → val → Prop ≝ |
---|
[3] | 1234 | | lessdef_refl: ∀v. Val_lessdef v v |
---|
| 1235 | | lessdef_undef: ∀v. Val_lessdef Vundef v. |
---|
| 1236 | |
---|
[487] | 1237 | inductive lessdef_list: list val → list val → Prop ≝ |
---|
[3] | 1238 | | lessdef_list_nil: |
---|
| 1239 | lessdef_list (nil ?) (nil ?) |
---|
| 1240 | | lessdef_list_cons: |
---|
| 1241 | ∀v1,v2,vl1,vl2. |
---|
| 1242 | Val_lessdef v1 v2 → lessdef_list vl1 vl2 → |
---|
| 1243 | lessdef_list (v1 :: vl1) (v2 :: vl2). |
---|
| 1244 | |
---|
| 1245 | (*Hint Resolve lessdef_refl lessdef_undef lessdef_list_nil lessdef_list_cons.*) |
---|
[487] | 1246 | (* |
---|
| 1247 | lemma lessdef_list_inv: |
---|
[3] | 1248 | ∀vl1,vl2. lessdef_list vl1 vl2 → vl1 = vl2 ∨ in_list ? Vundef vl1. |
---|
[487] | 1249 | #vl1 elim vl1; |
---|
| 1250 | [ #vl2 #H inversion H; /2/; #h1 #h2 #t1 #t2 #H1 #H2 #H3 #Hbad destruct |
---|
| 1251 | | #h #t #IH #vl2 #H |
---|
| 1252 | inversion H; |
---|
| 1253 | [ #H' destruct |
---|
| 1254 | | #h1 #h2 #t1 #t2 #H1 #H2 #H3 #e1 #e2 destruct; |
---|
| 1255 | elim H1; |
---|
| 1256 | [ elim (IH t2 H2); |
---|
| 1257 | [ #e destruct; /2/; |
---|
| 1258 | | /3/ ] |
---|
| 1259 | | /3/ ] |
---|
| 1260 | ] |
---|
| 1261 | ] qed. |
---|
| 1262 | *) |
---|
| 1263 | lemma load_result_lessdef: |
---|
[3] | 1264 | ∀chunk,v1,v2. |
---|
| 1265 | Val_lessdef v1 v2 → Val_lessdef (load_result chunk v1) (load_result chunk v2). |
---|
[487] | 1266 | #chunk #v1 #v2 #H inversion H; //; #v #e1 #e2 cases chunk |
---|
| 1267 | [ 8: #r ] whd in ⊢ (?%?); //; |
---|
| 1268 | qed. |
---|
[3] | 1269 | |
---|
[744] | 1270 | lemma zero_ext_lessdef: |
---|
| 1271 | ∀n,v1,v2. Val_lessdef v1 v2 → Val_lessdef (zero_ext n v1) (zero_ext n v2). |
---|
| 1272 | #n #v1 #v2 #H inversion H // #v #E1 #E2 destruct // |
---|
| 1273 | qed. |
---|
| 1274 | |
---|
[487] | 1275 | lemma sign_ext_lessdef: |
---|
[3] | 1276 | ∀n,v1,v2. Val_lessdef v1 v2 → Val_lessdef (sign_ext n v1) (sign_ext n v2). |
---|
[891] | 1277 | #n #v1 #v2 #H inversion H // #v #e1 #e2 whd in ⊢ (?%?) // |
---|
[487] | 1278 | qed. |
---|
[3] | 1279 | (* |
---|
| 1280 | Lemma singleoffloat_lessdef: |
---|
| 1281 | forall v1 v2, lessdef v1 v2 -> lessdef (singleoffloat v1) (singleoffloat v2). |
---|
| 1282 | Proof. |
---|
| 1283 | intros; inv H; simpl; auto. |
---|
| 1284 | Qed. |
---|
| 1285 | |
---|
| 1286 | End Val. |
---|
| 1287 | *) |
---|