1 | (* Memory model used in the dynamic semantics of the back-end intermediate |
---|
2 | languages. Inspired by common/Mem.ma, adapted from Compcert *) |
---|
3 | |
---|
4 | (* * This file develops the memory model that is used in the dynamic |
---|
5 | semantics of all the languages used in the compiler. |
---|
6 | It defines a type [mem] of memory states, the following 4 basic |
---|
7 | operations over memory states, and their properties: |
---|
8 | - [load]: read a memory chunk at a given address; |
---|
9 | - [store]: store a memory chunk at a given address; |
---|
10 | - [alloc]: allocate a fresh memory block; |
---|
11 | - [free]: invalidate a memory block. |
---|
12 | *) |
---|
13 | |
---|
14 | include "common/ByteValues.ma". |
---|
15 | include "common/GenMem.ma". |
---|
16 | |
---|
17 | definition bemem ≝ mem. |
---|
18 | |
---|
19 | definition is_addressable : region → bool ≝ λr.match r with |
---|
20 | [ XData ⇒ true | Code ⇒ true | _ ⇒ false ]. |
---|
21 | |
---|
22 | |
---|
23 | definition is_address : (beval × beval) → Prop ≝ λa. |
---|
24 | ∃p : Σp.bool_to_Prop (is_addressable (ptype p)).∃p0,p1. |
---|
25 | \fst a = BVptr p p0 ∧ part_no ? p0 = 0 ∧ |
---|
26 | \snd a = BVptr p p1 ∧ part_no ? p1 = 1. |
---|
27 | |
---|
28 | definition is_addressb : (beval × beval) → bool ≝ λa. |
---|
29 | match a with |
---|
30 | [ mk_Prod a0 a1 ⇒ |
---|
31 | match a0 with |
---|
32 | [ BVptr p0 part0 ⇒ |
---|
33 | is_addressable (ptype p0) ∧ eqb part0 0 ∧ |
---|
34 | match a1 with |
---|
35 | [ BVptr p1 part1 ⇒ |
---|
36 | eq_pointer p0 p1 ∧ eqb part1 1 |
---|
37 | | _ ⇒ false |
---|
38 | ] |
---|
39 | | _ ⇒ false |
---|
40 | ] |
---|
41 | ]. |
---|
42 | |
---|
43 | lemma is_addressb_elim : ∀P : bool → Prop.∀a : beval × beval. |
---|
44 | (is_address a → P true) → (¬is_address a → P false) → P (is_addressb a). |
---|
45 | #P * * |
---|
46 | [4:|*: [|#b0|#r0#part0] #a1 #_ #Pfalse @Pfalse % * #x * #p0 * #p1 *** #EQ destruct(EQ)] |
---|
47 | #p0 #part0 #a1 |
---|
48 | whd in match is_addressb; normalize nodelta |
---|
49 | elim (true_or_false_Prop (is_addressable (ptype p0))) |
---|
50 | #H >H |
---|
51 | [ @(eqb_elim part0 0) #Heq |
---|
52 | [ cases a1 [|#b0|#r0#part0|#p1#part1] whd in match (?∧?); |
---|
53 | [4: @eq_pointer_elim #Heq' |
---|
54 | [ @(eqb_elim part1 1) #Heq'' |
---|
55 | [ #Ptrue #_ @Ptrue destruct |
---|
56 | %{p1} [assumption] %{part0} %{part1} |
---|
57 | % [ % [ % ]] try % assumption |
---|
58 | ] |
---|
59 | ] |
---|
60 | ] |
---|
61 | ] |
---|
62 | ] |
---|
63 | #_ #Pfalse @Pfalse % ** #p0' #H' * #part0' * #part1' *** |
---|
64 | #H0 #H1 #H2 #H3 destruct /2 by absurd/ |
---|
65 | qed. |
---|
66 | |
---|
67 | (* CSC: only pointers to XRAM or code memory ATM *) |
---|
68 | definition address ≝ beval × beval. |
---|
69 | definition safe_address ≝ Sig address is_address. |
---|
70 | unification hint 0 ≔ ; |
---|
71 | P ≟ Prod beval beval |
---|
72 | (*------------------*)⊢ |
---|
73 | safe_address ≡ Sig P is_address. |
---|
74 | |
---|
75 | definition eq_address: address → address → bool ≝ |
---|
76 | λaddr1,addr2. |
---|
77 | eq_beval (\fst addr1) (\fst addr2) ∧ eq_beval (\snd addr1) (\snd addr2). |
---|
78 | |
---|
79 | definition pointer_of_address: address → res pointer ≝ |
---|
80 | λp. let 〈v1,v2〉 ≝ p in pointer_of_bevals [v1;v2]. |
---|
81 | |
---|
82 | definition pointer_of_address_safe : safe_address → pointer ≝ |
---|
83 | λp.match \fst p return λx.\fst p = x → ? with |
---|
84 | [ BVptr ptr _ ⇒ λ_.ptr |
---|
85 | | _ ⇒ λabs.⊥ |
---|
86 | ] (refl …). |
---|
87 | lapply abs -abs cases p |
---|
88 | * #a0 #a1 * #x * #p0 * #p1 *** #H0 #H1 #H2 #H3 #H4 |
---|
89 | destruct(H0 H4) |
---|
90 | qed. |
---|
91 | |
---|
92 | definition pointer_compat' ≝ λb,r. |
---|
93 | match b with |
---|
94 | [ mk_block r' z ⇒ |
---|
95 | if eq_region r' r then True |
---|
96 | else |
---|
97 | match r with |
---|
98 | [ Any ⇒ True |
---|
99 | | XData ⇒ match r' with |
---|
100 | [ PData ⇒ True |
---|
101 | | _ ⇒ False |
---|
102 | ] |
---|
103 | | _ ⇒ False |
---|
104 | ] |
---|
105 | ]. |
---|
106 | |
---|
107 | lemma pointer_compat_to_ind : ∀b,r.pointer_compat' b r → pointer_compat b r. |
---|
108 | ** #z ** // |
---|
109 | qed. |
---|
110 | |
---|
111 | lemma pointer_compat_from_ind : ∀b,r.pointer_compat b r → pointer_compat' b r. |
---|
112 | #b #r #H inversion H |
---|
113 | [ #s #id #EQ1 #EQ2 #EQ3 whd >reflexive_eq_region % |
---|
114 | | #id #EQ1 #EQ2 #EQ3 % |
---|
115 | | #r #id #EQ1 #EQ2 #EQ3 whd @eq_region_elim #EQ4 destruct(EQ4) % |
---|
116 | ] |
---|
117 | qed. |
---|
118 | |
---|
119 | lemma pointer_of_address_is_safe : ∀a : safe_address.pointer_of_address a = OK … (pointer_of_address_safe a). |
---|
120 | ** #a0 #a1 ***** #r #z #Hr #o * lapply (pointer_compat_from_ind ?? Hr) |
---|
121 | cases r in Hr ⊢ %; #Hr * |
---|
122 | ** #part0 #H0 ** #part1 #H1 *** #EQa0 #EQpart0 #EQa1 #EQpart1 |
---|
123 | destruct normalize |
---|
124 | @eqZb_elim [2,4,6: * #ABS elim (ABS (refl …))] |
---|
125 | @eqZb_elim [2,4,6: * #ABS elim (ABS (refl …))] |
---|
126 | #_ #_ normalize % |
---|
127 | qed. |
---|
128 | |
---|
129 | definition address_of_pointer : pointer → res address ≝ beval_pair_of_pointer. |
---|
130 | |
---|
131 | example address_of_pointer_OK_to_safe : |
---|
132 | ∀p,a.address_of_pointer p = OK … a → is_address a. |
---|
133 | #p |
---|
134 | lapply (refl … p) |
---|
135 | generalize in match p in ⊢ (???%→%); ** |
---|
136 | whd in match (address_of_pointer ?); |
---|
137 | #b #H #o #EQp * #a0 #a1 |
---|
138 | normalize #EQ destruct(EQ) |
---|
139 | %{p} >EQp [1,3: %] |
---|
140 | % [2,4: % [2,4: % [1,3: % [1,3: %]]]] % |
---|
141 | qed. |
---|
142 | |
---|
143 | definition safe_address_of_pointer: pointer → res safe_address ≝ λp. |
---|
144 | do a as EQ ← address_of_pointer p ; return «a ,address_of_pointer_OK_to_safe ?? EQ». |
---|
145 | |
---|
146 | lemma address_of_pointer_is_safe : |
---|
147 | ∀p.address_of_pointer p = ! a ← safe_address_of_pointer p ; return (a : address). |
---|
148 | ****#z #H |
---|
149 | lapply (pointer_compat_from_ind ?? H) * #o |
---|
150 | normalize % |
---|
151 | qed. |
---|
152 | |
---|
153 | definition code_pointer_of_address: address → res (Σp:pointer. ptype p = Code) ≝ |
---|
154 | code_pointer_of_beval_pair. |
---|
155 | |
---|
156 | definition address_of_code_pointer: (Σp:pointer. ptype p = Code) → address ≝ beval_pair_of_code_pointer. |
---|
157 | |
---|
158 | definition safe_address_of_code_pointer: (Σp:pointer. ptype p = Code) → safe_address ≝ address_of_code_pointer. |
---|
159 | cases H -H * #r #b #H #o #EQ destruct(EQ) normalize lapply H |
---|
160 | lapply (pointer_compat_from_ind … H) -H cases b * #z * #H |
---|
161 | %{«mk_pointer ? (mk_block Code z) H o,I»} |
---|
162 | % [2: % [2: % [ % [ % ]] % |]|] |
---|
163 | qed. |
---|
164 | |
---|
165 | (* Paolo: why only code pointers and not XRAM too? *) |
---|
166 | definition addr_add: address → nat → res address ≝ |
---|
167 | λaddr,n. |
---|
168 | do ptr ← code_pointer_of_address addr ; |
---|
169 | OK … (address_of_code_pointer (shift_pointer 16 ptr (bitvector_of_nat … n))). |
---|
170 | normalize cases ptr #p #E @E |
---|
171 | qed. |
---|
172 | |
---|
173 | definition safe_addr_add: safe_address → nat → res safe_address ≝ |
---|
174 | λaddr,n. |
---|
175 | do ptr ← code_pointer_of_address addr ; |
---|
176 | OK … (safe_address_of_code_pointer (shift_pointer 16 ptr (bitvector_of_nat … n))). |
---|
177 | normalize cases ptr #p #E @E |
---|
178 | qed. |
---|
179 | |
---|
180 | definition addr_sub: address → nat → res address ≝ |
---|
181 | λaddr,n. |
---|
182 | do ptr ← code_pointer_of_address addr ; |
---|
183 | OK … (address_of_code_pointer (neg_shift_pointer 16 ptr (bitvector_of_nat … n))). |
---|
184 | normalize cases ptr #p #E @E |
---|
185 | qed. |
---|
186 | |
---|
187 | definition safe_addr_sub: safe_address → nat → res safe_address ≝ |
---|
188 | λaddr,n. |
---|
189 | do ptr ← code_pointer_of_address addr ; |
---|
190 | OK … (safe_address_of_code_pointer (neg_shift_pointer 16 ptr (bitvector_of_nat … n))). |
---|
191 | normalize cases ptr #p #E @E |
---|
192 | qed. |
---|