Fixpoint int_of_one_bits (l: list int) : int :=
  match l with
  | nil => zero
  | a :: b => add (shl one a) (int_of_one_bits b)
  end.

(* Specifications: *)
Theorem one_bits_decomp: forall x, x = int_of_one_bits (one_bits x).
Theorem negate_cmp: forall c x y, cmp (negate_comparison c) x y = negb (cmp c x y).
Theorem negate_cmpu: forall c x y, cmpu (negate_comparison c) x y = negb (cmpu c x y).
Theorem swap_cmp: forall c x y, cmp (swap_comparison c) x y = cmp c y x.
Theorem swap_cmpu: forall c x y, cmpu (swap_comparison c) x y = cmpu c y x.
Lemma translate_eq: forall x y d, eq (add x d) (add y d) = eq x y.
Lemma translate_ltu: forall x y d, 0 <= unsigned x + unsigned d <= max_unsigned -> 0 <= unsigned y + unsigned d <= max_unsigned -> ltu (add x d) (add y d) = ltu x y.
Theorem translate_cmpu: forall c x y d, 0 <= unsigned x + unsigned d <= max_unsigned -> 0 <= unsigned y + unsigned d <= max_unsigned -> cmpu c (add x d) (add y d) = cmpu c x y.
Lemma translate_lt: forall x y d, min_signed <= signed x + signed d <= max_signed -> min_signed <= signed y + signed d <= max_signed -> lt (add x d) (add y d) = lt x y.
Theorem translate_cmp: forall c x y d, min_signed <= signed x + signed d <= max_signed -> min_signed <= signed y + signed d <= max_signed -> cmp c (add x d) (add y d) = cmp c x y.
Theorem notbool_isfalse_istrue: forall x, is_false x -> is_true (notbool x).
Theorem notbool_istrue_isfalse: forall x, is_true x -> is_false (notbool x).
Theorem ltu_range_test: forall x y, ltu x y = true -> unsigned y <= max_signed -> 0 <= signed x < unsigned y.
Theorem lt_sub_overflow: forall x y, xor (sub_overflow x y zero) (negative (sub x y)) = if lt x y then one else zero.
Lemma signed_eq: forall x y, eq x y = zeq (signed x) (signed y).
Lemma not_lt: forall x y, negb (lt y x) = (lt x y || eq x y).
Lemma lt_not: forall x y, lt y x = negb (lt x y) && negb (eq x y).
Lemma not_ltu: forall x y, negb (ltu y x) = (ltu x y || eq x y).
Lemma ltu_not: forall x y, ltu y x = negb (ltu x y) && negb (eq x y).