(* Specifications: *)
Lemma gfield_dec: forall (gf0 gf1: gfield), {gf0 = gf1} + {gf0 <> gf1}.
Lemma rgfs_dec: forall rgfs0 rgfs1: list gfield, {rgfs0 = rgfs1} + {rgfs0 <> rgfs1}.
Lemma struct_Prop_cons2: forall it it' m (A: ident*type -> Type) (P: forall it, A it -> Prop) (v: compact_prod (map A (it::it'::m))), struct_Prop (it :: it' :: m) P v = (P _ (fst v) /\ struct_Prop (it'::m) P (snd v)).
Lemma struct_Prop_ext_derives: forall m {A0 A1} (P0: forall it, A0 it -> Prop) (P1: forall it, A1 it -> Prop) v0 v1, members_no_replicate m = true -> (forall i d0 d1, in_members i m -> P0 _ (proj_struct i m v0 d0) -> P1 _ (proj_struct i m v1 d1)) -> struct_Prop m P0 v0 -> struct_Prop m P1 v1.
Lemma struct_Prop_ext: forall m {A0 A1} (P0: forall it, A0 it -> Prop) (P1: forall it, A1 it -> Prop) v0 v1, members_no_replicate m = true -> (forall i d0 d1, in_members i m -> P0 _ (proj_struct i m v0 d0) = P1 _ (proj_struct i m v1 d1)) -> struct_Prop m P0 v0 = struct_Prop m P1 v1.
Lemma field_compatible_offset_zero: forall {cs: compspecs} t gfs p, field_compatible t gfs p <-> field_compatible t gfs (offset_val 0 p).
Lemma field_address0_offset: forall {cs: compspecs} t gfs p, field_compatible0 t gfs p -> field_address0 t gfs p = offset_val (nested_field_offset t gfs) p.
Lemma field_address_offset: forall {cs: compspecs} t gfs p, field_compatible t gfs p -> field_address t gfs p = offset_val (nested_field_offset t gfs) p.
Lemma field_compatible_array_smaller0: forall {cs: compspecs} t n n' d, field_compatible (Tarray t n' noattr) nil d -> 0 <= n <= n' -> field_compatible (Tarray t n noattr) nil d.
Lemma field_compatible0_array_smaller0: forall {cs: compspecs} t n n' d, field_compatible0 (Tarray t n' noattr) nil d -> 0 <= n <= n' -> field_compatible0 (Tarray t n noattr) nil d.
Lemma field_compatible0_array_smaller1: forall {cs: compspecs} t i j n1 n2 p, field_compatible0 (Tarray t n1 noattr) (ArraySubsc j::nil) p -> 0 <= i <= n2 -> n2 <= n1 -> field_compatible0 (Tarray t n2 noattr) (ArraySubsc i::nil) p.
Lemma field_compatible0_ArraySubsc0: forall {cs: compspecs} t gfs p, field_compatible0 t gfs p -> legal_nested_field0 t (gfs SUB 0) -> field_compatible0 t (gfs SUB 0) p.
Lemma field_compatible_Tarray_split: forall {cs: compspecs} t i n d, 0 <= i <= n -> (field_compatible (tarray t n) nil d <-> field_compatible (tarray t i) nil d /\ field_compatible (tarray t (n-i)) nil (field_address0 (tarray t n) (ArraySubsc i::nil) d)).
Lemma split2_data_at_Tarray {cs: compspecs} sh t n n1 (v v' v1 v2: list (reptype t)) p: 0 <= n1 <= n -> n <= Zlength v' -> v = (sublist 0 n v') -> v1 = (sublist 0 n1 v') -> v2 = (sublist n1 n v') -> data_at sh (Tarray t n noattr) v p = data_at sh (Tarray t n1 noattr) v1 p * data_at sh (Tarray t (n - n1) noattr) v2 (field_address0 (Tarray t n noattr) (ArraySubsc n1::nil) p).
Lemma field_compatible0_Tarray_offset: forall {cs: compspecs} t n i n' i' p p', field_compatible0 (Tarray t n' noattr) (ArraySubsc i' :: nil) p -> naturally_aligned t -> 0 <= n <= n' -> 0 <= i <= n -> n-i <= n'-i' -> i <= i' -> p' = offset_val (sizeof t * (i'-i)) p -> field_compatible0 (Tarray t n noattr) (ArraySubsc i :: nil) p'.
Lemma split3_data_at_Tarray {cs: compspecs} sh t n n1 n2 v (v' v1 v2 v3: list (reptype t)) p: naturally_aligned t -> 0 <= n1 <= n2 -> n2 <= n <= Zlength v' -> v = (sublist 0 n v') -> v1 = (sublist 0 n1 v') -> v2 = (sublist n1 n2 v') -> v3 = (sublist n2 n v') -> data_at sh (Tarray t n noattr) v p = data_at sh (Tarray t n1 noattr) v1 p * data_at sh (Tarray t (n2 - n1) noattr) v2 (field_address0 (Tarray t n noattr) (ArraySubsc n1::nil) p) * data_at sh (Tarray t (n - n2) noattr) v3 (field_address0 (Tarray t n noattr) (ArraySubsc n2::nil) p).
Lemma split2_data_at_Tarray_tuchar {cs: compspecs} sh n n1 (v: list val) p: 0 <= n1 <= n -> Zlength v = n -> data_at sh (Tarray tuchar n noattr) v p = data_at sh (Tarray tuchar n1 noattr) (sublist 0 n1 v) p * data_at sh (Tarray tuchar (n - n1) noattr) (sublist n1 n v) (field_address0 (Tarray tuchar n noattr) (ArraySubsc n1::nil) p).
Lemma split3_data_at_Tarray_tuchar {cs: compspecs} sh n n1 n2 (v: list val) p: 0 <= n1 <= n2 -> n2 <= n -> Zlength v = n -> data_at sh (Tarray tuchar n noattr) v p = data_at sh (Tarray tuchar n1 noattr) (sublist 0 n1 v) p * data_at sh (Tarray tuchar (n2 - n1) noattr) (sublist n1 n2 v) (field_address0 (Tarray tuchar n noattr) (ArraySubsc n1::nil) p) * data_at sh (Tarray tuchar (n - n2) noattr) (sublist n2 n v) (field_address0 (Tarray tuchar n noattr) (ArraySubsc n2::nil) p).
Lemma sizeof_tarray_tuchar {cs} n (N:0<=n): @sizeof cs (tarray tuchar n) = n.
Lemma memory_block_data_at__tarray_tuchar_eq {cs} sh p n (N: 0<=n < Ptrofs.modulus): memory_block sh n p = @data_at_ cs sh (tarray tuchar n) p.
Lemma isptr_field_compatible0_tarray {cs}: forall t (H: complete_legal_cosu_type t = true) p, isptr p -> @field_compatible cs (tarray t 0) nil p.
Lemma data_at_zero_array_eq {cs} sh t (v: list (reptype t)) p: complete_legal_cosu_type t = true -> isptr p -> v = (@nil (reptype t)) -> @data_at cs sh (tarray t 0) v p = emp.
Lemma data_at__tuchar_zero_array_eq {cs} sh p (H: isptr p): @data_at_ cs sh (tarray tuchar 0) p = emp.
Lemma isptr_not_Vundef: forall v, isptr v -> v <> Vundef.
Lemma eval_id_get: forall rho i v, eval_id i rho = v -> v <> Vundef -> Map.get (te_of rho) i = Some v.
Lemma divide_align: forall x y: Z, x > 0 -> Z.divide x y -> align y x = y.
Lemma arith_aux00: forall a b, b <= a -> 0%nat = nat_of_Z (a - b) -> a - b = 0.
Lemma arith_aux01: forall a b n, S n = nat_of_Z (a - b) -> b < a.
Lemma arith_aux02: forall n a b, S n = nat_of_Z (a - b) -> n = nat_of_Z (a - Z.succ b).
Lemma arith_aux03: forall a b c, 0 <= b -> 0 <= a + b * c -> 0 <= a + b * Z.succ c.
Lemma arith_aux05: forall lo hi, 0 <= lo -> 0 <= hi -> 0 <= Z.max 0 (hi - lo) <= hi.
Lemma arith_aux06: forall lo hi n, 0 <= lo <= n -> 0 <= hi <= n -> 0 <= lo + Z.max 0 (hi - lo) <= n.
Lemma denote_tc_assert_andp: forall {CS: compspecs} (a b : tc_assert), denote_tc_assert (tc_andp a b) = andp (denote_tc_assert a) (denote_tc_assert b).
Lemma denote_tc_assert_orp: forall {CS: compspecs} (a b : tc_assert), denote_tc_assert (tc_orp a b) = orp (denote_tc_assert a) (denote_tc_assert b).
Lemma denote_tc_assert_bool: forall {CS: compspecs} b c, denote_tc_assert (tc_bool b c) = prop (b=true).
Lemma tc_andp_TT2: forall e, tc_andp e tc_TT = e.
Lemma tc_andp_TT1: forall e, tc_andp tc_TT e = e.
Lemma typed_true_nullptr: forall v t0 t t', typed_true t0 (force_val (sem_cmp Ceq (tptr t) (tptr t') v (Vint Int.zero))) -> v=nullval.
Lemma typed_true_nullptr': forall {cs: compspecs} t0 t t' v, typed_true t0 (eval_binop Cop.Oeq (tptr t) (tptr t') v nullval) -> v=nullval.
Lemma canon1: forall P1 B P Q R, do_canon (prop P1 && B) (PROPx P (LOCALx Q (SEPx R))) = do_canon B (PROPx (P1::P) (LOCALx Q (SEPx R))).
Lemma canon2: forall Q1 B P Q R, do_canon (local (locald_denote Q1) && B) (PROPx P (LOCALx Q (SEPx R))) = do_canon B (PROPx (P) (LOCALx (Q1::Q) (SEPx R))).
Lemma is_int_dec i s v: {is_int i s v} + {~ is_int i s v}.
Lemma tc_val_dec t v: {tc_val t v} + {~ tc_val t v}.
Lemma sem_add_pi_ptr: forall {cs: compspecs} t p i si, isptr p -> match si with | Signed => Int.min_signed <= i <= Int.max_signed | Unsigned => 0 <= i <= Int.max_unsigned end -> Cop.sem_add_ptr_int cenv_cs t si p (Vint (Int.repr i)) = Some (offset_val (sizeof t * i) p).
Lemma sem_cast_i2i_correct_range: forall sz s v, is_int sz s v -> sem_cast_i2i sz s v = Some v.
Lemma sem_cast_neutral_ptr: forall p, isptr p -> sem_cast_pointer p = Some p.
Lemma sem_cast_neutral_Vint: forall v, sem_cast_pointer (Vint v) = Some (Vint v).
Lemma flat_map_app: forall {A B: Type} (f: A -> list B) l1 l2, flat_map f l1 ++ flat_map f l2 = flat_map f (l1 ++ l2).
Lemma unfold_Ssequence_idempotent: forall c, flat_map unfold_Ssequence (unfold_Ssequence c) = unfold_Ssequence c.
Lemma flat_map_unfold_Ssequence_idempotent: forall ls, flat_map unfold_Ssequence (flat_map unfold_Ssequence ls) = flat_map unfold_Ssequence ls.
Lemma unfold_seq_to_unfold_Ssequence: forall cs, unfold_Ssequence cs = flat_map unfold_Ssequence (unfold_seq cs).
Lemma semax_unfold_seq {Espec: OracleKind} {CS: compspecs} : forall c1 c2, unfold_seq c1 = unfold_seq c2 -> forall P Q Delta, semax Delta P c1 Q -> semax Delta P c2 Q.
Lemma Vint_injective i j (H: Vint i = Vint j): i=j.
Lemma map_Vint_injective: forall l m, map Vint l = map Vint m -> l=m.
Lemma cons_inv {A} (a a':A) l l': a::l = a'::l' -> a=a' /\ l=l'.
Lemma is_neutral_cast_by_value: forall t t', is_neutral_cast t t' = true -> type_is_by_value t = true.
Lemma isptr_force_sem_add_ptr_int: forall {cs: compspecs} t si p i, isptr p -> isptr (force_val (sem_add_ptr_int t si p (Vint (Int.repr i)))).
Lemma mapsto_offset_zero: forall sh t v1 v2, mapsto sh t v1 v2 = mapsto sh t (offset_val 0 v1) v2.
Lemma mapsto__offset_zero: forall sh t v1, mapsto_ sh t v1 = mapsto_ sh t (offset_val 0 v1).
Lemma ptrofs_of_ints_unfold: forall x, Ptrofs.of_ints x = Ptrofs.repr (Int.signed x).
Lemma ptrofs_of_intu_unfold: forall x, Ptrofs.of_intu x = Ptrofs.repr (Int.unsigned x).
Lemma isptr_force_val_sem_cast_neutral : forall p, isptr p -> isptr (force_val (sem_cast_pointer p)).
Lemma closed_wrt_subst: forall {A} id e (P: environ -> A), closed_wrt_vars (eq id) P -> subst id e P = P.
Lemma obox_closed_wrt: forall Delta id P, closed_wrt_vars (eq id) (obox Delta id P).
Lemma odia_closed_wrt: forall Delta id P, closed_wrt_vars (eq id) (odia Delta id P).
Lemma obox_closed: forall Delta i P, temp_guard Delta i -> closed_wrt_vars (eq i) P -> obox Delta i P = P.
Lemma obox_odia: forall Delta i P, temp_guard Delta i -> obox Delta i (odia Delta i P) = odia Delta i P.
Lemma Vptrofs_unfold_false: Archi.ptr64 = false -> Vptrofs = fun x => Vint (Ptrofs.to_int x).
Lemma Vptrofs_unfold_true: Archi.ptr64 = true -> Vptrofs = fun x => Vlong (Ptrofs.to_int64 x).
Lemma modu_repr: forall x y, 0 <= x <= Int.max_unsigned -> 0 <= y <= Int.max_unsigned -> Int.modu (Int.repr x) (Int.repr y) = Int.repr (x mod y).
Lemma reptype_Tarray_JMeq_constr0: forall t gfs t0 n a (v: reptype (nested_field_type t gfs)), legal_nested_field t gfs -> nested_field_type t gfs = Tarray t0 n a -> {v': list (reptype (nested_field_type t (ArraySubsc 0 :: gfs))) | JMeq v v'}.
Lemma reptype_Tarray_JMeq_constr1: forall t gfs t0 n a i (v: reptype (nested_field_type t (ArraySubsc i :: gfs))), legal_nested_field t gfs -> nested_field_type t gfs = Tarray t0 n a -> {v': reptype (gfield_type (nested_field_type t gfs) (ArraySubsc i)) | JMeq v v'}.
Lemma reptype_Tarray_JMeq_constr2: forall t gfs t0 n a i (v': reptype (nested_field_type t (ArraySubsc i :: gfs))), legal_nested_field t gfs -> nested_field_type t gfs = Tarray t0 n a -> {v: reptype (nested_field_type t (ArraySubsc 0 :: gfs)) | JMeq v' v}.
Lemma reptype_Tstruct_JMeq_constr0: forall t gfs id a (v: reptype (nested_field_type t gfs)), legal_nested_field t gfs -> nested_field_type t gfs = Tstruct id a -> {v' : nested_reptype_structlist t gfs (co_members (get_co id)) | JMeq v v'}.
Lemma reptype_Tunion_JMeq_constr0: forall t gfs id a (v: reptype (nested_field_type t gfs)), legal_nested_field t gfs -> nested_field_type t gfs = Tunion id a -> {v' : nested_reptype_unionlist t gfs (co_members (get_co id)) | JMeq v v'}.
Lemma nested_efield_app: forall t gfs0 gfs1 tts0 tts1, length gfs1 = length tts1 -> nested_efield (nested_efield t gfs0 tts0) gfs1 t
Lemma semax_while_peel: forall {CS: compspecs} {Espec: OracleKind} Inv Delta P expr body R, @semax CS Espec Delta P (Ssequence (Sifthenelse expr Sskip Sbreak) body) (loop1_ret_assert Inv R) -> @semax CS Espec Delta Inv (Swhile expr body) R -> @semax CS Espec Delta P (Swhile expr body) R.
Lemma semax_func_cons_ext_vacuous: forall {Espec: OracleKind} (V : varspecs) (G : funspecs) (C : compspecs) (fs : list (ident * Clight.fundef)) (id : ident) (ef : external_function) (argsig : typelist) (retsig : type) (G' : funspecs) cc, (id_in_list id (map fst fs)) = false -> ef_sig ef = {| sig_args := typlist_of_typelist (type_of_params (arglist 1 argsig)); sig_res := opttyp_of_type retsig; sig_cc := cc_of_fundef (External ef argsig retsig cc) |} -> semax_func V G fs G' -> semax_func V G ((id, External ef argsig retsig cc) :: fs) ((id, vacuous_funspec (External ef argsig retsig cc)) :: G').
Lemma int_eq_false_e: forall i j, Int.eq i j = false -> i <> j.
Lemma repr_inj_signed: forall i j, repable_signed i -> repable_signed j -> Int.repr i = Int.repr j -> i=j.
Lemma repr_inj_unsigned: forall i j, 0 <= i <= Int.max_unsigned -> 0 <= j <= Int.max_unsigned -> Int.repr i = Int.repr j -> i=j.
Lemma repr_inj_signed': forall i j, (* The first two premises are not needed to prove this, but are used to limit its applicability *) repable_signed i -> repable_signed j -> Int.repr i <> Int.repr j -> i<>j.
Lemma repr_inj_unsigned': forall i j, 0 <= i <= Int.max_unsigned -> 0 <= j <= Int.max_unsigned -> Int.repr i <> Int.repr j -> i<>j.
Lemma fold_right_map: forall {A B C} (f: B -> A -> A) (g: C -> B) (e: A) (l: list C), fold_right f e (map g l) = fold_right (fun c a => f (g c) a) e l.
Lemma Byte_unsigned_range_32 b: 0 <= Byte.unsigned b <= Int.max_unsigned.
Lemma vn_spec_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_vn vn_spec.
Lemma verify16_spec_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_crypto_verify_16_tweet verify16_spec.
Lemma verify32_spec_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_crypto_verify_32_tweet verify32_spec.
Lemma HFalse_inv16_char: forall l xs ys, HFalse_inv l 16 xs ys -> Zlength xs = 16 -> Zlength ys=16 -> exists sum, Some sum = sumlist xs ys /\ l = QuadChunks2ValList (map littleendian_invert sum).
Lemma TP C1 C2 C3 C4 N1 N2 N3 N4 intsums OUT: Zlength intsums = 16 -> Zlength OUT = 32 -> hPosLoop3 4 (hPosLoop2 4 intsums (C1, C2, C3, C4) (N1, N2, N3, N4)) OUT = QuadByte2ValList (littleendian_invert (Int.sub (Znth 0 intsums) (littleendian C1))) ++ QuadByte2ValList (littleendian_invert (Int.sub (Znth 5 intsums) (littleendian C2))) ++ QuadByte2ValList (littleendian_invert (Int.sub (Znth 10 intsums) (littleendian C3))) ++ QuadByte2ValList (littleendian_invert (Int.sub (Znth 15 intsums) (littleendian C4))) ++ QuadByte2ValList (littleendian_invert (Int.sub (Znth 6 intsums) (littleendian N1))) ++ QuadByte2ValList (littleendian_invert (Int.sub (Znth 7 intsums) (littleendian N2))) ++ QuadByte2ValList (littleendian_invert (Int.sub (Znth 8 intsums) (littleendian N3))) ++ QuadByte2ValList (littleendian_invert (Int.sub (Znth 9 intsums) (littleendian N4))).
Lemma int_max_unsigned_int64_max_unsigned: Int.max_unsigned < Int64.max_unsigned.
Lemma int_max_signed_int64_max_signed: Int.max_signed < Int64.max_signed.
Lemma byte_unsigned_max_eq: Byte.max_unsigned = 255.
Lemma Byte_unsigned_range_32 b: 0 <= Byte.unsigned b <= Int.max_unsigned.
Lemma Int64_sub_sub a b c: Int64.min_signed <= - c <= Int64.max_signed -> Int64.min_signed <= - b <= Int64.max_signed -> Int64.sub a (Int64.repr (b + c)) = Int64.sub (Int64.sub a (Int64.repr b)) (Int64.repr c).
Lemma sublist_hi_plus {A} (l:list A) lo a b: 0<=lo<=a -> 0<=b -> sublist lo (a + b) l = sublist lo a l ++ sublist a (a+b) l.
Lemma sublist0_hi_plus {A} (l:list A) a b: 0<=a -> 0<=b -> sublist 0 (a + b) l = sublist 0 a l ++ sublist a (a+b) l.
Lemma byte_unsigned_range_3 b: 0 <= Byte.unsigned b <= Int.max_unsigned.
Lemma Int_unsigned_repr_byte b: Int.unsigned (Int.repr (Byte.unsigned b)) = Byte.unsigned b.
Lemma zero_ext8_byte b: Int.zero_ext 8 (Int.repr (Byte.unsigned b)) = Int.repr (Byte.unsigned b).
Lemma Zlxor_range_byte b1 b2: 0<= Z.lxor (Byte.unsigned b1) (Byte.unsigned b2) <= Byte.max_unsigned.
Lemma Znth_sublist': forall (A : Type){d: Inhabitant A} (lo i hi : Z) (al : list A), 0 <= lo -> Zlength al <= hi -> 0 <= i <= hi - lo -> Znth i (sublist lo hi al) = Znth (i + lo) al.
Lemma xor_byte_int b1 b2: Int.xor (Int.repr (Byte.unsigned b1)) (Int.repr (Byte.unsigned b2)) = Int.repr (Byte.unsigned (Byte.xor b1 b2)).
Lemma Zlength_combinelist {A} f xs ys l: combinelist A f xs ys = Some l -> Zlength l = Zlength ys.
Lemma Tarray_0_emp_iff sh c: field_compatible (Tarray tuchar 0 noattr) [] c -> data_at sh (Tarray tuchar 0 noattr) nil c = emp.
Lemma Tarray_0_emp_iff_ sh c: field_compatible (Tarray tuchar 0 noattr) [] c -> data_at_ sh (Tarray tuchar 0 noattr) c = emp.
Lemma bxorlist_app xs2 ys2: forall xs1 ys1 zs1 zs2, bxorlist xs1 ys1 = Some zs1 -> bxorlist xs2 ys2 = Some zs2 -> bxorlist (xs1 ++ xs2) (ys1 ++ ys2) = Some(zs1 ++ zs2).
Lemma Int64_ltu_false x y: Int64.ltu x y = false -> 0 <= Int64.unsigned y <= Int64.unsigned x.
Lemma Zlength_Bl2VL l: Zlength (Bl2VL l) = Zlength l.
Lemma Bl2VL_app l m: Bl2VL (l ++ m) = Bl2VL l ++ Bl2VL m.
Lemma ZZ_is_byte: forall n zbytes u U, ZZ zbytes n = (u,U) -> 0<= Int.unsigned u <256.
Lemma crypto_stream_salsa20_tweet_ok: semax_body SalsaVarSpecs (*(crypto_stream_salsa20_xor_spec::*)SalsaFunSpecs f_crypto_stream_salsa20_tweet f_crypto_stream_salsa20_tweet_spec.
Lemma crypto_stream_xsalsa20_tweet_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_crypto_stream_xsalsa20_tweet f_crypto_stream_xsalsa20_tweet_spec.
Lemma crypto_stream_xsalsa20_tweet_xor_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_crypto_stream_xsalsa20_tweet_xor f_crypto_stream_xsalsa20_tweet_xor_spec.
Lemma L32_spec_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_L32 L32_spec.
Lemma ld32_spec_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_ld32 ld32_spec.
Lemma crypto_core_salsa20_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_crypto_core_salsa20_tweet crypto_core_salsa20_spec.
Lemma Snuffle_sub_simpl data x: Snuffle20 (prepare_data data) = Some x -> exists s, Snuffle 20 (prepare_data data) = Some s /\ forall i (I:0 <= i < 16) v, Znth i (prepare_data data) = v -> littleendian_invert (Int.sub (Znth i x) v) = littleendian_invert (Znth i s).
Lemma crypto_core_hsalsa20_ok: semax_body SalsaVarSpecs SalsaFunSpecs f_crypto_core_hsalsa20_tweet crypto_core_hsalsa20_spec.
Lemma unsigned_add: forall i pos, 0 <= pos -> Ptrofs.unsigned (Ptrofs.add i (Ptrofs.repr pos)) = (Ptrofs.unsigned i + pos) mod Ptrofs.modulus.
Lemma Arith_aux1: forall i pos z, 0 <= pos /\ pos + z <= Ptrofs.modulus - Ptrofs.unsigned i -> Ptrofs.unsigned (Ptrofs.add i (Ptrofs.repr pos)) + z <= Ptrofs.modulus.
Lemma offset_in_range_0 v: offset_in_range 0 v.
Lemma offset_in_range_le n m d: offset_in_range n d -> 0<=m<=n -> offset_in_range m d.
Lemma offset_in_range_offset_val z1 z2 v (Z1: 0 <= z1) (Z2: 0 <= z2) (Off : offset_in_range (z1 + z2) v): offset_in_range z2 (offset_val z1 v).
Lemma sizeof_Zlength_nonneg {A} {ge: composite_env} t (d:list A): 0 <= sizeof t * Zlength d.
Lemma SnuffleS i l: Snuffle (S i) l = bind (Snuffle i l) (Snuffle 1).
Lemma Zlength_list_repeat' {A} n (v:A): Zlength (list_repeat n v) = Z.of_nat n.
Lemma Zlength_cons' {A} (a:A) l: Zlength (a::l) = 1 + Zlength l.
Lemma isptrD v: isptr v -> exists b ofs, v = Vptr b ofs.
Lemma firstn_Zlength {A} (l:list A) n: (n <= length l)%nat -> Zlength (firstn n l) = Z.of_nat n.
Lemma skipn_Zlength {A} (l:list A) n: (n <= length l)%nat -> Zlength (skipn n l) = Zlength l - (Z.of_nat n).
Lemma map_cons_inv {A B} (f:A -> B) a l fT: (f a:: fT) = map f l -> exists b T, l = b :: T /\ f a = f b /\ fT = map f T.
Lemma inj_le': forall n m : nat, (Z.of_nat n <= Z.of_nat m <-> (n <= m)%nat).
Lemma Byte_max_unsigned_Int_max_unsigned: Byte.max_unsigned < Int.max_unsigned.
Lemma force_lengthn_map {A B} (f:A->B) n: forall l d fd, fd = f d -> force_lengthn n (map f l) fd = map f (force_lengthn n l d).
Lemma force_lengthn_mapN {A B} (f:A->B) n: forall l d fd, (n < length l)%nat -> force_lengthn n (map f l) fd = map f (force_lengthn n l d).
Lemma In_force_lengthn {A} d u: forall n l, @In A u (force_lengthn n l d) -> In u l \/ u=d.
Lemma In_force_lengthn_n {A} d u: forall n l (L:(length l >=n)%nat), @In A u (force_lengthn n l d) -> In u l.
Lemma In_skipn {A} (u:A): forall n l, In u (skipn n l) -> In u l.
Lemma nth_force_lengthn': forall (A : Type) (n i : nat) (xs : list A) (default d: A) (N: (n < length xs)%nat), (0 <= i < n)%nat -> @nth A i (@force_lengthn A n xs default) d = @nth A i xs d.
Lemma app_Znth1: forall (A : Type){d: Inhabitant A} (l l' : list A) (n :Z), (n < Zlength l) -> Znth n (l ++ l') = Znth n l.
Lemma app_Znth2: forall (A : Type) {d: Inhabitant A}(l l' : list A) (n : Z), (Zlength l <= n) -> Znth n (l ++ l') = Znth (n - Zlength l) l'.
Lemma nth_extensional {A}: forall l1 l2 (L:length l1 = length l2) (d:A) (N: forall i, (0<=i<length l1)%nat -> nth i l1 d = nth i l2 d), l1=l2.
Lemma Znth_extensional {A} {d: Inhabitant A}(l1 l2 : list A): Zlength l1 = Zlength l2 -> (forall i, (0 <= i < Zlength l1) -> Znth i l1 = Znth i l2) -> l1 = l2.
Lemma force_lengthn_app1 {A}{d: Inhabitant A}: forall n l1 l2, length l1 =n -> force_lengthn n (l1 ++ l2) d = l1.
Lemma listD16 {A} (l:list A): Zlength l = 16 -> exists v0 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15, l = [v0; v1; v2; v3; v4; v5; v6; v7; v8; v9; v10; v11; v12; v13; v14; v15].
Lemma listGE16 {A} (l:list A): 16 <= Zlength l -> exists v0 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 t, l = [v0; v1; v2; v3; v4; v5; v6; v7; v8; v9; v10; v11; v12; v13; v14; v15] ++ t /\ Zlength t = Zlength l - 16.
Theorem Bernoulli_wf : forall r, well_formed_comp (Bernoulli r).
Lemma mult_same_r : forall n1 n2 n3, n3 > 0 -> n1 * n3 = n2 * n3 -> n1 = n2.
Lemma mult_same_l : forall n3 n1 n2, n3 > 0 -> n3 * n1 = n3 * n2 -> n1 = n2.
Lemma mult_gt_0 : forall n1 n2, n1 > 0 -> n2 > 0 -> n1 * n2 > 0.
Lemma minus_eq_compat : forall n1 n2 n3 n4, n1 = n2 -> n3 = n4 -> n1 - n3 = n2 - n4.
Lemma plus_eq_compat : forall n1 n2 n3 n4, n1 = n2 -> n3 = n4 -> n1 + n3 = n2 + n4.
Lemma minus_diag_eq : forall n1 n2, n1 = n2 -> n1 - n2 = 0.
Lemma le_eq : forall n1 n2, n1 = n2 -> n1 <= n2.
Lemma minus_add_assoc : forall n1 n2 n3, (n3 <= n2)%nat -> (n1 + (n2 - n3) = n1 + n2 - n3)%nat.
Theorem oracleMap_wf : forall (D R S : Set)(eqds : EqDec S)(eqdr : EqDec R) (oracle : S -> D -> Comp (R * S))ds s, (forall s x, well_formed_comp (oracle s x)) -> well_formed_comp (@oracleMap D R S _ _ oracle s ds).
Theorem qam_count_gen : forall (A B C : Set)(c : OracleComp A B C)(q : nat), queries_at_most c q -> forall (S : Set)(count : S -> nat)(eqds : EqDec S)(o : S -> A -> Comp (B * S))(s : S)(n : nat), (forall a b x y, In (a, b) (getSupport (o x y)) -> count b <= n + (count x)) -> forall a b, In (a, b) (getSupport (c _ _ o s)) -> count b <= q * n + (count s).
Theorem qam_count : forall (A B C : Set)(c : OracleComp A B C)(q : nat), queries_at_most c q -> forall (S : Set)(count : S -> nat)(eqds : EqDec S)(o : S -> A -> Comp (B * S))(s : S), (forall a b x y, In (a, b) (getSupport (o x y)) -> count b <= 1 + (count x)) -> count s = 0 -> forall a b, In (a, b) (getSupport (c _ _ o s)) -> count b <= q.
Theorem le_epsilon_zero : forall (a : A), (forall (epsilon : A), ~eq epsilon zero -> le a epsilon) -> eq a zero.
Theorem RndGrpElem_wf : well_formed_comp RndGrpElem.
Theorem groupExp_closed : forall k, In (g^k) (getSupport RndGrpElem).
Theorem RndGrpElem_spec : forall x y, comp_spec (fun a b => a = x <-> b = y) RndGrpElem RndGrpElem.
Lemma evalDist_in_f : forall (A B : Set)(c1 : Comp A)(c2 : Comp B)(f : A -> B), (forall a, eqRat (evalDist c1 a) (evalDist c2 (f a))) -> (forall a, In a (getSupport c1) <-> In (f a) (getSupport c2)).
Lemma perm_map_in : forall (A B : Set)(lsa : list A)(lsb : list B)(f : A -> B)(f_inv : B -> A), (forall b, In b lsb -> f (f_inv b) = b) -> (forall a, In a lsa <-> In (f a) lsb) -> NoDup (map f lsa) -> NoDup lsb -> Permutation (map f lsa) lsb.
Lemma not_in_map : forall (A B : Set)(ls : list A)(f : A -> B)(f_inv : B -> A)(a : A), (forall a, f_inv (f a) = a) -> ~In a ls -> ~In (f a) (map f ls).
Lemma map_NoDup : forall (A B : Set)(ls : list A)(f : A -> B)(f_inv : B -> A), (forall a, In a ls -> f_inv (f a) = a) -> NoDup ls -> NoDup (map f ls).
Lemma support_NoDup : forall (A : Set)(c : Comp A), NoDup (getSupport c).
Lemma filter_NoDup : forall (A : Set)(ls : list A)(P : A -> bool), NoDup ls -> NoDup (filter P ls).
Lemma evalDist_getSupport_perm : forall (A B : Set)(c1 : Comp A)(c2 : Comp B) (f : A -> B)(f_inv : B -> A), (forall b, In b (getSupport c2) -> (f (f_inv b)) = b) -> (forall a, In a (getSupport c1) -> (f_inv (f a)) = a) -> (forall a, In a (getSupport c1) -> eqRat (evalDist c1 a) (evalDist c2 (f a))) -> (forall a, In a (getSupport c2) -> eqRat (evalDist c2 a) (evalDist c1 (f_inv a))) -> Permutation (map f (getSupport c1)) (getSupport c2).
Lemma evalDist_getSupport_filter_perm : forall (A: Set)(c1 : Comp A)(c2 : Comp A)(P : A -> bool), (forall a, P a = true -> eqRat (evalDist c1 a) (evalDist c2 a)) -> Permutation (filter P (getSupport c1)) (filter P (getSupport c2)).
Lemma evalDist_getSupport_perm_id : forall (A : Set)(c1 c2 : Comp A), (forall a, eqRat (evalDist c1 a) (evalDist c2 a)) -> Permutation (getSupport c1) (getSupport c2).
Theorem evalDist_assoc_eq : forall (A : Set)(c1 : Comp A)(B C : Set)(c2 : A -> Comp B)(c3 : B -> Comp C), dist_sem_eq (Bind (Bind c1 c2) c3) (Bind c1 (fun a => (Bind (c2 a) c3))).
Theorem O1_count_wf : forall a b, well_formed_comp (O1_count a b).
Theorem Oi_wf : forall i a b, well_formed_comp (Oi i a b).
Theorem O1_count_increases : forall d1 b1 c1 a2 b2 c2, In (d1, (b1, c1)) (getSupport (O1_count (b2, c2) a2)) -> c1 = S c2.
Theorem Oi_count_increases : forall i d1 b1 c1 a2 b2 c2, In (d1, (b1, c1)) (getSupport (Oi i (b2, c2) a2)) -> c1 = S c2.
Theorem O1_count_Oi_eq_until_bad : forall s s_A, comp_spec (fun a b => ((snd (snd a) > q) <-> (snd (snd b) > q)) /\ ((snd (snd a) <= q)%nat -> (fst a = fst b /\ fst (snd a) = fst (snd b)))) ((A1 s_A) _ _ O1_count (s, 0)%nat) ((A1 s_A) _ _ (Oi q) (s, 0)%nat).
Theorem OMH_G_oc_wf : forall p
Theorem DistSingle_impl_Mult : DistMult_Adv _ c1 c2 A1 A2 n <= (n / 1) * (DistSingle_Adv c1 c2 B1 B2).
Theorem DistMult_impl_RepeatCore : RepeatCore_Adv P c1 c2 A1 A2 <= DistMult_Adv _ c1 c2 A1 DM_RC_B2 n + expRat k1 n + expRat k2 n.
Theorem removeFirst_In_length : forall (A : Set)(eqd : EqDec A)(ls : list A)(a : A), In a ls -> length (removeFirst (EqDec_dec _ ) ls a) = pred (length ls).
Theorem skipn_ge_nil : forall (A : Type)(ls : list A)(n : nat), n >= length ls -> skipn n ls = nil.
Theorem skipn_lt_nil_false : forall (A : Type)(ls : list A)(n : nat), n < length ls -> skipn n ls = nil -> False.
Theorem hd_skip_eq_nth : forall (A : Type)(def : A)(ls : list A)(n : nat), hd def (skipn n ls) = nth n ls def.
Theorem tl_skipn_eq : forall (A : Type)(ls : list A)(n : nat), tl (skipn n ls) = skipn (S n) ls.
Theorem skipn_gt_nil : forall (A : Type)(ls : list A)(n : nat), n >= length ls -> skipn n ls = nil.
Theorem firstn_firstn : forall (A : Type)(ls : list A)(n1 n2 : nat), (n1 <= n2)%nat -> firstn n1 (firstn n2 ls) = firstn n1 ls.
Theorem nth_firstn : forall (A : Set)(def : A)(ls : list A)(n1 n2 : nat), (n1 < n2)%nat -> nth n1 (firstn n2 ls) def = nth n1 ls def.
Theorem Single_impl_ListHybrid_sum : ListHybrid_Advantage <= sumList (forNats maxA) (fun i => DistSingle_Adv c1 c2 (B1 i) B2).
Theorem Single_impl_ListHybrid : ListHybrid_Advantage <= maxA / 1 * maxDistance.
Theorem rndListElem_wf : forall (ls : list A), well_formed_comp (rndListElem ls).
Theorem nth_option_In : forall (A : Set)(ls : list A)(a : A) i, nth_option ls i = Some a -> In a ls.
Theorem ratSubtract_leRat_same_r : forall r1 r2 r3, r3 <= r1 -> r3 <= r2 -> ratSubtract r1 r3 <= ratSubtract r2 r3 -> r1 <= r2.
Theorem filter_ext : forall (A : Set)(ls : list A)(f1 f2 : A -> bool), (forall a, f1 a = f2 a) -> filter f1 ls = filter f2 ls.
Theorem list_choice : forall (A B : Type)(eqd : forall (a1 a2 : A), {a1 = a2} + {a1 <> a2}) P (ls : list A) (b : B), (forall a, In a ls -> exists (b : B), P a b) -> exists (f : A -> B), (forall a, In a ls -> P a (f a)).
Theorem comp_spec_seq : forall {A B : Set} P' {C D : Set} P{eqda : EqDec A}{eqdb : EqDec B}{eqdc : EqDec C}{eqdd : EqDec D}(c1 : Comp A)(c2 : Comp B) (c : C) (d : D) (f1 : A -> Comp C)(f2 : B -> Comp D), comp_spec P' c1 c2 -> (forall a b, In a (getSupport c1) -> In b (getSupport c2) -> P' a b -> comp_spec P (f1 a) (f2 b)) -> comp_spec P (Bind c1 f1) (Bind c2 f2).
Lemma map_Ret_repeat : forall (A : Set)(eqd : eq_dec A)(a : A) ls ls', rel_map (evalDet (Ret eqd a)) ls ls' -> ls' = listRepeat (ca_done a) (length ls).
Lemma Tsh_split: forall sh, exists sh', sepalg.join sh sh' Tsh.
Lemma body_head_pointer_switch: semax_body Vprog Gprog f_head_pointer_switch head_pointer_switch_spec.
Lemma body_head_head_switch: semax_body Vprog Gprog f_head_head_switch head_head_switch_spec.
Lemma if_trueb: forall {A: Type} b (a1 a2: A), b = true -> (if b then a1 else a2) = a1.
Lemma if_falseb: forall {A: Type} b (a1 a2: A), b = false -> (if b then a1 else a2) = a2.
Lemma if_trueb: forall {A: Type} b (a1 a2: A), b = true -> (if b then a1 else a2) = a1.
Lemma if_falseb: forall {A: Type} b (a1 a2: A), b = false -> (if b then a1 else a2) = a2.
Lemma functional_extensionality_dep: forall {A: Type} {B : A -> Type} (f g : forall x : A, B x), (forall x, f x = g x) -> f = g.
Lemma functional_extensionality: forall {A B: Type} (f g : A -> B), (forall x, f x = g x) -> f = g.
Lemma extensionality: forall {A B: Type} (f g : A -> B), (forall x, f x = g x) -> f = g.
Theorem Zopp_le_cancel : forall x y : Z, (-y <= -x)%Z -> Zle x y.
Theorem Zgt_not_eq : forall x y : Z, (y < x)%Z -> (x <> y)%Z.
Theorem round_val_of_pred : forall rnd : R -> R -> Prop, round_pred rnd -> forall x, { f : R | rnd x f }.
Theorem round_fun_of_pred : forall rnd : R -> R -> Prop, round_pred rnd -> { f : R -> R | forall x, rnd x (f x) }.
Theorem round_unicity : forall rnd : R -> R -> Prop, round_pred_monotone rnd -> forall x f1 f2, rnd x f1 -> rnd x f2 -> f1 = f2.
Theorem Rnd_DN_pt_monotone : forall F : R -> Prop, round_pred_monotone (Rnd_DN_pt F).
Theorem Rnd_DN_pt_unicity : forall F : R -> Prop, forall x f1 f2 : R, Rnd_DN_pt F x f1 -> Rnd_DN_pt F x f2 -> f1 = f2.
Theorem Rnd_DN_unicity : forall F : R -> Prop, forall rnd1 rnd2 : R -> R, Rnd_DN F rnd1 -> Rnd_DN F rnd2 -> forall x, rnd1 x = rnd2 x.
Theorem Rnd_UP_pt_monotone : forall F : R -> Prop, round_pred_monotone (Rnd_UP_pt F).
Theorem Rnd_UP_pt_unicity : forall F : R -> Prop, forall x f1 f2 : R, Rnd_UP_pt F x f1 -> Rnd_UP_pt F x f2 -> f1 = f2.
Theorem Rnd_UP_unicity : forall F : R -> Prop, forall rnd1 rnd2 : R -> R, Rnd_UP F rnd1 -> Rnd_UP F rnd2 -> forall x, rnd1 x = rnd2 x.
Theorem Rnd_DN_UP_pt_sym : forall F : R -> Prop, ( forall x, F x -> F (- x) ) -> forall x f : R, Rnd_DN_pt F x f -> Rnd_UP_pt F (-x) (-f).
Theorem Rnd_UP_DN_pt_sym : forall F : R -> Prop, ( forall x, F x -> F (- x) ) -> forall x f : R, Rnd_UP_pt F x f -> Rnd_DN_pt F (-x) (-f).
Theorem Rnd_DN_UP_sym : forall F : R -> Prop, ( forall x, F x -> F (- x) ) -> forall rnd1 rnd2 : R -> R, Rnd_DN F rnd1 -> Rnd_UP F rnd2 -> forall x, rnd1 (- x) = - rnd2 x.
Theorem Rnd_DN_UP_pt_split : forall F : R -> Prop, forall x d u, Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> forall f, F f -> (f <= d) \/ (u <= f).
Theorem Rnd_DN_pt_refl : forall F : R -> Prop, forall x : R, F x -> Rnd_DN_pt F x x.
Theorem Rnd_DN_pt_idempotent : forall F : R -> Prop, forall x f : R, Rnd_DN_pt F x f -> F x -> f = x.
Theorem Rnd_UP_pt_refl : forall F : R -> Prop, forall x : R, F x -> Rnd_UP_pt F x x.
Theorem Rnd_UP_pt_idempotent : forall F : R -> Prop, forall x f : R, Rnd_UP_pt F x f -> F x -> f = x.
Theorem Only_DN_or_UP : forall F : R -> Prop, forall x fd fu f : R, Rnd_DN_pt F x fd -> Rnd_UP_pt F x fu -> F f -> (fd <= f <= fu)%R -> f = fd \/ f = fu.
Theorem Rnd_ZR_abs : forall (F : R -> Prop) (rnd: R-> R), Rnd_ZR F rnd -> forall x : R, (Rabs (rnd x) <= Rabs x)%R.
Theorem Rnd_ZR_pt_monotone : forall F : R -> Prop, F 0 -> round_pred_monotone (Rnd_ZR_pt F).
Theorem Rnd_N_pt_DN_or_UP : forall F : R -> Prop, forall x f : R, Rnd_N_pt F x f -> Rnd_DN_pt F x f \/ Rnd_UP_pt F x f.
Theorem Rnd_N_pt_DN_or_UP_eq : forall F : R -> Prop, forall x fd fu f : R, Rnd_DN_pt F x fd -> Rnd_UP_pt F x fu -> Rnd_N_pt F x f -> f = fd \/ f = fu.
Theorem Rnd_N_pt_sym : forall F : R -> Prop, ( forall x, F x -> F (- x) ) -> forall x f : R, Rnd_N_pt F (-x) (-f) -> Rnd_N_pt F x f.
Theorem Rnd_N_pt_monotone : forall F : R -> Prop, forall x y f g : R, Rnd_N_pt F x f -> Rnd_N_pt F y g -> x < y -> f <= g.
Theorem Rnd_N_pt_unicity : forall F : R -> Prop, forall x d u f1 f2 : R, Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> x - d <> u - x -> Rnd_N_pt F x f1 -> Rnd_N_pt F x f2 -> f1 = f2.
Theorem Rnd_N_pt_refl : forall F : R -> Prop, forall x : R, F x -> Rnd_N_pt F x x.
Theorem Rnd_N_pt_idempotent : forall F : R -> Prop, forall x f : R, Rnd_N_pt F x f -> F x -> f = x.
Theorem Rnd_N_pt_0 : forall F : R -> Prop, F 0 -> Rnd_N_pt F 0 0.
Theorem Rnd_N_pt_pos : forall F : R -> Prop, F 0 -> forall x f, 0 <= x -> Rnd_N_pt F x f -> 0 <= f.
Theorem Rnd_N_pt_neg : forall F : R -> Prop, F 0 -> forall x f, x <= 0 -> Rnd_N_pt F x f -> f <= 0.
Theorem Rnd_N_pt_abs : forall F : R -> Prop, F 0 -> ( forall x, F x -> F (- x) ) -> forall x f : R, Rnd_N_pt F x f -> Rnd_N_pt F (Rabs x) (Rabs f).
Theorem Rnd_DN_UP_pt_N : forall F : R -> Prop, forall x d u f : R, F f -> Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> (Rabs (f - x) <= x - d)%R -> (Rabs (f - x) <= u - x)%R -> Rnd_N_pt F x f.
Theorem Rnd_DN_pt_N : forall F : R -> Prop, forall x d u : R, Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> (x - d <= u - x)%R -> Rnd_N_pt F x d.
Theorem Rnd_UP_pt_N : forall F : R -> Prop, forall x d u : R, Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> (u - x <= x - d)%R -> Rnd_N_pt F x u.
Theorem Rle_0_minus : forall x y, (x <= y)%R -> (0 <= y - x)%R.
Theorem Rabs_eq_Rabs : forall x y : R, Rabs x = Rabs y -> x = y \/ x = Ropp y.
Theorem Rabs_minus_le: forall x y : R, (0 <= y)%R -> (y <= 2*x)%R -> (Rabs (x-y) <= x)%R.
Theorem Rplus_eq_reg_r : forall r r1 r2 : R, (r1 + r = r2 + r)%R -> (r1 = r2)%R.
Theorem Rplus_lt_reg_l : forall r r1 r2 : R, (r + r1 < r + r2)%R -> (r1 < r2)%R.
Theorem Rplus_lt_reg_r : forall r r1 r2 : R, (r1 + r < r2 + r)%R -> (r1 < r2)%R.
Theorem Rplus_le_reg_r : forall r r1 r2 : R, (r1 + r <= r2 + r)%R -> (r1 <= r2)%R.
Theorem Rmult_lt_reg_r : forall r r1 r2 : R, (0 < r)%R -> (r1 * r < r2 * r)%R -> (r1 < r2)%R.
Theorem Rmult_le_reg_r : forall r r1 r2 : R, (0 < r)%R -> (r1 * r <= r2 * r)%R -> (r1 <= r2)%R.
Theorem Rmult_lt_compat : forall r1 r2 r3 r4, (0 <= r1)%R -> (0 <= r3)%R -> (r1 < r2)%R -> (r3 < r4)%R -> (r1 * r3 < r2 * r4)%R.
Theorem Rmult_eq_reg_r : forall r r1 r2 : R, (r1 * r)%R = (r2 * r)%R -> r <> 0%R -> r1 = r2.
Theorem Rmult_minus_distr_r : forall r r1 r2 : R, ((r1 - r2) * r = r1 * r - r2 * r)%R.
Lemma Rmult_neq_reg_r: forall r1 r2 r3:R, (r2 * r1 <> r3 * r1)%R -> r2 <> r3.
Lemma Rmult_neq_compat_r: forall r1 r2 r3:R, (r1 <> 0)%R -> (r2 <> r3)%R -> (r2 *r1 <> r3*r1)%R.
Theorem Rmult_min_distr_r : forall r r1 r2 : R, (0 <= r)%R -> (Rmin r1 r2 * r)%R = Rmin (r1 * r) (r2 * r).
Theorem Rmult_min_distr_l : forall r r1 r2 : R, (0 <= r)%R -> (r * Rmin r1 r2)%R = Rmin (r * r1) (r * r2).
Lemma Rmin_opp: forall x y, (Rmin (-x) (-y) = - Rmax x y)%R.
Lemma Rmax_opp: forall x y, (Rmax (-x) (-y) = - Rmin x y)%R.
Theorem exp_le : forall x y : R, (x <= y)%R -> (exp x <= exp y)%R.
Theorem Rinv_lt : forall x y, (0 < x)%R -> (x < y)%R -> (/y < /x)%R.
Theorem Rinv_le : forall x y, (0 < x)%R -> (x <= y)%R -> (/y <= /x)%R.
Theorem sqrt_ge_0 : forall x : R, (0 <= sqrt x)%R.
Lemma sqrt_neg : forall x, (x <= 0)%R -> (sqrt x = 0)%R.
Theorem Rabs_le : forall x y, (-y <= x <= y)%R -> (Rabs x <= y)%R.
Theorem Rabs_le_inv : forall x y, (Rabs x <= y)%R -> (-y <= x <= y)%R.
Theorem Rabs_ge : forall x y, (y <= -x \/ x <= y)%R -> (x <= Rabs y)%R.
Theorem Rabs_ge_inv : forall x y, (x <= Rabs y)%R -> (y <= -x \/ x <= y)%R.
Theorem Rabs_lt : forall x y, (-y < x < y)%R -> (Rabs x < y)%R.
Theorem Rabs_lt_inv : forall x y, (Rabs x < y)%R -> (-y < x < y)%R.
Theorem Rabs_gt : forall x y, (y < -x \/ x < y)%R -> (x < Rabs y)%R.
Theorem Rabs_gt_inv : forall x y, (x < Rabs y)%R -> (y < -x \/ x < y)%R.
Lemma body_initialize_writer : semax_body Vprog Gprog f_initialize_writer initialize_writer_spec.
Lemma body_start_write : semax_body Vprog Gprog f_start_write start_write_spec.
Lemma find_write_rest : forall d h, exists n, snd (find_write h d) = skipn n h.
Lemma body_surely_malloc: semax_body Vprog Gprog f_surely_malloc surely_malloc_spec.
Lemma body_memset : semax_body Vprog Gprog f_memset memset_spec.
Lemma body_initialize_channels : semax_body Vprog Gprog f_initialize_channels initialize_channels_spec.
Lemma body_reader : semax_body Vprog Gprog f_reader reader_spec.
Lemma sepcon_filter_combine : forall {A} P (l : list A) l', Zlength l' = Zlength l -> fold_right sepcon emp (map P l) = fold_right sepcon emp (map P (map snd (filter fst (combine l' l)))) * fold_right sepcon emp (map P (map snd (filter (fun '(b, _) => negb b) (combine l' l)))).
Lemma data_at_shares_join' : forall {cs} sh v p shs sh1 (Hsplit : sepalg_list.list_join sh1 shs sh), readable_share sh1 -> @data_at cs sh1 tint (Vint v) p * fold_right_sepcon (map (fun sh => EX v : _, data_at sh tint (Vint v) p) shs) = data_at sh tint (Vint v) p.
Lemma map_snd_filter_fst : forall {A B C} f (g : B -> C) (l : list (A * B)), filter (fun '(a, _) => f a) (map (fun '(a, b) => (a, g b)) l) = map (fun '(a, b) => (a, g b)) (filter (fun '(a, _) => f a) l).
Lemma body_writer : semax_body Vprog Gprog f_writer writer_spec.
Lemma comm_loc_share_join : forall good lsh1 lsh2 lsh comm g g0 g1 g2 bufs sh gsh h1 h2 h (Hsh : sepalg.join lsh1 lsh2 lsh) (Hh : Permutation.Permutation (h1 ++ h2) h) (Hsh1 : lsh1 <> Share.bot) (Hsh2 : lsh2 <> Share.bot) (Hdisj : disjoint h1 h2), comm_loc good lsh1 comm g g0 g1 g2 bufs sh gsh h1 * comm_loc good lsh2 comm g g0 g1 g2 bufs sh gsh h2 = comm_loc good lsh comm g g0 g1 g2 bufs sh gsh h.
Lemma body_main : semax_body Vprog Gprog f_main main_spec.
Lemma body_reader : semax_body Vprog Gprog f_reader reader_spec.
Lemma body_initialize_reader : semax_body Vprog Gprog f_initialize_reader initialize_reader_spec.
Lemma body_start_read : semax_body Vprog Gprog f_start_read start_read_spec.
Lemma body_finish_read : semax_body Vprog Gprog f_finish_read finish_read_spec.
Lemma body_surely_malloc: semax_body Vprog Gprog f_surely_malloc surely_malloc_spec.
Lemma body_memset : semax_body Vprog Gprog f_memset memset_spec.
Lemma malloc_compatible_isptr: forall {cs: compspecs} t p, malloc_compatible (sizeof t) p -> isptr p.
Lemma body_initialize_channels : semax_body Vprog Gprog f_initialize_channels initialize_channels_spec.
Lemma body_writer : semax_body Vprog Gprog f_writer writer_spec.
Lemma body_main : semax_body Vprog Gprog f_main main_spec.
Lemma body_initialize_writer : semax_body Vprog Gprog f_initialize_writer initialize_writer_spec.
Lemma body_start_write : semax_body Vprog Gprog f_start_write start_write_spec.
Lemma find_write_rest : forall d h, exists n, snd (find_write h d) = skipn n h.
Lemma body_initialize_reader : semax_body Vprog Gprog f_initialize_reader initialize_reader_spec.
Lemma body_start_read : semax_body Vprog Gprog f_start_read start_read_spec.
Lemma body_finish_read : semax_body Vprog Gprog f_finish_read finish_read_spec.
Lemma msubst_efield_denote_nil: forall T1 T2, msubst_efield_denote T1 T2 nil = Some nil.
Lemma msubst_efield_denote_cons_struct: forall fld efs T1 T2 gfs, msubst_efield_denote T1 T2 efs = Some gfs -> msubst_efield_denote T1 T2 (eStructField fld :: efs) = Some (StructField fld :: gfs).
Lemma msubst_efield_denote_cons_union: forall fld efs T1 T2 gfs, msubst_efield_denote T1 T2 efs = Some gfs -> msubst_efield_denote T1 T2 (eUnionField fld :: efs) = Some (UnionField fld :: gfs).
Lemma msubst_efield_denote_cons_array: forall ei efs T1 T2 i gfs, msubst_efield_denote T1 T2 efs = Some gfs -> type_is_int ei = true -> msubst_eval_LR T1 T2 ei RRRR = Some (Values.Vint i) -> msubst_efield_denote T1 T2 (eArraySubsc ei :: efs) = Some (ArraySubsc (Int.unsigned i) :: gfs).
Lemma index_of_spec : forall k m, match index_of m k with | Some i => 0 <= i < Zlength m /\ fst (Znth i m) = k /\ Forall (fun x => fst x <> k) (sublist 0 i m) | None => ~In k (map fst m) end.
Lemma emp_dup: forall P, P && emp = (P && emp) * (P && emp).
Theorem HMAC_DRBG_update_concrete_correct: forall HMAC provided_data K V, HMAC_DRBG_update HMAC provided_data K V = HMAC_DRBG_update_concrete HMAC provided_data K V.
Lemma HMAC_DRBG_generate_helper_Z_any_prop_fst: forall (P: list byte -> Prop) HMAC key v z, 0 <= z -> P v -> (forall x y, P (HMAC x y)) -> P (fst (HMAC_DRBG_generate_helper_Z HMAC key v z)).
Lemma HMAC_DRBG_generate_helper_Z_incremental_fst: forall HMAC key v z v', 0 <= z -> v' = fst (HMAC_DRBG_generate_helper_Z HMAC key v z) -> HMAC v' key = fst (HMAC_DRBG_generate_helper_Z HMAC key v (z + 32)).
Lemma HMAC_DRBG_generate_helper_Z_incremental_snd: forall HMAC key v z v', 0 <= z -> v' = fst (HMAC_DRBG_generate_helper_Z HMAC key v (z + 32)) -> snd (HMAC_DRBG_generate_helper_Z HMAC key v z) ++ v' = snd (HMAC_DRBG_generate_helper_Z HMAC key v (z + 32)).
Lemma HMAC_DRBG_generate_helper_Z_Zlength_fst: forall HMAC key v z, 0 <= z -> Zlength v = 32 -> (forall x y, Zlength (HMAC x y) = 32) -> Zlength (fst (HMAC_DRBG_generate_helper_Z HMAC key v z)) = 32.
Lemma HMAC_DRBG_generate_helper_Z_Zlength_snd: forall HMAC key v z, 0 <= z -> (forall x y, Zlength (HMAC x y) = 32) -> (exists n, z = n * 32) -> Zlength (snd (HMAC_DRBG_generate_helper_Z HMAC key v z)) = z.
Lemma HMAC_DRBG_generate_helper_Z_incremental_equiv: forall HMAC key v z incr, 0 <= z -> 0 < incr <= 32 -> (exists n, z = n * 32) -> HMAC_DRBG_generate_helper_Z HMAC key v (z + incr) = HMAC_DRBG_generate_helper_Z HMAC key v (z + 32).
Lemma body_hmac_drbg_reseed: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_reseed hmac_drbg_reseed_spec.
Lemma body_md_free: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_md_free md_free_spec.
Lemma body_md_get_size: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_md_get_size md_get_size_spec.
Lemma body_md_start: semax_body HmacDrbgVarSpecs (HmacDrbgFunSpecs) f_mbedtls_md_hmac_starts md_starts_spec.
Lemma body_md_update: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_md_hmac_update md_update_spec.
Lemma body_md_final: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_md_hmac_finish md_final_spec.
Lemma body_md_reset: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_md_hmac_reset md_reset_spec.
Lemma body_md_setup: semax_body HmacDrbgVarSpecs ((*malloc_spec::*)HmacDrbgFunSpecs) f_mbedtls_md_setup md_setup_spec.
Lemma false_zgt z a: false = (z >? a) -> z<=a.
Lemma false_zge z a: false = (z >=? a) -> z<a.
Lemma false_zge' z a (A:z<a): false = (z >=? a).
Lemma bytesToBits_InBlocks l: InBlocks 8 (bytesToBits l).
Lemma flatten_bytes_bits: forall m, flatten m = bitsToBytes (flatten (map bytesToBits m)).
Lemma Forall_rev {A} P: forall (l:list A), Forall P l -> Forall P (rev l).
Lemma to_list_eq (A : Type) (n : nat) l: to_list l = @Vector.to_list A n l.
Lemma da_emp_null sh t v p: p=nullval -> da_emp sh t v p = emp.
Lemma sublist_app_exact1: forall X (A B: list X), sublist 0 (Zlength A) (A ++ B) = A.
Lemma sublist_app_exact2: forall X (A B: list X), sublist (Zlength A) (Zlength A + Zlength B) (A ++ B) = B.
Lemma hmac256drbgabs_hmac_drbg_update_any_prop_key: forall (P: list byte -> Prop) a additional_data, (forall x y, P (HMAC256 x y)) -> P (hmac256drbgabs_key (hmac256drbgabs_hmac_drbg_update a additional_data)).
Lemma hmac256drbgabs_hmac_drbg_update_any_prop_V: forall (P: list byte -> Prop) a additional_data, (forall x y, P (HMAC256 x y)) -> P (hmac256drbgabs_value (hmac256drbgabs_hmac_drbg_update a additional_data)).
Lemma hmac256drbgabs_hmac_drbg_update_Zlength_key: forall a additional_data, Zlength (hmac256drbgabs_key (hmac256drbgabs_hmac_drbg_update a additional_data)) = Z.of_nat SHA256.DigestLength.
Lemma hmac256drbgabs_hmac_drbg_update_Zlength_V: forall a additional_data, Zlength (hmac256drbgabs_value (hmac256drbgabs_hmac_drbg_update a additional_data)) = Z.of_nat SHA256.DigestLength.
Lemma hmac256drbgabs_reseed_any_prop_key: forall (P: list byte -> Prop) a s additional_data, P (hmac256drbgabs_key a) -> (forall x y, P (HMAC256 x y)) -> P (hmac256drbgabs_key (hmac256drbgabs_reseed a s additional_data)).
Lemma hmac256drbgabs_reseed_any_prop_V: forall (P: list byte -> Prop) a s additional_data, P (hmac256drbgabs_value a) -> (forall x y, P (HMAC256 x y)) -> P (hmac256drbgabs_value (hmac256drbgabs_reseed a s additional_data)).
Lemma hmac256drbgabs_reseed_Zlength_key: forall a s additional_data, Zlength (hmac256drbgabs_key a) = Z.of_nat SHA256.DigestLength -> Zlength (hmac256drbgabs_key (hmac256drbgabs_reseed a s additional_data)) = Z.of_nat SHA256.DigestLength.
Lemma hmac256drbgabs_reseed_Zlength_V: forall a s additional_data, Zlength (hmac256drbgabs_value a) = Z.of_nat SHA256.DigestLength -> Zlength (hmac256drbgabs_value (hmac256drbgabs_reseed a s additional_data)) = Z.of_nat SHA256.DigestLength.
Lemma hmac256drbgabs_update_key_ident: forall a key, key = hmac256drbgabs_key a -> hmac256drbgabs_update_key a key = a.
Lemma hmac256drbgabs_update_value_ident: forall a value, value = hmac256drbgabs_value a -> hmac256drbgabs_update_value a value = a.
Lemma hmac256drbgabs_update_key_update_value_commute: forall a key value, hmac256drbgabs_update_value (hmac256drbgabs_update_key a key) value = hmac256drbgabs_update_key (hmac256drbgabs_update_value a value) key.
Lemma HMAC_DRBG_update_value l key V key' V' (P:(key', V') = HMAC_DRBG_update HMAC256 l key V): Zlength V' = 32.
Lemma Zlength_hmac256drbgabs_update_value abs c: Zlength (hmac256drbgabs_value (hmac256drbgabs_hmac_drbg_update abs c)) = 32.
Lemma body_hmac_drbg_free: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_free hmac_drbg_free_spec.
Lemma body_hmac_drbg_random: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_random hmac_drbg_random_spec.
Lemma HMAC256_DRBG_reseed_algorithmWFaux d l y A B zz (H: (A, B, zz) = HMAC256_DRBG_functional_prog.HMAC256_DRBG_reseed_algorithm d l y): 0 <= zz < Int.max_signed /\ Zlength A = 32.
Lemma HMAC256_DRBG_reseed_functionWFaux a b c s t x y A B zz C D ss (H: ENTROPY.success (A, B, zz, C, D) ss = HMAC256_DRBG_functional_prog.HMAC256_DRBG_reseed_function a b c s t x y): 0 <= zz < Int.max_signed /\ Zlength A = 32.
Lemma mbedtls_HMAC256_DRBG_reseed_functionWFaux a s data ss A B zz C D (H: mbedtls_HMAC256_DRBG_reseed_function s a data = ENTROPY.success (A, B, zz, C, D) ss): 0 <= zz < Int.max_signed /\ Zlength A = 32.
Lemma HMAC_DRBG_updateWF a b c d e: (d,e) = HMAC_DRBG_algorithms.HMAC_DRBG_update HMAC256_functional_prog.HMAC256 a b c -> Zlength e = 32.
Lemma HMAC256_DRBG_generate_algorithmWF a v k rc n l bytes V K RC (N:n >=0) (A: 0<= a +1< Int.max_signed) (Rc: 0<=rc) (H: DRBG_functions.generate_algorithm_success bytes (V, K, RC) = HMAC256_DRBG_functional_prog.HMAC256_DRBG_generate_algorithm a (v,k,rc) n l): Zlength V = 32 /\ 0 <= RC < Int.max_signed.
Lemma HMAC256_DRBG_generate_functionWF f a b c s v k rc d pr n e l V K RC z PR ss bytes (A: 0<= a+1 < Int.max_signed) (N: n>=0) (Rc: 0<=rc) (F: forall s d z b x y zz A B C D ss, ENTROPY.success (A, B, zz, C, D) ss = f s (d, z, b) x y -> 0<=zz) (H : ENTROPY.success (bytes, (V, K, RC, z, PR)) ss = HMAC256_DRBG_functional_prog.HMAC256_DRBG_generate_function f a b c s (v, k, rc, d, pr) n e pr l): Zlength V = 32 /\ 0 <= RC < Int.max_signed.
Lemma mbedtls_HMAC256_DRBG_generate_functionWF_success s k v rc el pr rsi n l bytes V K RC z PR ss (N: n>=0) (Rc: 0<=rc) (HRSI: 0 <= rsi+1 < Int.max_signed) (H: ENTROPY.success (bytes, (V, K, RC, z, PR)) ss = mbedtls_HMAC256_DRBG_generate_function s (HMAC256DRBGabs k v rc el pr rsi) n l): Zlength V = 32 /\ 0 <= RC < Int.max_signed.
Lemma hmac256drbgabs_generateWF I s n l K V RC el PR rsi (N:n>=0) (HI: Zlength (hmac256drbgabs_value I) = 32 /\ 0 <= hmac256drbgabs_reseed_counter I < Int.max_signed) (HRSI: 0 <= rsi +1< Int.max_signed) (G: hmac256drbgabs_generate I s n l = HMAC256DRBGabs K V RC el PR rsi): Zlength V = 32 /\ 0 <= RC < Int.max_signed.
Lemma my_fold_right_eq {A B} (f : B -> A -> A) a: my_fold_right f a = fold_right f a.
Lemma FRZL_ax' ps: FRZL ps = my_fold_right sepcon emp ps.
Lemma while_loop_post_incremental_snd: forall key0 V0 n out_len, 0 <= (n * 32)%Z <= out_len -> (n * 32)%Z <> out_len -> snd (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 (n * 32)%Z) ++ fst (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 ((n * 32)%Z + Z.min 32 (out_len - (n * 32)%Z))) = snd (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 ((n * 32)%Z + Z.min 32 (out_len - (n * 32)%Z))).
Lemma while_loop_post_incremental_fst: forall key0 V0 n out_len, 0 <= (n * 32)%Z <= out_len -> (n * 32)%Z <> out_len -> fst (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 ((n * 32)%Z + Z.min 32 (out_len - (n * 32)%Z))) = HMAC256 (fst (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 (n * 32)%Z)) key0.
Lemma while_loop_post_sublist_app: forall key0 V0 n out_len, 0 <= (n * 32)%Z <= out_len -> Zlength V0 = 32 -> sublist 0 (n * 32) (snd (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 (n * 32))) ++ sublist 0 (Z.min 32 (out_len - n * 32)) (fst (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 (n * 32 + Z.min 32 (out_len - n * 32)))) = sublist 0 (n * 32 + Z.min 32 (out_len - n * 32)) (snd (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 (n * 32)) ++ fst (HMAC_DRBG_generate_helper_Z HMAC256 key0 V0 (n * 32 + Z.min 32 (out_len - n * 32)))).
Lemma body_hmac_drbg_seed_buf: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_seed_buf hmac_drbg_seed_buf_spec.
Lemma body_hmac_drbg_update: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_update hmac_drbg_update_spec.
Lemma drb_seed_256_subsume: NDsubsume_funspec (snd hmac_drbg_seed_inst256_spec) (snd drbg_seed_inst256_spec_abs).
Lemma body_hmac_drbg_seed_buf: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_seed_buf drbg_seed_buf_abs_spec.
Lemma body_hmac_drbg_reseed: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_reseed drbg_reseed_spec_abs.
Lemma body_hmac_drbg_random_abs: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_random drbg_random_abs_spec.
Lemma body_hmac_drbg_random_abs1: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_random drbg_random_abs_spec1.
Lemma HMAC_DRBG_update_concreteWF c K V k v (H: (k, v) = HMAC_DRBG_update_concrete HMAC256 c K V): Zlength v = 32.
Lemma update_WF I (WFI: WF I) c: WF (hmac256drbgabs_hmac_drbg_update I c).
Lemma body_hmac_drbg_update_abs: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_update drbg_update_abs_spec.
Lemma body_hmac_drbg_setEntropyLen: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_set_entropy_len drbg_setEntropyLen_spec_abs.
Lemma body_hmac_drbg_setPredictionResistance: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_set_prediction_resistance drbg_setPredictionResistance_spec_abs.
Lemma body_hmac_drbg_setReseedInterval: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_set_reseed_interval drbg_setReseedInterval_spec_abs.
Lemma body_hmac_drbg_seed_256: semax_body HmacDrbgVarSpecs HmacDrbgFunSpecs f_mbedtls_hmac_drbg_seed hmac_drbg_seed_inst256_spec.
Lemma ReseedRes: forall X r v, @return_value_relate_result X r (Vint v) -> Int.eq v (Int.repr (-20864)) = false.
Lemma mem_step_refl m: mem_step m m.
Lemma mem_step_free: forall m b lo hi m', Mem.free m b lo hi = Some m' -> mem_step m m'.
Lemma mem_step_store: forall m ch b a v m', Mem.store ch m b a v = Some m' -> mem_step m m'.
Lemma valid_genv_alloc: forall ge (m m1:mem) lo hi b (ALLOC: Mem.alloc m lo hi = (m1,b)) (G: X86WD.ge_wd (id_ren m) ge), X86WD.ge_wd (id_ren m1) ge.
Lemma valid_genv_store: forall ge m m1 b ofs v chunk (STORE: Mem.store chunk m b ofs v = Some m1) (G: X86WD.ge_wd (id_ren m) ge), X86WD.ge_wd (id_ren m1) ge.
Lemma valid_genv_store_zeros: forall ge m m1 b y z (STORE_ZERO: store_zeros m b y z = Some m1) (G: X86WD.ge_wd (id_ren m) ge), X86WD.ge_wd (id_ren m1) ge.
Lemma mem_wd_store_zeros: forall m b p n m1 (STORE_ZERO: store_zeros m b p n = Some m1) (WD: MemoryWD.valid_mem m), MemoryWD.valid_mem m1.
Lemma validblock_id_ren : forall (m : mem) (b : block), id_ren m b -> Mem.valid_block m b.
Lemma valid_genv_drop: forall ge (m m1:mem) b lo hi p (DROP: Mem.drop_perm m b lo hi p = Some m1) (G: X86WD.ge_wd (id_ren m) ge), X86WD.ge_wd (id_ren m1) ge.
Lemma mem_wd_store_init_data: forall ge a (b:block) (z:Z) m1 m2 (SID:Genv.store_init_data ge m1 b z a = Some m2), X86WD.ge_wd (id_ren m1) ge -> MemoryWD.valid_mem m1 -> MemoryWD.valid_mem m2.
Lemma valid_genv_store_init_data: forall ge a (b:block) (z:Z) m1 m2 (SID: Genv.store_init_data ge m1 b z a = Some m2), X86WD.ge_wd (id_ren m1) ge -> X86WD.ge_wd (id_ren m2) ge.
Lemma mem_wd_store_init_datalist: forall ge l (b:block) (z:Z) m1 m2 (SID: Genv.store_init_data_list ge m1 b z l = Some m2), X86WD.ge_wd (id_ren m1) ge -> MemoryWD.valid_mem m1 -> MemoryWD.valid_mem m2.
Lemma valid_genv_store_init_datalist: forall ge l (b:block) (z:Z) m1 m2 (SID: Genv.store_init_data_list ge m1 b z l = Some m2), X86WD.ge_wd (id_ren m1) ge -> X86WD.ge_wd (id_ren m2) ge.
Lemma mem_valid_drop : forall (m : mem) (b : block) (lo hi : Z) (p : permission) (m' : mem), Mem.drop_perm m b lo hi p = Some m' -> MemoryWD.valid_mem m -> MemoryWD.valid_mem m'.
Lemma mem_wd_alloc_global: forall ge a m0 m1 (GA: Genv.alloc_global ge m0 a = Some m1), MemoryWD.valid_mem m0 -> X86WD.ge_wd (id_ren m0) ge -> MemoryWD.valid_mem m1.
Lemma valid_genv_alloc_global: forall ge a m0 m1 (GA: Genv.alloc_global ge m0 a = Some m1), X86WD.ge_wd (id_ren m0) ge -> X86WD.ge_wd (id_ren m1) ge.
Lemma valid_genv_alloc_globals: forall ge init_list m0 m (GA: Genv.alloc_globals ge m0 init_list = Some m), X86WD.ge_wd (id_ren m0) ge -> X86WD.ge_wd (id_ren m) ge.
Lemma mem_wd_alloc_globals: forall ge init_list m0 m (GA: Genv.alloc_globals ge m0 init_list = Some m), MemoryWD.valid_mem m0 -> X86WD.ge_wd (id_ren m0) ge -> MemoryWD.valid_mem m.
Lemma event_erasure_action: forall ev ev', event_erasure ev ev' -> action ev = action ev'.
Lemma memval_erasure_list_length: forall mval mval', ValErasure.memval_erasure_list mval mval' -> length mval = length mval'.
Lemma event_erasure_location: forall ev ev', event_erasure ev ev' -> location ev = location ev'.
Lemma event_erasure_sameLocation: forall ev1 ev1' ev2 ev2', event_erasure ev1 ev1' -> event_erasure ev2 ev2' -> sameLocation ev1' ev2' -> sameLocation ev1 ev2.
Lemma trace_erasure_nth: forall tr tr' i ev' (Herased: trace_erasure tr tr') (Hi: nth_error tr' i = Some ev'), exists ev, nth_error tr i = Some ev /\ event_erasure ev ev'.
Lemma trace_erasure_nth': forall tr tr' i ev (Herased: trace_erasure tr tr') (Hi: nth_error tr i = Some ev), exists ev', nth_error tr' i = Some ev' /\ event_erasure ev ev'.
Lemma trace_erasure_spinlock_clean: forall tr tr' (Herased: trace_erasure tr tr') (Hclean: spinlock_clean tr), spinlock_clean tr'.
Lemma event_erasure_caction: forall ev ev', event_erasure ev ev' -> caction ev' -> caction ev.
Lemma event_erasure_is_internal: forall ev ev', event_erasure ev ev' -> is_internal ev = is_internal ev'.
Lemma event_erasure_is_external: forall ev ev', event_erasure ev ev' -> is_external ev = is_external ev'.
Lemma event_erasure_thread_id: forall ev ev', event_erasure ev ev' -> thread_id ev = thread_id ev'.
Lemma event_erasure_competes: forall ev1 ev2 ev1' ev2' (Herasure1: event_erasure ev1 ev1') (Herasure2: event_erasure ev2 ev2'), competes ev1' ev2' -> competes ev1 ev2.
Lemma trace_erasure_spinlock_synchronized: forall tr tr' (Herased: trace_erasure tr tr') (Hsync: spinlock_synchronized tr), spinlock_synchronized tr'.
Lemma perm_of_glb_not_Freeable: forall sh, ~ perm_of_sh (Share.glb Share.Rsh sh) = Some Freeable.
Lemma join_bot_bot_eq sh : sepalg.join Share.bot Share.bot sh -> sh = Share.bot.
Lemma join_to_bot_l {sh1 sh2} : sepalg.join sh1 sh2 Share.bot -> sh1 = Share.bot.
Lemma join_to_bot_r {sh1 sh2} : sepalg.join sh1 sh2 Share.bot -> sh2 = Share.bot.
Lemma join_top_l {sh2 sh3} : sepalg.join Share.top sh2 sh3 -> sh2 = Share.bot.
Lemma join_top {sh2 sh3} : sepalg.join Share.top sh2 sh3 -> sh3 = Share.top.
Lemma join_pfullshare {sh2 sh3 : pshare} : ~sepalg.join pfullshare sh2 sh3.
Lemma join_with_bot_r sh1 sh2 : join sh1 Share.bot sh2 -> sh1 = sh2.
Lemma join_with_bot_l sh1 sh2 : join Share.bot sh1 sh2 -> sh1 = sh2.
Lemma join_top_r sh1 sh3 : join sh1 Share.top sh3 -> sh1 = Share.bot.
Lemma join_pshare_top_l (p1 p2 p3 : pshare) : @join pshare _ p1 p2 p3 -> pshare_sh p1 <> Share.top.
Lemma join_pshare_top_r (p1 p2 p3 : pshare) : @join pshare _ p1 p2 p3 -> pshare_sh p2 <> Share.top.
Lemma extcall_malloc_sem_inv: forall g v m t res m2 (E:Events.extcall_malloc_sem g v m t res m2), exists m1 b (sz : ptrofs), v=[Vptrofs sz] /\ t= Events.E0 /\ res=Vptr b Ptrofs.zero /\ Mem.alloc m (- size_chunk Mptr) (Ptrofs.unsigned sz) = (m1, b) /\ Mem.store Mptr m1 b (- size_chunk Mptr) (Vptrofs sz) = Some m2.
Lemma deref_locT_ax1 a m loc ofs v T (D:deref_locT (typeof a) m loc ofs v T): deref_loc (typeof a) m loc ofs v.
Lemma deref_locT_ax2 a m loc ofs v (D:deref_loc (typeof a) m loc ofs v): exists T, deref_locT (typeof a) m loc ofs v T.
Lemma deref_locT_fun a m loc ofs v1 T1 (D1:deref_locT (typeof a) m loc ofs v1 T1) v2 T2 (D2:deref_locT (typeof a) m loc ofs v2 T2): (v1,T1)=(v2,T2).
Lemma deref_locT_elim a m b ofs v T (D:deref_locT (typeof a) m b ofs v T): ev_elim m T m /\ (forall mm mm' (E:ev_elim mm T mm'), mm'=mm /\ deref_locT (typeof a) mm b ofs v T).
Lemma Asm_corestep_not_halted : forall ge m q m' q' i, step2corestep (part_semantics ge) q m q' m' -> ~final_state q i.
Lemma eval_builtin_arg_ev_determ: forall a v1 T1 (HT1:eval_builtin_arg_ev a v1 T1) v2 T2 (HT2:eval_builtin_arg_ev a v2 T2), v1=v2 /\ T1=T2.
Lemma eval_builtin_arg_event: forall a v, eval_builtin_arg ge e sp m a v -> exists T, eval_builtin_arg_ev a v T.
Lemma eval_builtin_arg_event_inv: forall a v T, eval_builtin_arg_ev a v T -> eval_builtin_arg ge e sp m a v.
Lemma CLight_Deterministic: forall ge c m c1 m1 c2 m2, veric.Clight_new.cl_step ge c m c2 m2 -> veric.Clight_new.cl_step ge c m c1 m1 -> c1 = c2 /\ m1 = m2.
Lemma mem_storebytes_counded_init: forall m m' b ofs bytes, bnd_from_init m -> Mem.storebytes m b ofs bytes = Some m' -> bnd_from_init m'.
Lemma mem_alloc_bounded_init: forall m lo hi m1 b, bnd_from_init m -> Mem.alloc m lo hi = (m1, b) -> bnd_from_init m1.
Lemma mem_free_bounded_init: forall m lo hi m' b, bnd_from_init m -> Mem.free m b lo hi = Some m' -> bnd_from_init m'.
Lemma mem_drop_perm_bounded_init: forall m b lo hi P m', bnd_from_init m -> Mem.drop_perm m b lo hi P = Some m' -> bnd_from_init m'.
Lemma mem_free_list_bounded_init: forall m l m', bnd_from_init m -> Mem.free_list m l = Some m' -> bnd_from_init m'.
Lemma preserve_bnd: memstep_preserve (fun m m' => bnd_from_init m -> bnd_from_init m').
Lemma CLight_step_mem_bound' ge c m c' m': veric.Clight_new.cl_step ge c m c' m' -> bnd_from_init m -> bnd_from_init m'.
Lemma Mem_canonical_useful: forall m loc k, fst (Mem.mem_access m) loc k = None.
Lemma mem_bound_init_mem_bound: forall m, bounded_maps.bounded_map (snd (getMaxPerm m)) <-> bnd_from_init m.
Lemma CLight_step_mem_bound ge c m c' m': veric.Clight_new.cl_step ge c m c' m' -> bounded_maps.bounded_map (snd (getMaxPerm m)) -> bounded_maps.bounded_map (snd (getMaxPerm m')).
Lemma po_refl: forall p, Mem.perm_order'' p p.
Lemma perm_order_antisym : forall p p' (Hlt: Mem.perm_order'' p p') (Hgt: Mem.perm_order'' p' p), p = p'.
Lemma NO_ext: forall sh1 sh2 p1 p2, sh1=sh2 -> NO sh1 p1 = NO sh2 p2.
Lemma rmap_bound_join {b phi1 phi2 phi3} : sepalg.join phi1 phi2 phi3 -> rmap_bound b phi3 <-> (rmap_bound b phi1 /\ rmap_bound b phi2).
Lemma resource_decay_aux_spec b phi1 phi2 : resource_decay b phi1 phi2 -> resource_decay_aux b phi1 phi2.
Lemma resource_decay_aux_spec_inv b phi1 phi2 : resource_decay_aux b phi1 phi2 -> resource_decay b phi1 phi2.
Lemma resource_fmap_approx_idempotent n r : resource_fmap (approx n) (approx n) (resource_fmap (approx n) (approx n) r) = resource_fmap (approx n) (approx n) r.
Lemma listoption_inv_In : forall {A} (x : A) l, In (Some x) l -> In x (listoption_inv l).
Lemma lockRes_thread : forall ge (tp : jstate ge) l r, lockRes tp l = Some (Some r) -> In r (listoption_inv (map snd (AMap.elements (elt:=lock_info) (lockGuts tp)))).
Lemma rmap_bound_join {b phi1 phi2 phi3} : join phi1 phi2 phi3 -> rmap_bound b phi3 -> rmap_bound b phi2.
Lemma resource_fmap_YES_inv f g r sh rsh k pp : resource_fmap f g r = YES sh rsh k pp -> exists pp', r = YES sh rsh k pp' /\ pp = preds_fmap f g pp'.
Lemma resource_fmap_PURE_inv f g r k pp : resource_fmap f g r = PURE k pp -> exists pp', r = PURE k pp' /\ pp = preds_fmap f g pp'.
Lemma resource_fmap_NO_inv f g r sh nsh : resource_fmap f g r = NO sh nsh -> r = NO sh nsh.
Lemma isSome_option_map {A B} (f : A -> B) o : ssrbool.isSome (option_map f o) = ssrbool.isSome o.
Lemma cl_step_mem_step ge c m c' m' : cl_step ge c m c' m' -> mem_step m m'.
Lemma mem_step_contents_at_None m m' loc : Mem.valid_block m (fst loc) -> mem_step m m' -> access_at m loc Cur = None -> contents_at m' loc = contents_at m loc.
Lemma mem_step_contents_at_Nonempty m m' loc : Mem.valid_block m (fst loc) -> mem_step m m' -> access_at m loc Cur = Some Nonempty -> contents_at m' loc = contents_at m loc.
Lemma perm_of_res_resource_fmap f g r : perm_of_res (resource_fmap f g r) = perm_of_res r.
Lemma resource_fmap_join f g r1 r2 r3 : join r1 r2 r3 -> join (resource_fmap f g r1) (resource_fmap f g r2) (resource_fmap f g r3).
Lemma decay_rewrite m m' : decay m m' <-> forall loc, (~valid_block m (fst loc) -> valid_block m' (fst loc) -> (forall k, access_at m' loc k = Some Freeable) \/ (forall k, access_at m' loc k = None)) /\ (valid_block m (fst loc) -> (forall k, (access_at m loc k = Some Freeable /\ access_at m' loc k = None)) \/ (forall k, access_at m loc k = access_at m' loc k)).
Lemma valid_block0 m b : ~valid_block m b <-> (b >= nextblock m)%positive.
Lemma valid_block1 m b : valid_block m b <-> (b < nextblock m)%positive.
Lemma not_Pge_Plt a b : ~ Pge a b -> Plt a b.
Lemma perm_of_res'_resource_fmap f g r : perm_of_res' (resource_fmap f g r) = perm_of_res' r.
Lemma mem_cohere_step c c' jm jm' Phi (X : rmap) ge : mem_cohere' (m_dry jm) Phi -> sepalg.join (m_phi jm) X Phi -> corestep (juicy_core_sem (cl_core_sem ge)) c jm c' jm' -> exists Phi', sepalg.join (m_phi jm') (age_to (level (m_phi jm')) X) Phi' /\ mem_cohere' (m_dry jm') Phi'.
Lemma lock_coherence_age_to lset Phi m n : lock_coherence lset Phi m -> lock_coherence (AMap.map (option_map (age_to n)) lset) Phi m.
Lemma flat_inj_incr : forall b b', (b <= b')%positive -> inject_incr (Mem.flat_inj b) (Mem.flat_inj b').
Lemma lset_valid_access ge m m_any (tp : jstate ge) Phi b ofs (compat : mem_compatible_with tp m Phi) : lock_coherence (lset tp) Phi m_any -> AMap.find (elt:=option rmap) (b, ofs) (lset tp) <> None -> Mem.valid_access (restrPermMap (mem_compatible_locks_ltwritable (mem_compatible_forget compat))) Mptr b ofs Writable.
Lemma mem_compatible_with_age ge {n} {tp : jstate ge} {m phi} : mem_compatible_with tp m phi -> mem_compatible_with (age_tp_to n tp) m (age_to n phi).
Lemma after_alloc_0 : forall b phi H, after_alloc 0 0 b phi H = phi.
Lemma PURE_SomeP_inj1 k A1 A2 pp1 pp2 : PURE k (SomeP A1 pp1) = PURE k (SomeP A2 pp2) -> A1 = A2.
Lemma PURE_SomeP_inj2 k A pp1 pp2 : PURE k (SomeP A pp1) = PURE k (SomeP A pp2) -> pp1 = pp2.
Lemma pures_eq_matchfunspecs e Gamma Phi Phi' : (level Phi' <= level Phi)%nat -> pures_eq Phi Phi' -> matchfunspecs e Gamma Phi -> matchfunspecs e Gamma Phi'.
Lemma pures_eq_age_to phi n : (level phi >= n)%nat -> pures_eq phi (age_to n phi).
Lemma matchfunspecs_age_to e Gamma n Phi : (n <= level Phi)%nat -> matchfunspecs e Gamma Phi -> matchfunspecs e Gamma (age_to n Phi).
Lemma age_pures_eq phi phi' : age phi phi' -> pures_eq phi phi'.
Lemma matchfunspecs_hered e Gamma : hereditary age (matchfunspecs e Gamma).
Lemma resource_decay_pures_eq b phi phi' : resource_decay b phi phi' -> pures_eq phi phi'.
Lemma resource_decay_matchfunspecs e Gamma b Phi Phi' : (level Phi' <= level Phi)%nat -> resource_decay b Phi Phi' -> matchfunspecs e Gamma Phi -> matchfunspecs e Gamma Phi'.
Lemma funassert_pures_eq G rho phi1 phi2 : (level phi1 >= level phi2)%nat -> pures_eq phi1 phi2 -> app_pred (funassert G rho) phi1 -> app_pred (funassert G rho) phi2.
Lemma env_coherence_hered Z Jspec ge G : hereditary age (@env_coherence Z Jspec ge G).
Lemma env_coherence_age_to Z Jspec ge G phi n : @env_coherence Z Jspec ge G phi -> @env_coherence Z Jspec ge G (age_to n phi).
Lemma env_coherence_pures_eq Z Jspec ge G phi phi' : (level phi >= level phi')%nat -> pures_eq phi phi' -> @env_coherence Z Jspec ge G phi -> @env_coherence Z Jspec ge G phi'.
Lemma env_coherence_resource_decay Z Jspec ge G b phi phi' : (level phi >= level phi')%nat -> resource_decay b phi phi' -> @env_coherence Z Jspec ge G phi -> @env_coherence Z Jspec ge G phi'.
Lemma restrPermMap_mem_contents p' m (Hlt: permMapLt p' (getMaxPerm m)): Mem.mem_contents (restrPermMap Hlt) = Mem.mem_contents m.
Lemma LockRes_age_content1 ge (js : jstate ge) n a : lockRes (age_tp_to n js) a = option_map (option_map (age_to n)) (lockRes js a).
Lemma join_sub_to_joining {A} {J : Join A} {_ : Perm_alg A} {_ : Sep_alg A} {_ : Canc_alg A} {_ : Disj_alg A} (a b e : A) : join_sub e a -> join_sub e b -> joins a b -> identity e.
Lemma join_sub_join {A} {J : Join A} {PA : Perm_alg A} {SA : Sep_alg A} {_ : Canc_alg A} {DA : Disj_alg A} {CA : Cross_alg A} (a b c x : A) : join a b c -> join_sub a x -> join_sub b x -> join_sub c x.
Lemma Ejuicy_sem : forall ge, (@juicy_sem (Clight_newSem ge)) = juicy_core_sem (cl_core_sem ge).
Lemma level_jm_ ge m tp Phi (compat : mem_compatible_with tp m Phi) i (cnti : containsThread tp i) : level (jm_(ge := ge) cnti compat) = level Phi.
Lemma pures_same_sym phi1 phi2 : pures_same phi1 phi2 -> pures_same phi2 phi1.
Lemma joins_pures_same phi1 phi2 : joins phi1 phi2 -> pures_same phi1 phi2.
Lemma join_sub_pures_same phi1 phi2 : join_sub phi1 phi2 -> pures_same phi1 phi2.
Lemma pures_same_eq_l phi1 phi1' phi2 : pures_same phi1 phi1' -> pures_eq phi1 phi2 -> pures_eq phi1' phi2.
Lemma pures_same_eq_r phi1 phi2 phi2' : level phi2 = level phi2' -> pures_same phi2 phi2' -> pures_eq phi1 phi2 -> pures_eq phi1 phi2'.
Lemma pures_same_pures_eq phi1 phi2 : level phi1 = level phi2 -> pures_same phi1 phi2 -> pures_eq phi1 phi2.
Lemma pures_same_jm_ ge m tp Phi (compat : mem_compatible_with tp m Phi) i (cnti : containsThread tp i) : pures_same (m_phi (jm_(ge := ge) cnti compat)) Phi.
Lemma level_m_phi jm : level (m_phi jm) = level jm.
Lemma jsafeN_downward {Z} {Jspec : juicy_ext_spec Z} {ge n z c jm} : jsafeN Jspec ge (S n) z c jm -> jsafeN Jspec ge n z c jm.
Lemma jsafe_phi_downward {Z} {Jspec : juicy_ext_spec Z} {ge n z c phi} : jsafe_phi Jspec ge (S n) z c phi -> jsafe_phi Jspec ge n z c phi.
Lemma jsafe_phi_bupd_downward {Z} {Jspec : juicy_ext_spec Z} {ge n z c phi} : jsafe_phi_bupd Jspec ge (S n) z c phi -> jsafe_phi_bupd Jspec ge n z c phi.
Lemma jsafe_phi_age Z Jspec ge ora q n phi phiaged : ext_spec_stable age (JE_spec _ Jspec) -> age phi phiaged -> le n (level phiaged) -> @jsafe_phi Z Jspec ge n ora q phi -> @jsafe_phi Z Jspec ge n ora q phiaged.
Lemma jsafe_phi_age_to Z Jspec ge ora q n l phi : ext_spec_stable age (JE_spec _ Jspec) -> le n l -> @jsafe_phi Z Jspec ge n ora q phi -> @jsafe_phi Z Jspec ge n ora q (age_to l phi).
Lemma jsafe_phi_bupd_age Z Jspec ge ora q n phi phiaged : ext_spec_stable age (JE_spec _ Jspec) -> age phi phiaged -> le n (level phiaged) -> @jsafe_phi_bupd Z Jspec ge n ora q phi -> @jsafe_phi_bupd Z Jspec ge n ora q phiaged.
Lemma jsafe_phi_bupd_age_to Z Jspec ge ora q n l phi : ext_spec_stable age (JE_spec _ Jspec) -> le n l -> @jsafe_phi_bupd Z Jspec ge n ora q phi -> @jsafe_phi_bupd Z Jspec ge n ora q (age_to l phi).
Lemma m_phi_jm_ ge m (tp : jstate ge) phi i cnti compat : m_phi (@jm_ ge tp m phi i cnti compat) = @getThreadR _ _ _ i tp cnti.
Lemma resource_decay_LK_at {b phi phi' R sh loc} : resource_decay b phi phi' -> (fst loc < b)%positive -> (LK_at R sh loc) phi -> (LK_at (approx (level phi) R) sh loc) phi'.
Lemma resource_decay_lkat' {b phi phi' R loc} : resource_decay b phi phi' -> (fst loc < b)%positive -> (lkat R loc) phi -> (lkat (approx (level phi) R) loc) phi'.
Lemma resource_decay_lkat'' {b phi phi' R loc} : resource_decay b phi phi' -> (fst loc < b)%positive -> (lkat R loc) phi -> (lkat R loc) phi'.
Lemma resource_decay_lkat {b phi phi' R loc} : resource_decay b phi phi' -> (fst loc < b)%positive -> (lkat R loc) phi -> (lkat (approx (level phi') R) loc) phi'.
Lemma resource_decay_LK_at' {b phi phi' R sh loc} : resource_decay b phi phi' -> (fst loc < b)%positive -> (LK_at R sh loc) phi -> (LK_at (approx (level phi') R) sh loc) phi'.
Lemma resource_decay_func_at' {b phi phi'} : resource_decay b phi phi' -> forall loc fs, seplog.func_at' fs loc phi -> seplog.func_at' fs loc phi'.
Lemma resource_decay_func_at'_inv {b phi phi'} : resource_decay b phi phi' -> forall loc fs, seplog.func_at' fs loc phi' -> seplog.func_at' fs loc phi.
Lemma resource_decay_same_locks {b phi phi'} : resource_decay b phi phi' -> same_locks phi phi'.
Lemma load_at_phi_restrict ge i (tp : jstate ge) (cnti : containsThread tp i) m (compat : mem_compatible tp m) b ofs v sh R phi0 o : join_sub phi0 (getThreadR cnti) -> (LKspec LKSIZE R sh (b, ofs)) phi0 -> (* typically given by lock_coherence: *) AMap.find (elt:=option rmap) (b, ofs) (lset tp) = Some o -> load Mint32 (restrPermMap (mem_compatible_locks_ltwritable compat)) b ofs = Some v -> load Mint32 (@juicyRestrict_locks _ m (mem_compat_thread_max_cohere compat cnti)) b ofs = Some v.
Lemma permMapLt_local_locks ge m i (tp : jstate ge) Phi b ofs ophi (compat : mem_compatible_with tp m Phi) (cnti : containsThread tp i) (Efind : AMap.find (elt:=option rmap) (b, Ptrofs.unsigned ofs) (lset tp) = Some ophi) : permMapLt (setPermBlock (Some Writable) b (Ptrofs.intval ofs) (juice2Perm_locks (getThreadR cnti) m) LKSIZE_nat) (getMaxPerm m).
Lemma cl_step_decay ge c m c' m' : @cl_step ge c m c' m' -> @decay m m'.
Lemma cl_step_unchanged_on ge c m c' m' b ofs : @cl_step ge c m c' m' -> Mem.valid_block m b -> ~ Mem.perm m b ofs Cur Writable -> Maps.ZMap.get ofs (Maps.PMap.get b (Mem.mem_contents m)) = Maps.ZMap.get ofs (Maps.PMap.get b (Mem.mem_contents m')).
Lemma resource_decay_joinlist b phi1 phi1' l Phi : rmap_bound b Phi -> resource_decay b phi1 phi1' -> ghost_of phi1' = ghost_fmap (approx (level phi1')) (approx (level phi1')) (ghost_of phi1) -> joinlist (phi1 :: l) Phi -> exists Phi', joinlist (phi1' :: (map (age_to (level phi1')) l)) Phi' /\ resource_decay b Phi Phi' /\ ghost_of Phi' = own.ghost_approx Phi' (ghost_of Phi).
Lemma resource_decay_join_all ge {tp : jstate ge} {m Phi} c' {phi' i} {cnti : containsThread tp i}: rmap_bound (Mem.nextblock m) Phi -> resource_decay (Mem.nextblock m) (getThreadR i tp cnti) phi' /\ level (getThreadR i tp cnti) = S (level phi') /\ ghost_of phi' = ghost_fmap (approx (level phi')) (approx (level phi')) (ghost_of (getThreadR i tp cnti)) -> join_all tp Phi -> exists Phi', join_all (updThread i (age_tp_to (level phi') tp) (cnt_age' cnti) c' phi') Phi' /\ resource_decay (Mem.nextblock m) Phi Phi' /\ ghost_of Phi' = own.ghost_approx Phi' (ghost_of Phi) /\ level Phi = S (level Phi').
Lemma resource_decay_join_identity b phi phi' e e' : resource_decay b phi phi' -> ghost_of phi' = ghost_fmap (approx (level phi')) (approx (level phi')) (ghost_of phi) -> sepalg.joins phi e -> sepalg.joins phi' e' -> identity e -> identity e' -> e' = age_to (level phi') e.
Lemma same_except_cur_jm_ ge tp m phi i cnti compat : same_except_cur m (m_dry (@jm_ ge tp m phi i cnti compat)).
Lemma resource_decay_lockSet_in_juicyLocks b phi phi' lset : resource_decay b phi phi' -> lockSet_block_bound lset b -> lockSet_in_juicyLocks lset phi -> lockSet_in_juicyLocks lset phi'.
Lemma resource_decay_lock_coherence {b phi phi' lset m} : resource_decay b phi phi' -> lockSet_block_bound lset b -> (forall l p, AMap.find l lset = Some (Some p) -> level p = level phi) -> lock_coherence lset phi m -> lock_coherence (AMap.map (Coqlib.option_map (age_to (level phi'))) lset) phi' m.
Lemma personal_mem_rewrite m phi phi' pr pr' : phi = phi' -> @personal_mem m phi pr = @personal_mem m phi' pr'.
Lemma isSome_find_map addr f lset : ssrbool.isSome (AMap.find (elt:=option rmap) addr (AMap.map f lset)) = ssrbool.isSome (AMap.find (elt:=option rmap) addr lset).
Lemma interval_adr_range b start length i : Intv.In i (start, start + length) <-> adr_range (b, start) length (b, i).
Lemma join_YES_l {r1 r2 r3 sh1 sh1' k pp} : sepalg.join r1 r2 r3 -> r1 = YES sh1 sh1' k pp -> exists sh3 sh3', r3 = YES sh3 sh3' k pp.
Lemma fst_snd0: forall loc: address, (fst loc, (snd loc + 0)%Z) = loc.
Lemma same_locks_juicyLocks_in_lockSet phi phi' lset : same_locks phi phi' -> juicyLocks_in_lockSet lset phi -> juicyLocks_in_lockSet lset phi'.
Lemma lockSet_Writable_lockSet_block_bound m lset : lockSet_Writable lset m -> lockSet_block_bound lset (Mem.nextblock m).
Lemma join_all_age_updThread_level (tp : jstate ge) i (cnti : ThreadPool.containsThread tp i) c phi Phi : join_all (age_tp_to (level phi) (ThreadPool.updThread cnti c phi)) Phi -> level Phi = level phi.
Lemma join_all_level_lset (tp : jstate ge) Phi l phi : join_all tp Phi -> AMap.find l (lset tp) = Some (Some phi) -> level phi = level Phi.
Lemma lset_range_perm m (tp : jstate ge) b ofs (compat : mem_compatible tp m) (Efind : AMap.find (elt:=option rmap) (b, ofs) (lset tp) <> None) : Mem.range_perm (restrPermMap (mem_compatible_locks_ltwritable compat)) b ofs (ofs + LKSIZE) Cur Writable.
Lemma age_to_updThread i (tp : jstate ge) n c phi cnti cnti' : age_tp_to n (@updThread _ _ _ i tp cnti c phi) = @updThread _ _ _ i (age_tp_to n tp) cnti' c (age_to n phi).
Lemma lset_age_tp_to n (tp : jstate ge) : lset (age_tp_to n tp) = AMap.map (option_map (age_to n)) (lset tp).
Lemma getThreadC_fun i (tp : jstate ge) cnti cnti' x y : @getThreadC _ _ _ i tp cnti = x -> @getThreadC _ _ _ i tp cnti' = y -> x = y.
Lemma getThreadR_fun i (tp : jstate ge) cnti cnti' x y : @getThreadR _ _ _ i tp cnti = x -> @getThreadR _ _ _ i tp cnti' = y -> x = y.
Lemma lockSet_Writable_age n (tp : jstate ge) m : lockSet_Writable (lset tp) m -> lockSet_Writable (lset (age_tp_to n tp)) m.
Lemma lockSet_age_to n (tp : jstate ge) : lockSet (age_tp_to n tp) = lockSet tp.
Lemma juicyLocks_in_lockSet_age n (tp : jstate ge) phi : juicyLocks_in_lockSet (lset tp) phi -> juicyLocks_in_lockSet (lset (age_tp_to n tp)) (age_to n phi).
Lemma lockSet_in_juicyLocks_age n (tp : jstate ge) phi : lockSet_in_juicyLocks (lset tp) phi -> lockSet_in_juicyLocks (lset (age_tp_to n tp)) (age_to n phi).
Lemma clight_self_simulation: self_simulation _ (cl_core_sem ge).
Lemma CLight_Deterministic: forall ge c m c1 m1 c2 m2, veric.Clight_new.cl_step ge c m c2 m2 -> veric.Clight_new.cl_step ge c m c1 m1 -> c1 = c2 /\ m1 = m2.
Lemma mem_storebytes_counded_init: forall m m' b ofs bytes, bnd_from_init m -> Mem.storebytes m b ofs bytes = Some m' -> bnd_from_init m'.
Lemma mem_alloc_bounded_init: forall m lo hi m1 b, bnd_from_init m -> Mem.alloc m lo hi = (m1, b) -> bnd_from_init m1.
Lemma mem_free_bounded_init: forall m lo hi m' b, bnd_from_init m -> Mem.free m b lo hi = Some m' -> bnd_from_init m'.
Lemma mem_drop_perm_bounded_init: forall m b lo hi P m', bnd_from_init m -> Mem.drop_perm m b lo hi P = Some m' -> bnd_from_init m'.
Lemma mem_free_list_bounded_init: forall m l m', bnd_from_init m -> Mem.free_list m l = Some m' -> bnd_from_init m'.
Lemma preserve_bnd: memstep_preserve (fun m m' => bnd_from_init m -> bnd_from_init m').
Lemma CLight_step_mem_bound' ge c m c' m': veric.Clight_new.cl_step ge c m c' m' -> bnd_from_init m -> bnd_from_init m'.
Lemma Mem_canonical_useful: forall m loc k, fst (Mem.mem_access m) loc k = None.
Lemma mem_bound_init_mem_bound: forall m, bounded_maps.bounded_map (snd (getMaxPerm m)) <-> bnd_from_init m.
Lemma CLight_step_mem_bound ge c m c' m': veric.Clight_new.cl_step ge c m c' m' -> bounded_maps.bounded_map (snd (getMaxPerm m)) -> bounded_maps.bounded_map (snd (getMaxPerm m')).
Lemma Asm_self_simulation: self_simulation _ (Asm_core_sem ge).
end. Theorem randomFunc_mem_spec : forall (D R : Set)(eqdd : EqDec D)(eqdr : EqDec R)(RndR : Comp R) (x1 x2 : list (D * R)) a, (forall z, arrayLookup _ x1 z = arrayLookup _ x2 z) -> comp_spec (fun y1 y2 => fst y1 = fst y2 /\ (forall x, arrayLookup _ (snd y1) x = arrayLookup _ (snd y2)
end. Theorem randomFunc_mem_spec : forall (D R : Set)(eqdd : EqDec D)(eqdr : EqDec R)(RndR : Comp R) (x1 x2 : list (D * R)) a, (forall z, arrayLookup _ x1 z = arrayLookup _ x2 z) -> comp_spec (fun y1 y2 => fst y1 = fst y2 /\ (forall x, arrayLookup _ (snd y1) x = arrayLookup _ (snd y2)
Lemma mem_step_refl m: mem_step m m.
Lemma mem_step_free: forall m b lo hi m', Mem.free m b lo hi = Some m' -> mem_step m m'.
Lemma mem_step_store: forall m ch b a v m', Mem.store ch m b a v = Some m' -> mem_step m m'.
Lemma ptree_finite: forall (t: PTree.t A), exists p, forall n, (p <= n)%positive -> PTree.get n t = None.
Lemma pmap_finite: forall (m: PMap.t A), exists p, forall n, (p <= n)%positive -> PMap.get n m = fst m.
Lemma pmap_construct: forall (f: positive -> A) hi dfl, (forall n, (n >= hi)%positive -> f n = dfl) -> exists m: PMap.t A, forall n, PMap.get n m = f n.
Lemma zmap_finite: forall (m: ZMap.t A), exists lo, exists hi, forall n, n < lo \/ n > hi -> ZMap.get n m = fst m.
Lemma zmap_construct: forall (f: Z -> A) lo hi dfl, (forall n, n < lo \/ n > hi -> f n = dfl) -> exists m: ZMap.t A, forall n, ZMap.get n m = f n.
Lemma compose_meminjI_Some: forall j k b1 b2 d1 b3 d2 (J:j b1 = Some(b2,d1)) (K:k b2 = Some(b3,d2)), compose_meminj j k b1 = Some(b3, d1+d2).
Lemma compose_meminjI_None: forall j k b1 (H: (j b1 = None) \/ (exists b2 d1, j b1 =Some(b2,d1) /\ k b2=None)), compose_meminj j k b1 = None.
Lemma inject_incr_coincide: forall f g (INC: inject_incr f g) b p (G:g b = Some p) q (F:f b = Some q),p=q.
Lemma inject_incr_inv: forall f g (INC: inject_incr f g) b (G: g b =None), f b = None.
Lemma forall2_val_inject_D: forall vals1 vals2 j (ValInjMu : Forall2 (val_inject j) vals1 vals2) v1 (IN: In v1 vals1), exists v2, val_inject j v1 v2 /\ In v2 vals2.
Lemma inj_simulation_star_wf: SM_simulation.SM_simulation_inject Sem1 Sem2 ge1 ge2 entry_points.
Lemma inj_simulation_star: SM_simulation.SM_simulation_inject Sem1 Sem2 ge1 ge2 entry_points.
Lemma inj_simulation_plus: SM_simulation.SM_simulation_inject Sem1 Sem2 ge1 ge2 entry_points.
Lemma external_call_mem_forward: forall (ef : external_function) (F V : Type) (ge : Genv.t F V) (vargs : list val) (m1 : mem) (t : trace) (vres : val) (m2 : mem), external_call ef ge vargs m1 t vres m2 -> mem_forward m1 m2.
Lemma pos_succ_plus_assoc: forall n m, (Pos.succ n + m = n + Pos.succ m)%positive.
Lemma mem_unchanged_on_sub: forall (P Q: block -> BinInt.Z -> Prop) m m', Mem.unchanged_on Q m m' -> (forall b ofs, P b ofs -> Q b ofs) -> Mem.unchanged_on P m m'.
Lemma inject_separated_same_meminj: forall j m m', Events.inject_separated j j m m'.
Theorem drop_extends: forall m1 m2 lo hi b p m1', Mem.extends m1 m2 -> Mem.drop_perm m1 b lo hi p = Some m1' -> exists m2', Mem.drop_perm m2 b lo hi p = Some m2' /\ Mem.extends m1' m2'.
Lemma mem_inj_id_trans: forall m1 m2 (Inj12: Mem.mem_inj inject_id m1 m2) m3 (Inj23: Mem.mem_inj inject_id m2 m3),Mem.mem_inj inject_id m1 m3.
Lemma extends_trans: forall m1 m2 (Ext12: Mem.extends m1 m2) m3 (Ext23: Mem.extends m2 m3), Mem.extends m1 m3.
Lemma memval_inject_id_refl: forall v, memval_inject inject_id v v.
Lemma extends_refl: forall m, Mem.extends m m.
Lemma compose_meminj_idR: forall j, j = compose_meminj j inject_id.
Lemma compose_meminj_idL: forall j, j = compose_meminj inject_id j.
Lemma perm_decE: forall m b ofs k p PF, (Mem.perm_dec m b ofs k p = left PF <-> Mem.perm m b ofs k p).
Lemma flatinj_E: forall b b1 b2 delta (H:Mem.flat_inj b b1 = Some (b2, delta)), b2=b1 /\ delta=0 /\ Plt b2 b.
Lemma flatinj_I: forall bb b, Plt b bb -> Mem.flat_inj bb b = Some (b, 0).
Lemma flatinj_mono: forall b b1 b2 b' delta (F: Mem.flat_inj b1 b = Some (b', delta)), Plt b1 b2 -> Mem.flat_inj b2 b = Some (b', delta).
Lemma core_diagram_trans: forall (core_data12 : Type) (match_core12 : core_data12 -> SM_Injection -> C1 -> mem -> C2 -> mem -> Prop) (core_ord12 : core_data12 -> core_data12 -> Prop) (core_diagram12 : forall (st1 : C1) (m1 : mem) (st1' : C1) (m1' : mem), corestep Sem1 g1 st1 m1 st1' m1' -> forall (cd : core_data12) (st2 : C2) (mu : SM_Injection) (m2 : mem), match_core12 cd mu st1 m1 st2 m2 -> exists (st2' : C2) (m2' : mem) (cd' : core_data12) (mu' : SM_Injection), intern_incr mu mu' /\ sm_inject_separated mu mu' m1 m2 /\ sm_locally_allocated mu mu' m1 m2 m1' m2' /\ match_core12 cd' mu' st1' m1' st2' m2' /\ (*temporarily added:*) SM_wd mu' /\ sm_valid mu' m1' m2' /\ (corestep_plus Sem2 g2 st2 m2 st2' m2' \/ corestep_star Sem2 g2 st2 m2 st2' m2' /\ core_ord12 cd' cd)) (core_data23 : Type) (match_core23 : core_data23 -> SM_Injection -> C2 -> mem -> C3 -> mem -> Prop) (core_ord23 : core_data23 -> core_data23 -> Prop) (core_diagram23 : forall (st1 : C2) (m1 : mem) (st1' : C2) (m1' : mem), corestep Sem2 g2 st1 m1 st1' m1' -> forall (cd : core_data23) (st2 : C3) (mu : SM_Injection) (m2 : mem), match_core23 cd mu st1 m1 st2 m2 -> exists (st2' : C3) (m2' : mem) (cd' : core_data23) (mu' : SM_Injection), intern_incr mu mu' /\ sm_inject_separated mu mu' m1 m2 /\ sm_locally_allocated mu mu' m1 m2 m1' m2' /\ match_core23 cd' mu' st1' m1' st2' m2' /\ (*temporarily added:*) SM_wd mu' /\ sm_valid mu' m1' m2' /\ (corestep_plus Sem3 g3 st2 m2 st2' m2' \/ corestep_star Sem3 g3 st2 m2 st2' m2' /\ core_ord23 cd' cd)) (match_sm_wd12 : forall (d : core_data12) (mu : SM_Injection) (c1 : C1) (m1 : mem) (c2 : C2) (m2 : mem), match_core12 d mu c1 m1 c2 m2 -> SM_wd mu) (match_validblock12 : forall (d : core_data12) (j : SM_Injection) (c1 : C1) (m1 : mem) (c2 : C2) (m2 : mem), match_core12 d j c1 m1 c2 m2 -> sm_valid j m1 m2) (match_sm_wd23 : forall (d : core_data23) (mu : SM_Injection) (c1 : C2) (m1 : mem) (c2 : C3) (m2 : mem), match_core23 d mu c1 m1 c2 m2 -> SM_wd mu) (match_validblock23 : forall (d : core_data23) (j : SM_Injection) (c1 : C2) (m1 : mem) (c2 : C3) (m2 : mem), match_core23 d j c1 m1 c2 m2 -> sm_valid j m1 m2) (st1 : C1) (m1 : mem) (st1' : C1) (m1' : mem) (CS1 : corestep Sem1 g1 st1 m1 st1' m1') (d12 : core_data12) (d23 : core_data23) (st3 : C3) (m3 : mem) (st2 : C2) (m2 : mem) (mu12 : SM_Injection) (mu23 : SM_Injection) (INV : locBlocksTgt mu12 = locBlocksSrc mu23 /\ extBlocksTgt mu12 = extBlocksSrc mu23 /\ (forall b : block, pubBlocksTgt mu12 b = true -> pubBlocksSrc mu23 b = true) /\ (forall b : block, frgnBlocksTgt mu12 b = true -> frgnBlocksSrc mu23 b = true)) (MC12 : match_core12 d12 mu12 st1 m1 st2 m2) (MC23 : match_core23 d23 mu23 st2 m2 st3 m3), exists (st2' : C3) (m2' : mem) (cd' : core_data12 * option C2 * core_data23) (mu' : SM_Injection), intern_incr (compose_sm mu12 mu23) mu' /\ sm_inject_separated (compose_sm mu12 mu23) mu' m1 m3 /\ sm_locally_allocated (compose_sm mu12 mu23) mu' m1 m3 m1' m2' /\ (let (y, d2) := cd' in let (d1, X) := y in exists (c0 : C2) (m0 : mem) (mu1 mu2 : SM_Injection), X = Some c0 /\ mu' = compose_sm mu1 mu2 /\ (locBlocksTgt mu1 = locBlocksSrc mu2 /\ extBlocksTgt mu1 = extBlocksSrc mu2 /\ (forall b : block, pubBlocksTgt mu1 b = true -> pubBlocksSrc mu2 b = true) /\ (forall b : block, frgnBlocksTgt mu1 b = true -> frgnBlocksSrc mu2 b = true)) /\ match_core12 d1 mu1 st1' m1' c0 m0 /\ match_core23 d2 mu2 c0 m0 st2' m2') /\ (*temporarily added:*) SM_wd mu' /\ sm_valid mu' m1' m2' /\ (corestep_plus Sem3 g3 st3 m3 st2' m2' \/ corestep_star Sem3 g3 st3 m3 st2' m2' /\ clos_trans (core_data12 * option C2 * core_data23) (sem_compose_ord_eq_eq core_ord12 core_ord23 C2) cd' (d12, Some st2, d23)).
Lemma init_mapping_wf: map_wf init_mapping.
Lemma add_var_wf: forall s1 s2 map name r map' i, add_var map name s1 = OK (r,map') s2 i -> map_wf map -> map_valid map s1 -> map_wf map'.
Lemma add_vars_wf: forall names s1 s2 map map' rl i, add_vars map names s1 = OK (rl,map') s2 i -> map_wf map -> map_valid map s1 -> map_wf map'.
Lemma add_letvar_wf: forall map r, map_wf map -> ~reg_in_map map r -> map_wf (add_letvar map r).
Lemma match_env_inject_incr: forall j map e le rs (MENV: match_env j map e le rs) j' (INC: inject_incr j j'), match_env j' map e le rs.
Lemma match_env_restrictD: forall j X map e le rs (MENV: match_env (restrict j X) map e le rs), match_env j map e le rs.
Lemma match_env_unbind_letvar: forall j map e le rs r v, match_env j (add_letvar map r) e (v :: le) rs -> match_env j map e le rs.
Lemma match_env_empty: forall j map, map.(map_letvars) = nil -> match_env j map (PTree.empty val) nil (Regmap.init Vundef).
Lemma match_init_env_init_reg: forall j params s0 rparams map1 s1 i1 vars rvars map2 s2 i2 vparams tvparams, add_vars init_mapping params s0 = OK (rparams, map1) s1 i1 -> add_vars map1 vars s1 = OK (rvars, map2) s2 i2 -> val_list_inject j vparams tvparams -> match_env j map2 (set_locals vars (set_params vparams params)) nil (init_regs tvparams rparams).
Lemma symbols_preserved: forall (s: ident), Genv.find_symbol tge s = Genv.find_symbol ge s.
Lemma function_ptr_translated: forall (b: block) (f: CminorSel.fundef), Genv.find_funct_ptr ge b = Some f -> exists tf, Genv.find_funct_ptr tge b = Some tf /\ transl_fundef f = OK tf.
Lemma functions_translated: forall (v: val) (f: CminorSel.fundef), Genv.find_funct ge v = Some f -> exists tf, Genv.find_funct tge v = Some tf /\ transl_fundef f = OK tf.
Lemma sig_transl_function: forall (f: CminorSel.fundef) (tf: RTL.fundef), transl_fundef f = OK tf -> RTL.funsig tf = CminorSel.funsig f.
Lemma varinfo_preserved: forall b, Genv.find_var_info tge b = Genv.find_var_info ge b.
Lemma EmptyEffect_allocvariables: forall L e m e' m' (ALLOC: alloc_variables e m L e' m'), Mem.unchanged_on (fun b ofs => EmptyEffect b ofs = false) m m'.
Lemma storebytes_freshloc: forall m b z bytes m' (SB: Mem.storebytes m b z bytes = Some m'), freshloc m m' = (fun _ : block => false).
Lemma assign_loc_freshloc: forall ty m b ofs v m' (AL:assign_loc ty m b ofs v m'), freshloc m m' = fun b => false.
Lemma rtl_effax1: forall (M : block -> Z -> bool) g c m c' m', RTL_effstep g M c m c' m' -> (corestep rtl_coop_sem g c m c' m' /\ Mem.unchanged_on (fun (b : block) (ofs : Z) => M b ofs = false) m m').
Lemma rtl_effax2: forall g c m c' m', corestep rtl_coop_sem g c m c' m' -> exists M, RTL_effstep g M c m c' m'.
Lemma symbols_preserved: forall (s: ident), Genv.find_symbol tge s = Genv.find_symbol ge s.
Lemma function_ptr_translated: forall (b: block) (f: Cminor.fundef), Genv.find_funct_ptr ge b = Some f -> Genv.find_funct_ptr tge b = Some (sel_fundef hf ge f).
Lemma ptree_finite: forall (t: PTree.t A), exists p, forall n, (p <= n)%positive -> PTree.get n t = None.
Lemma pmap_finite: forall (m: PMap.t A), exists p, forall n, (p <= n)%positive -> PMap.get n m = fst m.
Lemma pmap_construct: forall (f: positive -> A) hi dfl, (forall n, (n >= hi)%positive -> f n = dfl) -> exists m: PMap.t A, forall n, PMap.get n m = f n.
Lemma zmap_finite: forall (m: ZMap.t A), exists lo, exists hi, forall n, n < lo \/ n > hi -> ZMap.get n m = fst m.
Lemma zmap_construct: forall (f: Z -> A) lo hi dfl, (forall n, n < lo \/ n > hi -> f n = dfl) -> exists m: ZMap.t A, forall n, ZMap.get n m = f n.
Lemma symbols_preserved: forall (s: ident), Genv.find_symbol tge s = Genv.find_symbol ge s.
Lemma function_ptr_translated: forall (b: block) (f: Csharpminor.fundef), Genv.find_funct_ptr ge b = Some f -> exists tf, Genv.find_funct_ptr tge b = Some tf /\ transl_fundef f = OK tf.
Lemma functions_translated: forall (v: val) (f: Csharpminor.fundef), Genv.find_funct ge v = Some f -> exists tf, Genv.find_funct tge v = Some tf /\ transl_fundef f = OK tf.
Lemma varinfo_preserved: forall b, Genv.find_var_info tge b = Genv.find_var_info ge b.
Lemma sig_preserved_body: forall f tf cenv size, transl_funbody cenv size f = OK tf -> tf.(fn_sig) = Csharpminor.fn_sig f.
Lemma sig_preserved: forall f tf, transl_fundef f = OK tf -> Cminor.funsig tf = Csharpminor.funsig f.
Lemma load_freelist: forall fbl chunk m b ofs m', (forall b' lo hi, In (b', lo, hi) fbl -> b' <> b) -> Mem.free_list m fbl = Some m' -> Mem.load chunk m' b ofs = Mem.load chunk m b ofs.
Lemma perm_freelist: forall fbl m m' b ofs k p, Mem.free_list m fbl = Some m' -> Mem.perm m' b ofs k p -> Mem.perm m b ofs k p.
Lemma nextblock_freelist: forall fbl m m', Mem.free_list m fbl = Some m' -> Mem.nextblock m' = Mem.nextblock m.
Lemma free_list_freeable: forall l m m', Mem.free_list m l = Some m' -> forall b lo hi, In (b, lo, hi) l -> Mem.range_perm m b lo hi Cur Freeable.
Lemma nextblock_storev: forall chunk m addr v m', Mem.storev chunk m addr v = Some m' -> Mem.nextblock m' = Mem.nextblock m.
Lemma match_temps_invariant: forall f f' le te, match_temps f le te -> inject_incr f f' -> match_temps f' le te.
Lemma match_temps_assign: forall f le te id v tv, match_temps f le te -> val_inject f v tv -> match_temps f (PTree.set id v le) (PTree.set id tv te).
Lemma symbols_preserved: forall (s: ident), Genv.find_symbol tge s = Genv.find_symbol ge s.
Lemma function_ptr_translated: forall (b: block) (f: Csharpminor.fundef), Genv.find_funct_ptr ge b = Some f -> exists tf, Genv.find_funct_ptr tge b = Some tf /\ transl_fundef f = OK tf.
Lemma functions_translated: forall (v: val) (f: Csharpminor.fundef), Genv.find_funct ge v = Some f -> exists tf, Genv.find_funct tge v = Some tf /\ transl_fundef f = OK tf.
Lemma varinfo_preserved: forall b, Genv.find_var_info tge b = Genv.find_var_info ge b.
Lemma sig_preserved_body: forall f tf cenv size, transl_funbody cenv size f = OK tf -> tf.(fn_sig) = Csharpminor.fn_sig f.
Lemma sig_preserved: forall f tf, transl_fundef f = OK tf -> Cminor.funsig tf = Csharpminor.funsig f.
Lemma load_freelist: forall fbl chunk m b ofs m', (forall b' lo hi, In (b', lo, hi) fbl -> b' <> b) -> Mem.free_list m fbl = Some m' -> Mem.load chunk m' b ofs = Mem.load chunk m b ofs.
Lemma perm_freelist: forall fbl m m' b ofs k p, Mem.free_list m fbl = Some m' -> Mem.perm m' b ofs k p -> Mem.perm m b ofs k p.
Lemma nextblock_freelist: forall fbl m m', Mem.free_list m fbl = Some m' -> Mem.nextblock m' = Mem.nextblock m.
Lemma free_list_freeable: forall l m m', Mem.free_list m l = Some m' -> forall b lo hi, In (b, lo, hi) l -> Mem.range_perm m b lo hi Cur Freeable.
Lemma nextblock_storev: forall chunk m addr v m', Mem.storev chunk m addr v = Some m' -> Mem.nextblock m' = Mem.nextblock m.
Lemma match_temps_invariant: forall f f' le te, match_temps f le te -> inject_incr f f' -> match_temps f' le te.
Lemma match_temps_assign: forall f le te id v tv, match_temps f le te -> val_inject f v tv -> match_temps f (PTree.set id v le) (PTree.set id tv te).
Lemma allocvars_blocks_valid: forall vars E m e m1, alloc_variables E m vars e m1 -> forall b, Mem.valid_block m b -> Mem.valid_block m1 b.
Lemma storev_valid_block_1: forall ch m addr v m', Mem.storev ch m addr v = Some m' -> (forall b, Mem.valid_block m b -> Mem.valid_block m' b).
Lemma storev_valid_block_2: forall ch m addr v m', Mem.storev ch m addr v = Some m' -> (forall b, Mem.valid_block m' b -> Mem.valid_block m b).
Lemma add_global_find_symbol: forall {F V} (g: Genv.t F V) m0 m x (G: Genv.alloc_global (Genv.add_global g x) m0 x = Some m) (N: Genv.genv_next g = Mem.nextblock m0) b (VB: Mem.valid_block m b), Mem.valid_block m0 b \/ exists id, Genv.find_symbol (Genv.add_global g x) id = Some b.
Lemma genv_find_add_global_fresh: forall {F V} (g:Genv.t F V) i i0 v0 (I:i0 <> i), Genv.find_symbol (Genv.add_global g (i0, v0)) i = Genv.find_symbol g i.
Lemma genv_find_add_globals_fresh: forall {F V} defs (g:Genv.t F V) i (G: ~ In i (map fst defs)), Genv.find_symbol (Genv.add_globals g defs) i = Genv.find_symbol g i.
Lemma add_globals_find_symbol: forall {F V} (defs : list (ident * globdef F V)) (R: list_norepet (map fst defs)) (g: Genv.t F V) m0 m (G: Genv.alloc_globals (Genv.add_globals g defs) m0 defs = Some m) (N: Genv.genv_next g = Mem.nextblock m0) b (VB: Mem.valid_block m b), Mem.valid_block m0 b \/ exists id, Genv.find_symbol (Genv.add_globals g defs) id = Some b.
Lemma runnable_false (G C M (*D*): Type) (csem: CoreSemantics G C M (*D*)): forall c, runnable csem c=false -> (exists rv, halted csem c = Some rv) \/ (exists ef, exists sig, exists args, at_external csem c = Some (ef, sig, args)).
Lemma zint_invar_over_corestepN: forall n s m s' m', corestepN csem ge_core n (proj_core E s) m (proj_core E s') m' -> corestepN esem ge n s m s' m' -> proj_zint E s=proj_zint E s'.
Lemma corestepN_pres: forall n s m c' s' m' m'', corestepN csem ge_core n (proj_core E s) m c' m' -> corestepN esem ge n s m s' m'' -> proj_core E s' = c' /\ m'=m''.
Lemma corestep_step: forall s m c' m', let c := proj_core E s in corestep csem ge_core c m c' m' -> exists s', corestep esem ge s m s' m' /\ proj_core E s' = c'.
Lemma corestep_stepN: forall n s m c' m', let c := proj_core E s in corestepN csem ge_core n c m c' m' -> exists s', corestepN esem ge n s m s' m' /\ proj_core E s' = c'.
Lemma corestep_step_star: forall s m c' m', let c := proj_core E s in corestep_star csem ge_core c m c' m' -> exists s', corestep_star esem ge s m s' m' /\ proj_core E s' = c'.
Lemma corestep_step_plus: forall s m c' m', let c := proj_core E s in corestep_plus csem ge_core c m c' m' -> exists s', corestep_plus esem ge s m s' m' /\ proj_core E s' = c'.
Lemma external_call_mem_forward: forall (ef : external_function) (F V : Type) (ge : Genv.t F V) (vargs : list val) (m1 : mem) (t : trace) (vres : val) (m2 : mem), external_call ef ge vargs m1 t vres m2 -> mem_forward m1 m2.
Lemma pos_succ_plus_assoc: forall n m, (Pos.succ n + m = n + Pos.succ m)%positive.
Lemma mem_unchanged_on_sub: forall (P Q: block -> BinInt.Z -> Prop) m m', Mem.unchanged_on Q m m' -> (forall b ofs, P b ofs -> Q b ofs) -> Mem.unchanged_on P m m'.
Lemma inject_separated_same_meminj: forall j m m', Events.inject_separated j j m m'.
Theorem drop_extends: forall m1 m2 lo hi b p m1', Mem.extends m1 m2 -> Mem.drop_perm m1 b lo hi p = Some m1' -> exists m2', Mem.drop_perm m2 b lo hi p = Some m2' /\ Mem.extends m1' m2'.
Lemma mem_inj_id_trans: forall m1 m2 (Inj12: Mem.mem_inj inject_id m1 m2) m3 (Inj23: Mem.mem_inj inject_id m2 m3),Mem.mem_inj inject_id m1 m3.
Lemma extends_trans: forall m1 m2 (Ext12: Mem.extends m1 m2) m3 (Ext23: Mem.extends m2 m3), Mem.extends m1 m3.
Lemma memval_inject_id_refl: forall v, memval_inject inject_id v v.
Lemma extends_refl: forall m, Mem.extends m m.
Lemma compose_meminj_idR: forall j, j = compose_meminj j inject_id.
Lemma compose_meminj_idL: forall j, j = compose_meminj inject_id j.
Lemma perm_decE: forall m b ofs k p PF, (Mem.perm_dec m b ofs k p = left PF <-> Mem.perm m b ofs k p).
Lemma flatinj_E: forall b b1 b2 delta (H:Mem.flat_inj b b1 = Some (b2, delta)), b2=b1 /\ delta=0 /\ Plt b2 b.
Lemma flatinj_I: forall bb b, Plt b bb -> Mem.flat_inj bb b = Some (b, 0).
Lemma flatinj_mono: forall b b1 b2 b' delta (F: Mem.flat_inj b1 b = Some (b', delta)), Plt b1 b2 -> Mem.flat_inj b2 b = Some (b', delta).
Lemma eq_simulation_star_wf: @Forward_simulation_eq.Forward_simulation_equals _ _ _ _ _ _ _ Sem1 Sem2 ge1 ge2 entry_points.
Lemma eq_simulation_star: @Forward_simulation_eq.Forward_simulation_equals _ _ _ _ _ _ _ Sem1 Sem2 ge1 ge2 entry_points.
Lemma eq_simulation_plus: @Forward_simulation_eq.Forward_simulation_equals _ _ _ _ _ _ _ Sem1 Sem2 ge1 ge2 entry_points.
Lemma ext_simulation_star_wf: Forward_simulation_ext.Forward_simulation_extends Sem1 Sem2 ge1 ge2 entry_points.
Lemma ext_simulation_star: Forward_simulation_ext.Forward_simulation_extends Sem1 Sem2 ge1 ge2 entry_points.
Lemma ext_simulation_plus: Forward_simulation_ext.Forward_simulation_extends Sem1 Sem2 ge1 ge2 entry_points.
Lemma inj_simulation_star_wf: Forward_simulation_inj.Forward_simulation_inject Sem1 Sem2 ge1 ge2 entry_points.
Lemma inj_simulation_star: Forward_simulation_inj.Forward_simulation_inject Sem1 Sem2 ge1 ge2 entry_points.
Lemma inj_simulation_plus: Forward_simulation_inj.Forward_simulation_inject Sem1 Sem2 ge1 ge2 entry_points.
Lemma corec_fold_unfold {B A}: forall {F: (B -> pred A) -> (B -> pred A)}, covariant F -> corec F = F (corec F).
Lemma covariant_sepcon {B}{A} {JA: Join A}{PA: Perm_alg A}: forall P Q : (B -> pred A) -> (B -> pred A), covariant P -> covariant Q -> covariant (fun (x : B -> pred A) b => P x b * Q x b)%pred.
Lemma covariant_const {B A}: forall P : B -> pred A, covariant (fun _ => P).
Lemma covariant_orp {B A}: forall P Q: (B -> pred A)-> (B -> pred A), covariant P -> covariant Q -> covariant (fun x b => P x b || Q x b)%pred.
Lemma covariant_andp {B A}: forall P Q: (B -> pred A) -> (B -> pred A), covariant P -> covariant Q -> covariant (fun x b => P x b && Q x b)%pred.
Lemma covariant_exp {C B A}: forall F: C -> (B -> pred A) -> (B -> pred A), (forall c, covariant (F c)) -> covariant (fun P b => EX c:C, F c P b)%pred.
Lemma covariant_id {B A}: covariant (fun F: B -> pred A => F).
Lemma covariant_const' {B A}: forall c:B, covariant (fun (P: B -> pred A) _ => P c).
Lemma unsquash_inj : forall k1 k2, unsquash k1 = unsquash k2 -> k1 = k2.
Lemma squash_surj : forall k, exists n, exists Fp, squash (n, Fp) = k.
Lemma unsquash_approx : forall k n Fp, unsquash k = (n, Fp) -> Fp = fmap F (approx n) Fp.
Lemma approx_approx1 : forall m n, approx n = approx n oo approx (m+n).
Lemma approx_approx2 : forall m n, approx n = approx (m+n) oo approx n.
Lemma unsquash_squash_unfolded : forall nf, unsquash (squash nf) = (fst nf, fmap F (approx (fst nf)) (snd nf)).
Lemma unsquash_approx_unfolded : forall k, unsquash k = (fst (unsquash k), fmap F (approx (fst (unsquash k))) (snd (unsquash k))).
Lemma predicate_eq : forall (p1 p2:predicate), proj1_sig p1 = proj1_sig p2 -> p1 = p2.
Lemma unsquash_inj : forall k1 k2, unsquash k1 = unsquash k2 -> k1 = k2.
Lemma squash_surj : forall k, exists n, exists Fp, squash (n, Fp) = k.
Lemma unsquash_approx : forall k n Fp, unsquash k = (n, Fp) -> Fp = fmap F (approx n) Fp.
Lemma approx_approx1 : forall m n, approx n = approx n oo approx (m+n).
Lemma approx_approx2 : forall m n, approx n = approx (m+n) oo approx n.
Lemma unsquash_squash_unfolded : forall nf, unsquash (squash nf) = (fst nf, fmap F (approx (fst nf)) (snd nf)).
Lemma unsquash_approx_unfolded : forall k, unsquash k = (fst (unsquash k), fmap F (approx (fst (unsquash k))) (snd (unsquash k))).
Lemma eq_rect_eq : forall (U:Type) (p:U) (Q:U -> Type) (x:Q p) (h:p = p), x = eq_rect p Q x p h.
Lemma pjoin_unit {A} {JA: Join A}{PosA: Pos_alg A}: forall {a b : A}, join a b b -> False.
Lemma In_Permutation_cons: forall {A : Type} (l : list A) (x : A), In x l -> exists l', Permutation l (x :: l').
Lemma incl_Permutation {A: Type}: forall (l1 l2: list A), NoDup l2 -> incl l2 l1 -> exists l', Permutation l1 (l2 ++ l').
Lemma extensionality: forall (A B: Type) (f g : A -> B), (forall x, f x = g x) -> f = g.
Lemma conj_nonexpansive {A} `{ageable A} : forall (F G:pred A -> pred A), nonexpansive F -> nonexpansive G -> nonexpansive (fun x:pred A => F x && G x).
Lemma conj_contractive {A} `{ageable A} : forall F G, contractive F -> contractive G -> contractive (fun x => F x && G x).
Lemma forall_contractive {A} `{ageable A} : forall B (X : pred A -> B -> pred A), (forall x, (contractive (fun y => X y x))) -> contractive (fun x => (allp (X x))).
Lemma forall_nonexpansive {A} `{ageable A} : forall B (X : pred A -> B -> pred A), (forall x, (nonexpansive (fun y => X y x))) -> nonexpansive (fun x => (allp (X x))).
Lemma exists_contractive {A} `{ageable A} : forall B (X : pred A -> B -> pred A), (forall x, (contractive (fun y => X y x))) -> contractive (fun x => (exp (X x))).
Lemma exists_nonexpansive {A} `{ageable A} : forall B (X : pred A -> B -> pred A), (forall x, (nonexpansive (fun y => X y x))) -> nonexpansive (fun x => (exp (X x))).
Lemma const_nonexpansive {A: Type} {H: ageable A}: forall P: pred A, nonexpansive (fun _ => P).
Lemma const_contractive {A: Type} {H: ageable A}: forall P: pred A, contractive (fun _ => P).
Lemma identity_nonexpansive {A: Type} {H: ageable A}: nonexpansive (fun P: pred A => P).
Lemma contractive_nonexpansive {A} `{ageable A} : forall F, contractive F -> nonexpansive F.
Lemma sepcon_contractive {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{AG: ageable A}{XA: Age_alg A} : forall F G, contractive F -> contractive G -> contractive (fun x => F x * G x).
Lemma sepcon_nonexpansive {A}{JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{AG: ageable A}{XA: Age_alg A} : forall F G, nonexpansive F -> nonexpansive G -> nonexpansive (fun x => F x * G x).
Lemma Rec_contractive {A} `{ageable A} : forall (F : pred A -> pred A -> pred A) (HF1 : forall X, contractive (F X)) (HF2 : forall R, contractive (fun X => F X R)), contractive (fun X => Rec (F X)).
Lemma Rec_nonexpansive {A} `{ageable A} : forall (F : pred A -> pred A -> pred A) (HF1 : forall X, contractive (F X)) (HF2 : forall R, nonexpansive (fun X => F X R)), nonexpansive (fun X => Rec (F X)).
Lemma HORec_contractive {A} `{ageable A} : forall B (F : pred A -> (B -> pred A) -> B -> pred A) (HF1 : forall X, HOcontractive (F X)) (HF2 : forall R a, contractive (fun X => F X R a)), forall a, contractive (fun X => HORec (F X) a).
Lemma HORec_nonexpansive {A} `{ageable A} : forall B (F : pred A -> (B -> pred A) -> B -> pred A) (HF1 : forall X, HOcontractive (F X)) (HF2 : forall R a, nonexpansive (fun X => F X R a)), forall a, nonexpansive (fun X => HORec (F X) a).
Lemma orp_HOcontractive {A}{agA: ageable A}: forall X (P Q: (X -> pred A) -> (X -> pred A)), HOcontractive P -> HOcontractive Q -> HOcontractive (fun R x => P R x || Q R x).
Lemma andp_HOcontractive {A}{agA: ageable A}: forall X (P Q: (X -> pred A) -> (X -> pred A)), HOcontractive P -> HOcontractive Q -> HOcontractive (fun R x => P R x && Q R x).
Lemma sepcon_HOcontractive {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{AG: ageable A}{XA: Age_alg A}: forall X (P Q: (X -> pred A) -> (X -> pred A)), HOcontractive P -> HOcontractive Q -> HOcontractive (fun R x => P R x * Q R x).
Lemma const_HOcontractive{A}{agA: ageable A}: forall X (P : X -> pred A), HOcontractive (fun _ => P).
Lemma exp_HOcontractive {A}{agA: ageable A}: forall X Y (G: Y -> X -> X) (F: Y -> X -> pred A -> pred A), (forall y x, contractive (F y x)) -> HOcontractive (fun (R: X -> pred A) (x: X) => EX y: Y, F y x (R (G y x))).
Lemma const_contractive {A}{agA: ageable A}: forall P : pred A, contractive (fun _ => P).
Lemma later_contractive' {A} `{ageable A} : contractive (box laterM).
Lemma in_app: (* THIS IS FROM compcert/Coqlib.v *) forall (A: Type) (x: A) (l1 l2: list A), In x (l1 ++ l2) <-> In x l1 \/ In x l2.
Lemma andp_TT {A}`{ageable A}: forall (P: pred A), P && TT = P.
Lemma pure_sepcon {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall (P : pred A), pure P -> P*P=P.
Lemma sepcon_pure_andp {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall P Q, pure P -> pure Q -> ((P * Q) = (P && Q)).
Lemma pure_emp {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: pure emp.
Lemma join_equiv_refl {A}: forall x:A, @join A (Join_equiv A) x x x.
Lemma pure_existential {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall B (P: B -> pred A), (forall x: B , pure (P x)) -> pure (exp P).
Lemma pure_core {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall P w, pure P -> P w -> P (core w).
Lemma FF_sepcon {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall P, FF * P = FF.
Lemma sepcon_FF {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall P, P * FF = FF.
Lemma pure_con' {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall P Q, pure P -> pure Q -> pure (P*Q).
Lemma pure_intersection1: forall {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A} (P Q: pred A), pure P -> pure (P && Q).
Lemma pure_intersection2: forall {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A} (P Q: pred A), pure Q -> pure (P && Q).
Lemma FF_andp {A} `{ageable A}: forall P: pred A, FF && P = FF.
Lemma andp_FF {A}`{ageable A}: forall P: pred A, P && FF = FF.
Lemma andp_emp_sepcon_TT {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall (Q: pred A), (forall w1 w2, core w1 = core w2 -> Q w1 -> Q w2) -> (Q && emp * TT = Q).
Lemma pure_sepcon_TT_andp {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall P Q, pure P -> (P * TT) && Q = (P*Q).
Lemma pure_sepcon_TT_andp' {A} {JA: Join A}{PA: Perm_alg A}{SA: Sep_alg A}{agA: ageable A}{AgeA: Age_alg A}: forall P Q, pure P -> Q && (P * TT) = (Q*P).
Lemma valid_rel_fashion {A} `{AG: ageable A} : valid_rel fashionR.
Lemma unfash_sepcon_distrib: forall {T}{agT: ageable T}{JoinT: Join T}{PermT: Perm_alg T}{SepT: Sep_alg T}{AgeT: Age_alg T} (P: pred nat) (Q R: pred T), unfash P && (Q*R) = (unfash P && Q) * (unfash P && R).
Lemma isvNat: forall n, isValue (Nat n).
Lemma isvLoc: forall l, isValue (Loc l).
Lemma isvLam: forall e, closed' 1 e -> isValue (Lam e).
Lemma expr_type_safen: forall k v e tau, expr_type e tau (k,v) -> forall m, mtype_valid m (k,v) -> safen (level k) (m,e).
Theorem typing_implies_safety: forall e tau, Typ nil e tau -> safe_prog e.
Lemma isVal_val2exp : forall v, isValue (val_to_exp v).
Lemma closed_dec : forall e n, { closed' n e} + { ~closed' n e}.
Lemma value_dec : forall e, { isValue e } + { ~isValue e }.
Lemma exp_to_val_to_exp : forall v H, exp_to_val (val_to_exp v) H = v.
Lemma subst_env_valid_closed : forall env G e a, closed' (length G) e -> etype_valid env G a -> closed (subst_env env e).
Lemma etype_valid_val : forall G env m v v', etype_valid env G (m,v) -> etype_valid env G (m,v').
Lemma expr_type_val : forall e tau k v v', expr_type e tau (k,v) -> expr_type e tau (k,v').
Lemma openValue_valid_value : forall env G a e, openValue e -> closed' (length G) e -> etype_valid env G a -> isValue (subst_env env e).
Lemma expr_ty_deref_loc : forall l tau a, expr_type (Loc l) (ty_ref tau) a -> expr_type (Deref (Loc l)) tau a.
Lemma T_weaken : forall G G' e tau, Typ G e tau -> Typ (G++G') e tau.
Lemma T_weaken_nil : forall G e tau, Typ nil e tau -> Typ G e tau.
Lemma etype_valid_sub : forall G G' env a, gamma_sub G G' -> etype_valid env G' a -> etype_valid env G a.
Lemma T_weaken_sub : forall G G' e tau, gamma_sub G G' -> Typ G e tau -> Typ G' e tau.
Lemma T_Nat : forall G n, Typ G (Nat n) ty_nat.
Lemma T_Var: forall G x tau, nth_error G x = Some tau -> (* g(x) = tau *) Typ G (Var x) tau.
Lemma T_Abs: forall G sigma e tau, Typ (sigma :: G) e tau -> Typ G (Lam e) (ty_lam sigma tau).
Lemma nth_error_None_iff: forall {A} (l: list A) n, nth_error l n = None <-> n >= length l.
Lemma peq: forall (n1 n2: positive), {n1=n2}+{n1<>n2}.
Lemma later_level : forall k1 k2 : K.knot, laterR k1 k2 -> level k2 < level k1.
Lemma nec_level : forall k1 k2 : K.knot, necR k1 k2 -> level k2 <= level k1.
Lemma age1_level : forall p1 p2 : K.knot, age1 p1 = Some p2 -> level p1 = S (level p2).
Lemma peq: forall (n1 n2: positive), {n1=n2}+{n1<>n2}.
Lemma later_level : forall k1 k2, laterR k1 k2 -> level k2 < level k1.
Lemma nec_level : forall k1 k2, necR k1 k2 -> level k2 <= level k1.
Lemma age1_level : forall p1 p2, age1 p1 = Some p2 -> level p1 = S (level p2).
Lemma peq: forall (n1 n2: positive), {n1=n2}+{n1<>n2}.
Lemma later_level : forall k1 k2 : K.knot, laterR k1 k2 -> level k2 < level k1.
Lemma nec_level : forall k1 k2 : K.knot, necR k1 k2 -> level k2 <= level k1.
Lemma arguments_gss: forall x xl v vl, arguments (x::xl)(v::vl) x = v.
Lemma arguments_gso: forall x xl v vl x', x<>x' -> arguments (x::xl)(v::vl)x' = arguments xl vl x'.
Lemma typecheck_binop_sound: forall op {CS: compspecs} (rho : environ) m (e1 e2 : expr) (t : type) (IBR: denote_tc_assert (isBinOpResultType op e1 e2 t) rho m) (TV2: tc_val (typeof e2) (eval_expr e2 rho)) (TV1: tc_val (typeof e1) (eval_expr e1 rho)), tc_val t (eval_binop op (typeof e1) (typeof e2) (eval_expr e1 rho) (eval_expr e2 rho)).
Lemma eval_lvalue_ptr : forall {CS: compspecs} rho m e (Delta: tycontext) te ve ge, mkEnviron ge ve te = rho -> typecheck_var_environ ve (var_types Delta) -> typecheck_glob_environ ge (glob_types Delta) -> denote_tc_assert (typecheck_lvalue Delta e) rho m -> exists base, exists ofs, eval_lvalue e rho = Vptr base ofs.
Lemma no_dups_swap: forall F V a b c, @no_dups F V (a++b) c -> @no_dups F V (b++a) c.
Lemma join_sub_share_top: forall sh, join_sub Share.top sh -> sh = Share.top.
Lemma opt2list2opt: forall {A:Type} (l: option A), list2opt (opt2list l) = l.
Lemma nat_of_Z_minus_le : forall z a b, b <= a -> (nat_of_Z (z - a) <= nat_of_Z (z - b))%nat.
Lemma age_laterR {A} `{ageable A}: forall {x y}, age x y -> laterR x y.
Lemma typecheck_environ_sub: forall Delta Delta', tycontext_sub Delta Delta' -> forall rho, typecheck_environ Delta' rho -> typecheck_environ Delta rho.
Lemma funassert_resource: forall Delta rho a a' (Hl: level a = level a') (Hr: resource_at a = resource_at a'), funassert Delta rho a -> funassert Delta rho a'.
Lemma cl_corestep_fun': forall ge, corestep_fun (cl_core_sem ge).
Lemma jsafe_corestep_forward: forall {Espec: OracleKind} ge c m c' m' n z, jstep (cl_core_sem ge) c m c' m' -> jsafeN (@OK_spec Espec) ge (S n) z c m -> jm_bupd z (jsafeN (@OK_spec Espec) ge n z c') m'.
Lemma semax_unfold {CS: compspecs} {Espec: OracleKind}: semax Espec = fun Delta P c R => forall (psi: Clight.genv) Delta' (w: nat) (TS: tycontext_sub Delta Delta') (HGG: genv_cenv psi = cenv_cs) (Prog_OK: believe Espec Delta' psi Delta' w) (k: cont) (F: assert), closed_wrt_modvars c F -> rguard Espec psi Delta' (frame_ret_assert R F) k w -> guard Espec psi Delta' (fun rho => F rho * P rho) (Kseq c :: k) w.
Lemma unrel_glb: forall a b, Share.unrel a b = Share.unrel a (Share.glb a b).
Lemma share_rel_unrel': forall r sh, Share.rel r (Share.unrel r sh) = Share.glb r sh.
Lemma share_sub_Lsh: forall sh, identity (Share.unrel Share.Rsh sh) -> join_sub sh Share.Lsh.
Lemma join_splice2_aux: forall a1 a2 a3 b1 b2 b3, Share.lub (Share.rel Share.Lsh (Share.lub a1 a2)) (Share.rel Share.Rsh (Share.lub b1 b2)) = Share.lub (Share.rel Share.Lsh a3) (Share.rel Share.Rsh b3) -> Share.lub a1 a2 = a3 /\ Share.lub b1 b2 = b3.
Lemma share_rel_unrel: forall r sh, join_sub sh r -> Share.rel r (Share.unrel r sh) = sh.
Lemma glb_rel_Lsh_Rsh: forall a b, Share.glb (Share.rel Share.Lsh a) (Share.rel Share.Rsh b) = Share.bot.
Lemma glb_Rsh_rel_Lsh_sh: forall sh, Share.glb Share.Rsh (Share.rel Share.Lsh sh) = Share.bot.
Lemma right_nonempty_readable: forall rsh sh, sepalg.nonidentity sh <-> readable_share (Share.splice rsh sh).
Lemma writable_share_right: forall sh, writable_share sh -> Share.unrel Share.Rsh sh = Share.top.
Lemma unrel_bot: forall sh, nonidentity sh -> Share.unrel sh Share.bot = Share.bot.
Lemma join_splice2_aux1: forall a1 a2 b1 b2, Share.lub (Share.rel Share.Lsh (Share.glb a1 a2)) (Share.rel Share.Rsh (Share.glb b1 b2)) = Share.bot -> Share.glb a1 a2 = Share.bot /\ Share.glb b1 b2 = Share.bot.
Lemma join_splice: forall a1 a2 a3 b1 b2 b3, sepalg.join a1 a2 a3 -> sepalg.join b1 b2 b3 -> sepalg.join (Share.splice a1 b1) (Share.splice a2 b2) (Share.splice a3 b3).
Lemma splice_bot2: forall sh, Share.splice sh Share.bot = Share.rel Share.Lsh sh.
Lemma splice_unrel_unrel: forall sh, Share.splice (Share.unrel Share.Lsh sh) (Share.unrel Share.Rsh sh) = sh.
Lemma join_splice2: forall a1 a2 a3 b1 b2 b3 : Share.t, join (Share.splice a1 b1) (Share.splice a2 b2) (Share.splice a3 b3) -> join a1 a2 a3 /\ join b1 b2 b3.
Lemma nonidentity_rel_Lsh: forall t, nonidentity (Share.rel Share.Lsh t) -> nonidentity t.
Lemma readable_share_unrel_Rsh: forall sh, readable_share sh <-> nonunit (Share.unrel Share.Rsh sh).
Lemma mapsto_core_load: forall ch v sh loc m, (address_mapsto ch v sh loc * TT)%pred m -> core_load ch loc v m.
Lemma nth_error_in_bounds: forall {A} (l: list A) i, (O <= i < length l)%nat -> exists x, nth_error l i = value x.
Lemma nth_eq_nth_error_eq: forall {A} (d: A) (l l': list A) i, (O <= i < length l)%nat -> length l = length l' -> nth i l d = nth i l' d -> nth_error l i = nth_error l' i.
Lemma core_load_fun: forall ch m loc v1 v2, core_load ch loc v1 m -> core_load ch loc v2 m -> v1=v2.
Lemma extensible_core_load': forall ch loc v w w', extendR w w' -> core_load ch loc v w -> core_load ch loc v w'.
Lemma rmap_unage_age: forall r, age (rmap_unage r) r.
Lemma adr_range_split_lem1: forall n m r loc loc', r = n + m -> n >= 0 -> m >= 0 -> adr_range loc n loc' -> adr_range loc r loc'.
Lemma adr_range_split_lem2: forall n m r loc loc', r = n + m -> n >= 0 -> m >= 0 -> adr_range (fst loc, snd loc + n) m loc' -> adr_range loc r loc'.
Lemma adr_range_split_lem3: forall n m r loc loc', r = n + m -> n >= 0 -> m >= 0 -> ~adr_range loc n loc' -> ~adr_range (fst loc, snd loc + n) m loc' -> ~adr_range loc r loc'.
Lemma corable_pureat: forall pp k loc, corable (pureat pp k loc).
Lemma corable_func_at: forall f l, corable (func_at f l).
Lemma corable_func_at': forall f l, corable (func_at' f l).
Lemma corable_func_ptr : forall f v, corable (func_ptr f v).
Lemma corable_funspecs_assert: forall FS rho, corable (funspecs_assert FS rho).
Lemma corable_jam: forall {B} {S': B -> Prop} (S: forall l, {S' l}+{~ S' l}) (P Q: B -> pred rmap), (forall loc, corable (P loc)) -> (forall loc, corable (Q loc)) -> forall b, corable (jam S P Q b).
Lemma corable_funassert: forall G rho, corable (funassert G rho).
Lemma corable_allp_fun_id: forall Delta rho, corable (allp_fun_id Delta rho).
Lemma tc_bool_e_sub: forall b b' err rho phi, (b = true -> b' = true) -> denote_tc_assert (tc_bool b err) rho phi -> denote_tc_assert (tc_bool b' err) rho phi.
Lemma tc_bool_e_i: forall b c rho phi, b = true -> app_pred (denote_tc_assert (tc_bool b c) rho) phi.
Lemma typeof_temp_sub: forall i t, typeof_temp Delta i = Some t -> typeof_temp Delta' i = Some t.
Lemma range_dec: forall a b c: Z, {a <= b < c}+{~(a <= b < c)}.
Lemma eval_expr_any: forall {CS: compspecs} rho e v, eval_expr e any_environ = v -> v <> Vundef -> eval_expr e rho = v with eval_lvalue_any: forall {CS: compspecs} rho e v, eval_lvalue e any_environ = v -> v <> Vundef -> eval_lvalue e rho = v.
Lemma denote_tc_assert_ilt': forall {CS: compspecs} e j, denote_tc_assert (tc_ilt e j) = denote_tc_assert (tc_ilt' e j).
Lemma denote_tc_assert_llt': forall {CS: compspecs} e j, denote_tc_assert (tc_llt e j) = denote_tc_assert (tc_llt' e j).
Lemma tc_val_void: forall v, tc_val Tvoid v <-> False.
Lemma typecheck_Otest_order_sound: forall op {CS: compspecs} (rho : environ) m (e1 e2 : expr) (t : type) (IBR: denote_tc_assert (isBinOpResultType op e1 e2 t) rho m) (TV2: tc_val (typeof e2) (eval_expr e2 rho)) (TV1: tc_val (typeof e1) (eval_expr e1 rho)) (OP: op = Ole \/ op = Olt \/ op = Oge \/ op = Ogt), tc_val t (eval_binop op (typeof e1) (typeof e2) (eval_expr e1 rho) (eval_expr e2 rho)).
Lemma tc_test_eq1: forall b i v m, (denote_tc_test_eq (Vptr b i) v) (m_phi m) -> Mem.weak_valid_pointer (m_dry m) b (Ptrofs.unsigned i) = true.
Lemma mem_lessdef_sem_cast: forall m1 m2, mem_lessdef m1 m2 -> forall v1 v1', Val.lessdef v1 v1' -> forall t1 t2 v, classify_cast t1 t2 <> Cop.cast_case_void -> sem_cast v1 t1 t2 m1 = Some v -> sem_cast v1' t1 t2 m2 = Some v.
Lemma mem_lessdef_sem_binarith: forall m1 m2, mem_lessdef m1 m2 -> forall v1 v1', Val.lessdef v1 v1' -> forall v2 v2', Val.lessdef v2 v2' -> forall (sem_int: signedness -> int -> int -> option val) (sem_long: signedness -> int64 -> int64 -> option val) (sem_float: float -> float -> option val) (sem_single: float32 -> float32 -> option val) (t1: type) (t2: type) v, sem_binarith sem_int sem_long sem_float sem_single v1 t1 v2 t2 m1 = Some v -> sem_binarith sem_int sem_long sem_float sem_single v1' t1 v2' t2 m2 = Some v.
Lemma mem_lessdef_sem_shift: forall m1 m2, mem_lessdef m1 m2 -> forall v1 v1', Val.lessdef v1 v1' -> forall v2 v2', Val.lessdef v2 v2' -> forall (sem_int: signedness -> int -> int -> int) (sem_long: signedness -> int64 -> int64 -> int64) (t1: type) (t2: type) v, sem_shift sem_int sem_long v1 t1 v2 t2 = Some v -> sem_shift sem_int sem_long v1' t1 v2' t2 = Some v.
Lemma mem_lessdef_cmp_ptr: forall m1 m2, mem_lessdef m1 m2 -> forall v1 v1', Val.lessdef v1 v1' -> forall v2 v2', Val.lessdef v2 v2' -> forall op v, cmp_ptr m1 op v1 v2 = Some v -> cmp_ptr m2 op v1' v2' = Some v.
Lemma mem_lessdef_sem_cmp: forall m1 m2, mem_lessdef m1 m2 -> forall v1 v1', Val.lessdef v1 v1' -> forall v2 v2', Val.lessdef v2 v2' -> forall op (t1: type) (t2: type) v, sem_cmp op v1 t1 v2 t2 m1 = Some v -> sem_cmp op v1' t1 v2' t2 m2 = Some v.
Lemma classify_cast_void_e: forall t ty, classify_cast t ty = cast_case_void -> ty=Tvoid.
Lemma mem_lessdef_eval_expr: forall ge ve te m1 m2 a v1, mem_lessdef m1 m2 -> eval_expr ge ve te m1 a v1 -> exists v2, eval_expr ge ve te m2 a v2 /\ Val.lessdef v1 v2 with mem_lessdef_eval_lvalue: forall ge ve te m1 m2 a b z, mem_lessdef m1 m2 -> eval_lvalue ge ve te m1 a b z -> eval_lvalue ge ve te m2 a b z.
Lemma unaryop_mem_lessaloc {op u t m v m2} (V: sem_unary_operation op u t m = Some v) (M:mem_lessalloc m m2): sem_unary_operation op u t m2 = Some v.
Lemma sem_cast_mem_lessaloc {v t d m m2} (M:mem_lessalloc m m2): sem_cast v t d m = sem_cast v t d m2.
Lemma sem_cmp_mem_lessalloc {f v1 t1 v2 t2 m m2} (M : mem_lessalloc m m2): sem_cmp f v1 t1 v2 t2 m2 = sem_cmp f v1 t1 v2 t2 m.
Lemma binaryop_mem_lessaloc {ge op v1 t1 v2 t2 m v m2} (V: sem_binary_operation ge op v1 t1 v2 t2 m = Some v) (M:mem_lessalloc m m2): sem_binary_operation ge op v1 t1 v2 t2 m2 = Some v.
Lemma eval_expr_eval_lvalue_mem_lessalloc ge ve te m: (forall (e : expr) (v : val), eval_expr ge ve te m e v -> forall m2 : mem, mem_lessalloc m m2 -> eval_expr ge ve te m2 e v) /\ (forall (e : expr) (b : block) (i : ptrofs), eval_lvalue ge ve te m e b i -> forall m2 : mem, mem_lessalloc m m2 -> eval_lvalue ge ve te m2 e b i).
Lemma eval_expr_mem_lessalloc {ge ve te m m2 e v} (M:mem_lessalloc m m2): eval_expr ge ve te m e v -> eval_expr ge ve te m2 e v.
Lemma eval_exprlist_mem_lessalloc {ge ve te}: forall al tyargs vargs m m2 (M:mem_lessalloc m m2) (E:eval_exprlist ge ve te m al tyargs vargs), eval_exprlist ge ve te m2 al tyargs vargs.
Lemma eval_lvalue_mem_lessalloc {ge ve te m m2 e b i} (M:mem_lessalloc m m2): eval_lvalue ge ve te m e b i -> eval_lvalue ge ve te m2 e b i.
Lemma max_two_power_nat: forall n1 n2, Z.max (two_power_nat n1) (two_power_nat n2) = two_power_nat (Nat.max n1 n2).
Lemma Z_max_two_p: forall m1 m2, (exists n, m1 = two_power_nat n) -> (exists n, m2 = two_power_nat n) -> (exists n, Z.max m1 m2 = two_power_nat n).
Lemma power_nat_divide: forall n m, two_power_nat n <= two_power_nat m -> Z.divide (two_power_nat n) (two_power_nat m).
Lemma two_p_max_1: forall m1 m2, (exists n, m1 = two_power_nat n) -> (exists n, m2 = two_power_nat n) -> (Z.max m1 m2 = 1 <-> m1 = 1 /\ m2 = 1).
Lemma two_power_nat_0: forall x, (exists n, x = two_power_nat n) -> x <> 0.
Lemma Z_of_nat_ge_O: forall n, Z.of_nat n >= 0.
Lemma nth_error_nth: forall A (al: list A) (z: A) i, (i < length al)%nat -> nth_error al i = Some (nth i al z).
Lemma nat_of_Z_eq: forall i, nat_of_Z (Z_of_nat i) = i.
Lemma nth_error_length: forall {A} i (l: list A), nth_error l i = None <-> (i >= length l)%nat.
Lemma prop_unext: forall P Q: Prop, P=Q -> (P<->Q).
Lemma list_norepet_In_In: forall {K X} a x y (l:list (K*X)), list_norepet (map (@fst K X) l) -> In (a, x) l -> In (a, y) l -> x = y.
Lemma join_Bot : forall a b, sepalg.join a b Share.bot -> a = Share.bot /\ b = Share.bot.
Lemma typecheck_Otest_eq_sound: forall op {CS: compspecs} (rho : environ) m (e1 e2 : expr) (t : type) (IBR: denote_tc_assert (isBinOpResultType op e1 e2 t) rho m) (TV2: tc_val (typeof e2) (eval_expr e2 rho)) (TV1: tc_val (typeof e1) (eval_expr e1 rho)) (OP: op = Oeq \/ op = One), tc_val t (eval_binop op (typeof e1) (typeof e2) (eval_expr e1 rho) (eval_expr e2 rho)).
Lemma share_lemma87: forall a b, Share.glb a b = Share.bot -> Share.glb (Share.comp a) b = b.
Lemma join_top_comp: forall a b, join a b Share.top -> Share.comp a = b.
Lemma comp_bot: Share.comp Share.bot = Share.top.
Lemma share_distrib1': forall w x y z : Share.t, Share.glb (Share.lub w x) (Share.lub y z) = Share.lub (Share.lub (Share.glb w y) (Share.glb x y)) (Share.lub (Share.glb w z) (Share.glb x z)).
Lemma share_distrib2': forall w x y z : Share.t, Share.lub (Share.glb w x) (Share.glb y z) = Share.glb (Share.glb (Share.lub w y) (Share.lub x y)) (Share.glb (Share.lub w z) (Share.lub x z)).
Lemma lub_bot_e: forall x y, Share.lub x y = Share.bot -> x = Share.bot /\ y = Share.bot.
Lemma glb_less_both: forall a L b R, Share.Ord a L -> Share.Ord b R -> Share.Ord (Share.glb a b) (Share.glb L R).
Lemma comp_Lsh_Rsh: Share.comp Share.Lsh = Share.Rsh.
Lemma share_lemma88: forall sh, Share.glb sh Share.Rsh = Share.bot -> join_sub sh Share.Lsh.
Lemma align_compatible_rec_Tarray_inv: forall t n a z, align_compatible_rec (Tarray t n a) z -> (forall i : Z, 0 <= i < n -> align_compatible_rec t (z + sizeof cenv t * i)).
Lemma align_chunk_1248: forall ch, align_chunk ch = 1 \/ align_chunk ch = 2 \/ align_chunk ch = 4 \/ align_chunk ch = 8.
Lemma align_chunk_two_p: forall ch, exists n, align_chunk ch = two_power_nat n.
Lemma neutral_cast_lemma: forall t1 t2 v, is_neutral_cast t1 t2 = true -> tc_val t1 v -> eval_cast t1 t2 v = v.
Lemma neutral_cast_subsumption: forall t1 t2 v, is_neutral_cast t1 t2 = true -> tc_val t1 v -> tc_val t2 v.
Lemma neutral_cast_subsumption': forall t1 t2 v, is_neutral_cast (implicit_deref t1) t2 = true -> tc_val t1 v -> tc_val t2 v.
Lemma typecheck_both_sound: forall {CS: compspecs} Delta rho m e , typecheck_environ Delta rho -> (denote_tc_assert (typecheck_expr Delta e) rho m -> tc_val (typeof e) (eval_expr e rho)) /\ (forall pt, denote_tc_assert (typecheck_lvalue Delta e) rho m -> is_pointer_type pt = true -> tc_val pt (eval_lvalue e rho)).
Lemma typecheck_expr_sound : forall {CS: compspecs} Delta rho m e, typecheck_environ Delta rho -> denote_tc_assert (typecheck_expr Delta e) rho m -> tc_val (typeof e) (eval_expr e rho).
Lemma typecheck_lvalue_sound : forall {CS: compspecs} Delta rho m e, typecheck_environ Delta rho -> denote_tc_assert (typecheck_lvalue Delta e) rho m -> is_pointer_or_null (eval_lvalue e rho).
Lemma closed_wrt_modvars_switch: forall a sl n F, closed_wrt_modvars (Sswitch a sl) F -> closed_wrt_modvars (seq_of_labeled_statement (select_switch n sl)) F.
Lemma unfash_allp: forall {A} {agA: ageable A} {B} (f: B -> pred nat), @unfash _ agA (allp f) = allp (fun x:B => unfash (f x)).
Lemma fash_TT: forall {A} {agA: ageable A}, @unfash A agA TT = TT.
Lemma allp_andp: forall {A} {NA: ageable A} {B: Type} (b0: B) (P: B -> pred A) (Q: pred A), (allp P && Q = allp (fun x => P x && Q))%pred.
Lemma unfash_andp: forall {A} {agA: ageable A} (P Q: pred nat), (@unfash A agA (andp P Q) = andp (@unfash A agA P) (@unfash A agA Q)).
Lemma int_of_bytes_uniq: forall i j, length i = length j -> int_of_bytes i = int_of_bytes j -> i = j.
Lemma decode_int_uniq: forall i j, length i = length j -> decode_int i = decode_int j -> i=j.
Lemma decode_int_range: forall l N, N = two_p (8 * Z.of_nat (length l)) -> 0 <= decode_int l < N.
Lemma sign_ext_injective: forall n i j, 0 < n < Int.zwordsize -> 0 <= i < two_p n -> 0 <= j < two_p n -> Int.sign_ext n (Int.repr i) = Int.sign_ext n (Int.repr j) -> i=j.
Lemma zero_ext_injective: forall n i j, 0 <= n < Int.zwordsize -> 0 <= i < two_p n -> 0 <= j < two_p n -> Int.zero_ext n (Int.repr i) = Int.zero_ext n (Int.repr j) -> i=j.
Lemma repr_decode_int_inj: forall l1 l2, length l1 = 4%nat -> length l2 = 4%nat -> Int.repr (decode_int l1) = Int.repr (decode_int l2) -> l1=l2.
Lemma repr_decode_int64_inj: forall l1 l2, length l1 = 8%nat -> length l2 = 8%nat -> Int64.repr (decode_int l1) = Int64.repr (decode_int l2) -> l1=l2.
Lemma double_of_bits_inj: forall i j, Float.of_bits i = Float.of_bits j -> i=j.
Lemma binary_normalize_inj: forall s1 m1 e1 (h1 : bounded 24 128 m1 e1 = true), forall s2 m2 e2 (h2 : bounded 24 128 m2 e2 = true), binary_normalize 53 1024 (eq_refl _) (eq_refl _) mode_NE (cond_Zopp s1 (Zpos m1)) e1 s1 = binary_normalize 53 1024 (eq_refl _) (eq_refl _) mode_NE (cond_Zopp s2 (Zpos m2)) e2 s2 -> B754_finite 24 128 s1 m1 e1 h1 = B754_finite 24 128 s2 m2 e2 h2.
Lemma binary_normalize_finite: forall b m e, bounded (23 + 1) (2 ^ (8 - 1)) m e = true -> match binary_normalize 53 1024 eq_refl eq_refl mode_NE (cond_Zopp b (Z.pos m)) e b with B754_finite _ _ _ _ => True | _ => False end.
Lemma float32_preserves_payload: forall s pl, let '(s1,pl1) := Float.of_single_pl s pl in (s=s1 /\ (536870912 * (Pos.lor (proj1_sig pl) 4194304))%positive = proj1_sig pl1).
Lemma pos_lor_inj: (* not true *) forall k N (a b: nan_pl k), Zpower_nat 2 (Z.to_nat (k-2)) = Zpos N -> Pos.lor (proj1_sig a) N = Pos.lor (proj1_sig b) N -> a=b.
Lemma range_overlap_spec: forall l1 n1 l2 n2, n1 > 0 -> n2 > 0 -> (range_overlap l1 n1 l2 n2 <-> adr_range l1 n1 l2 \/ adr_range l2 n2 l1).
Lemma range_overlap_comm: forall l1 n1 l2 n2, range_overlap l1 n1 l2 n2 -> range_overlap l2 n2 l1 n1.
Lemma range_overlap_non_zero: forall l1 n1 l2 n2, range_overlap l1 n1 l2 n2 -> n1 > 0 /\ n2 > 0.
Lemma denote_tc_test_eq_Vint_l: forall m i v, (denote_tc_test_eq (Vint i) v) m -> i = Int.zero.
Lemma denote_tc_test_eq_Vint_r: forall m i v, (denote_tc_test_eq v (Vint i)) m -> i = Int.zero.
Lemma sameblock_eq_block: forall p q r s, is_true (sameblock (Vptr p r) (Vptr q s)) -> p=q.
Lemma denote_tc_test_eq_Vint_l': forall m i v, (denote_tc_test_eq (Vint i) v) m -> Int.eq i Int.zero = true.
Lemma denote_tc_test_eq_Vint_r': forall m i v, (denote_tc_test_eq v (Vint i)) m -> Int.eq i Int.zero = true.
Lemma denote_tc_test_eq_Vlong_l': forall m i v, (denote_tc_test_eq (Vlong i) v) m -> Int64.eq i Int64.zero = true.
Lemma denote_tc_test_eq_Vlong_r': forall m i v, (denote_tc_test_eq v (Vlong i)) m -> Int64.eq i Int64.zero = true.
Lemma denote_tc_test_order_eqblock: forall phi b0 i0 b i, app_pred (denote_tc_test_order (Vptr b0 i0) (Vptr b i)) phi -> b0 = b.
Lemma valid_pointer_dry: forall b ofs d m, app_pred (valid_pointer' (Vptr b ofs) d) (m_phi m) -> Mem.valid_pointer (m_dry m) b (Ptrofs.unsigned ofs + d) = true.
Lemma weak_valid_pointer_dry: forall b ofs m, app_pred (weak_valid_pointer (Vptr b ofs)) (m_phi m) -> (Mem.valid_pointer (m_dry m) b (Ptrofs.unsigned ofs) || Mem.valid_pointer (m_dry m) b (Ptrofs.unsigned ofs - 1))%bool = true.
Lemma test_eq_relate': forall v1 v2 op m (OP: op = Ceq \/ op = Cne), (denote_tc_test_eq v1 v2) (m_phi m) -> cmp_ptr (m_dry m) op v1 v2 = Some (force_val (sem_cmp_pp op v1 v2)).
Lemma sem_cast_relate: forall i sz si a si' a' m, Cop.sem_cast (Vint i) (Tint sz si a) (Tint I32 si' a') m = sem_cast (Tint sz si a) (Tint I32 si' a') (Vint i).
Lemma sem_cast_int_lemma: forall sz si a si' a' i, sem_cast (Tint sz si a) (Tint I32 si' a') (Vint i) = Some (Vint i).
Lemma sem_cast_relate_int_long: forall i sz si a si' a' m, Cop.sem_cast (Vint i) (Tint sz si a) (Tlong si' a') m = sem_cast (Tint sz si a) (Tlong si' a') (Vint i).
Lemma sem_cast_relate_long: forall i si a si' a' m, Cop.sem_cast (Vlong i) (Tlong si a) (Tlong si' a') m = sem_cast (Tlong si a) (Tlong si' a') (Vlong i).
Lemma sem_cast_int_long_lemma: forall sz si a si' a' i, sem_cast (Tint sz si a) (Tlong si' a') (Vint i) = Some (Vlong (cast_int_long si i)).
Lemma sem_cast_long_lemma: forall si a si' a' i, sem_cast (Tlong si a) (Tlong si' a') (Vlong i) = Some (Vlong i).
Lemma denote_tc_test_eq_xx: forall v si i phi, app_pred (denote_tc_test_eq v (Vint i)) phi -> app_pred (denote_tc_test_eq v (Vptrofs (ptrofs_of_int si i))) phi.
Lemma denote_tc_test_eq_yy: forall v si i phi, app_pred (denote_tc_test_eq (Vint i) v) phi -> app_pred (denote_tc_test_eq (Vptrofs (ptrofs_of_int si i)) v) phi.
Lemma sem_cast_long_intptr_lemma: forall si a i, force_val1 (sem_cast (Tlong si a) size_t) (Vlong i) = Vptrofs (Ptrofs.of_int64 i).
Lemma test_order_relate': forall v1 v2 op m, (denote_tc_test_order v1 v2) (m_phi m) -> cmp_ptr (m_dry m) op v1 v2 = Some (force_val (sem_cmp_pp op v1 v2)).
Lemma sem_cast_int_intptr_lemma: forall sz si a i, force_val1 (sem_cast (Tint sz si a) size_t) (Vint i) = Vptrofs (ptrofs_of_int si i).
Lemma test_eq_fiddle_signed_xx: forall si si' v i phi, app_pred (denote_tc_test_eq v (Vptrofs (ptrofs_of_int si i))) phi -> app_pred (denote_tc_test_eq v (Vptrofs (ptrofs_of_int si' i))) phi.
Lemma test_eq_fiddle_signed_yy: forall si si' v i phi, app_pred (denote_tc_test_eq (Vptrofs (ptrofs_of_int si i)) v) phi -> app_pred (denote_tc_test_eq (Vptrofs (ptrofs_of_int si' i)) v) phi.
Lemma test_order_fiddle_signed_xx: forall si si' v i phi, app_pred (denote_tc_test_order v (Vptrofs (ptrofs_of_int si i))) phi -> app_pred (denote_tc_test_order v (Vptrofs (ptrofs_of_int si' i))) phi.
Lemma test_order_fiddle_signed_yy: forall si si' v i phi, app_pred (denote_tc_test_order (Vptrofs (ptrofs_of_int si i)) v) phi -> app_pred (denote_tc_test_order (Vptrofs (ptrofs_of_int si' i)) v) phi.
Lemma denote_tc_nonzero_e': forall i m, app_pred (denote_tc_nonzero (Vint i)) m -> Int.eq i Int.zero = false.
Lemma denote_tc_nodivover_e': forall i j m, app_pred (denote_tc_nodivover (Vint i) (Vint j)) m -> Int.eq i (Int.repr Int.min_signed) && Int.eq j Int.mone = false.
Lemma denote_tc_nonzero_e64': forall i m, app_pred (denote_tc_nonzero (Vlong i)) m -> Int64.eq i Int64.zero = false.
Lemma denote_tc_nodivover_e64_ll': forall i j m, app_pred (denote_tc_nodivover (Vlong i) (Vlong j)) m -> Int64.eq i (Int64.repr Int64.min_signed) && Int64.eq j Int64.mone = false.
Lemma denote_tc_nodivover_e64_il': forall s i j m, app_pred (denote_tc_nodivover (Vint i) (Vlong j)) m -> Int64.eq (cast_int_long s i) (Int64.repr Int64.min_signed) && Int64.eq j Int64.mone = false.
Lemma denote_tc_nodivover_e64_li': forall s i j m, app_pred (denote_tc_nodivover (Vlong i) (Vint j)) m -> Int64.eq i (Int64.repr Int64.min_signed) && Int64.eq (cast_int_long s j) Int64.mone = false.
Lemma Int64_eq_repr_signed32_nonzero': forall i, Int.eq i Int.zero = false -> Int64.eq (Int64.repr (Int.signed i)) Int64.zero = false.
Lemma Int64_eq_repr_unsigned32_nonzero': forall i, Int.eq i Int.zero = false -> Int64.eq (Int64.repr (Int.unsigned i)) Int64.zero = false.
Lemma Int64_eq_repr_int_nonzero': forall s i, Int.eq i Int.zero = false -> Int64.eq (cast_int_long s i) Int64.zero = false.
Lemma denote_tc_igt_e': forall m i j, app_pred (denote_tc_igt j (Vint i)) m -> Int.ltu i j = true.
Lemma denote_tc_lgt_e': forall m i j, app_pred (denote_tc_lgt j (Vlong i)) m -> Int64.ltu i j = true.
Lemma denote_tc_iszero_long_e': forall m i, app_pred (denote_tc_iszero (Vlong i)) m -> Int64.eq (Int64.repr (Int64.unsigned i)) Int64.zero = true.
Lemma eval_binop_relate': forall {CS: compspecs} (ge: genv) te ve rho b e1 e2 t m (Hcenv: genv_cenv ge = @cenv_cs CS) (H1: Clight.eval_expr ge ve te (m_dry m) e1 (eval_expr e1 rho)) (H2: Clight.eval_expr ge ve te (m_dry m) e2 (eval_expr e2 rho)) (H3: app_pred (denote_tc_assert (isBinOpResultType b e1 e2 t) rho) (m_phi m)) (TC1 : tc_val (typeof e1) (eval_expr e1 rho)) (TC2 : tc_val (typeof e2) (eval_expr e2 rho)), Clight.eval_expr ge ve te (m_dry m) (Ebinop b e1 e2 t) (force_val2 (sem_binary_operation' b (typeof e1) (typeof e2)) (eval_expr e1 rho) (eval_expr e2 rho)).
Lemma mapsto_unsigned_signed: forall sign1 sign2 sh sz v i, mapsto sh (Tint sz sign1 noattr) v (Vint (Cop.cast_int_int sz sign1 i)) = mapsto sh (Tint sz sign2 noattr) v (Vint (Cop.cast_int_int sz sign2 i)).
Lemma mapsto_tuint_tint: forall sh, mapsto sh tuint = mapsto sh tint.
Lemma tc_val_pointer_nullval: forall t, tc_val (tptr t) nullval.
Lemma mapsto_null_mapsto_pointer: forall t sh v, Archi.ptr64 = false -> mapsto sh tint v nullval = mapsto sh (tptr t) v nullval.
Lemma alloc_variables_mem_step: forall cenv vars m e e2 m' (M: alloc_variables cenv e m vars e2 m'), mem_step m m'.
Lemma bind_parameters_mem_step: forall cenv e m pars vargs m' (M: bind_parameters cenv e m pars vargs m'), mem_step m m'.
Lemma jsafeN_age Z Jspec ge ora q n jm jmaged : ext_spec_stable age (JE_spec _ Jspec) -> age jm jmaged -> le n (level jmaged) -> @jsafeN Z Jspec ge n ora q jm -> @jsafeN Z Jspec ge n ora q jmaged.
Lemma jsafeN_age_to Z Jspec ge ora q n l jm : ext_spec_stable age (JE_spec _ Jspec) -> le n l -> @jsafeN Z Jspec ge n ora q jm -> @jsafeN Z Jspec ge n ora q (age_to l jm).
Lemma type_eq_true : forall a b, proj_sumbool (type_eq a b) =true -> a = b.
Lemma opt2list_inj: forall A (a b: option A), opt2list a = opt2list b -> a=b.
Lemma age_twin' {A B} `{HA: ageable A} `{HB: ageable B}: forall (x: A) (y: B) (x': A), level x = level y -> age x x' -> exists y', level x' = level y' /\ age y y'.
Lemma later_twin' {A B} `{HA: ageable A} `{HB: ageable B}: forall (x: A) (y: B) (x': A), level x = level y -> laterR x x' -> exists y', level x' = level y' /\ laterR y y'.
Lemma later_twin {A} `{ageable A}: forall phi1 phi2 phi1', level phi1 = level phi2 -> laterR phi1 phi1' -> exists phi2', level phi1' = level phi2' /\ laterR phi2 phi2'.
Lemma someP_inj: forall A P Q, SomeP A P = SomeP A Q -> P=Q.
Lemma denote_tc_nonzero_e: forall i m, app_pred (denote_tc_nonzero (Vint i)) m -> i <> Int.zero.
Lemma denote_tc_nodivover_e: forall i j m, app_pred (denote_tc_nodivover (Vint i) (Vint j)) m -> ~ (i =Int.repr Int.min_signed /\ j = Int.mone).
Lemma denote_tc_nonzero_e64: forall i m, app_pred (denote_tc_nonzero (Vlong i)) m -> i <> Int64.zero.
Lemma denote_tc_nodivover_e64_ll: forall i j m, app_pred (denote_tc_nodivover (Vlong i) (Vlong j)) m -> ~ (i =Int64.repr Int64.min_signed /\ j = Int64.mone).
Lemma denote_tc_nodivover_e64_il: (* This is a rather vacuous lemma, since the premise is simply True *) forall s i j m, app_pred (denote_tc_nodivover (Vint i) (Vlong j)) m -> ~ (cast_int_long s i = Int64.repr Int64.min_signed /\ j = Int64.mone).
Lemma denote_tc_nodivover_e64_li: forall s i j m, app_pred (denote_tc_nodivover (Vlong i) (Vint j)) m -> ~ (i = Int64.repr Int64.min_signed /\ cast_int_long s j = Int64.mone).
Lemma Int64_eq_repr_signed32_nonzero: forall i, i <> Int.zero -> Int64.repr (Int.signed i) <> Int64.zero.
Lemma Int64_eq_repr_unsigned32_nonzero: forall i, i <> Int.zero -> Int64.repr (Int.unsigned i) <> Int64.zero.
Lemma Int64_eq_repr_int_nonzero: forall s i, i <> Int.zero -> cast_int_long s i <> Int64.zero.
Lemma denote_tc_igt_e: forall m i j, app_pred (denote_tc_igt j (Vint i)) m -> Int.unsigned i < Int.unsigned j.
Lemma denote_tc_lgt_e: forall m i j, app_pred (denote_tc_lgt j (Vlong i)) m -> Int64.unsigned i < Int64.unsigned j.
Lemma denote_tc_iszero_long_e: forall m i, app_pred (denote_tc_iszero (Vlong i)) m -> i = Int64.zero.
Lemma int_type_tc_val_Vtrue: forall t, is_int_type t = true -> tc_val t Vtrue.
Lemma int_type_tc_val_Vfalse: forall t, is_int_type t = true -> tc_val t Vfalse.
Lemma int_type_tc_val_of_bool: forall t b, is_int_type t = true -> tc_val t (Val.of_bool b).
Lemma Ptrofs_to_of64_lemma: Archi.ptr64 = false -> forall i, Ptrofs.to_int (Ptrofs.of_int64 i) = Int.repr (Int64.unsigned i).
Lemma Int64repr_Intsigned_zero: forall i, Int64.repr (Int.signed i) = Int64.zero -> i=Int.zero.
Lemma Int64repr_Intunsigned_zero: forall i, Int64.repr (Int.unsigned i) = Int64.zero -> i=Int.zero.
Lemma eq_block_true: forall b1 b2 i1 i2 A (a b: A), is_true (sameblock (Vptr b1 i1) (Vptr b2 i2)) -> (if eq_block b1 b2 then a else b) = a.
Lemma sizeof_range_true {CS: composite_env}: forall t A (a b: A) (max: Z), negb (Z.eqb (sizeof t) 0) = true -> Z.leb (sizeof t) max = true -> (if zlt 0 (sizeof t) && zle (sizeof t) max then a else b) = a.
Lemma adr_range_divide: forall b i p q loc, p >= 0 -> q >= 0 -> (adr_range (b,i) (p+q) loc <-> (adr_range (b,i) p loc \/adr_range (b,i+p) q loc)).
Lemma store_init_data_outside': forall F V (ge: Genv.t F V) b a m p m', Genv.store_init_data ge m b p a = Some m' -> (forall b' ofs, (b=b' /\ p <= ofs < p + init_data_size a) \/ contents_at m (b', ofs) = contents_at m' (b', ofs)) /\ access_at m = access_at m' /\ nextblock m = nextblock m'.
Lemma store_init_data_list_outside': forall F V (ge: Genv.t F V) b il m p m', Genv.store_init_data_list ge m b p il = Some m' -> (forall b' ofs, (b=b' /\ p <= ofs < p + init_data_list_size il) \/ contents_at m (b', ofs) = contents_at m' (b', ofs)) /\ access_at m = access_at m' /\ nextblock m = nextblock m'.
Lemma alloc_variables_mem_step: forall cenv vars m e e2 m' (M: alloc_variables cenv e m vars e2 m'), mem_step m m'.
Lemma assign_loc_mem_step g t m b z v m' (A:assign_loc g t m b z v m'): mem_step m m'.
Lemma bind_parameters_mem_step: forall cenv e m pars vargs m' (M: bind_parameters cenv e m pars vargs m'), semantics.mem_step m m'.
Lemma inline_assembly_memstep: forall text sg g vargs m t vres m' (IA:Events.inline_assembly_sem text sg g vargs m t vres m'), mem_step m m'.
Lemma extcall_sem_mem_step: forall name sg g vargs m t vres m' (E:Events.external_functions_sem name sg g vargs m t vres m'), mem_step m m'.
Lemma extcall_mem_step g: forall ef vargs m t vres m' (E:Events.external_call ef g vargs m t vres m'), mem_step m m'.
Lemma CLC_corestep_mem: forall (g : genv) c (m : mem) c' (m' : mem), semantics.corestep (cl_core_sem g) c m c' m' -> semantics.mem_step m m'.
Lemma pred_hered {A} {_ : ageable A} (P : pred A) : hereditary age (app_pred P).
Lemma hereditary_necR {phi phi' : rmap} {P} : necR phi phi' -> hereditary age P -> P phi -> P phi'.
Lemma anti_hereditary_necR {phi phi' : rmap} {P} : necR phi phi' -> hereditary (fun x y => age y x) P -> P phi' -> P phi.
Lemma app_pred_age {R} {phi phi' : rmap} : age phi phi' -> app_pred R phi -> app_pred R phi'.
Lemma age_to_ghost_of phi n : ghost_of (age_to n phi) = ghost_fmap (approx n) (approx n) (ghost_of phi).
Lemma tc_bool_val: forall v t, tc_val t v -> bool_type t = true -> exists b, strict_bool_val v t = Some b.
Lemma bool_val_strict: forall t v b, tc_val t v -> bool_type t = true -> bool_val t v = Some b -> strict_bool_val v t = Some b.
Lemma bool_val_Cop: forall t v m b b', bool_val t v = Some b -> Cop.bool_val v t m = Some b' -> b = b'.
Lemma map_ptree_rel : forall id v te, Map.set id v (make_tenv te) = make_tenv (PTree.set id v te).
Lemma cast_exists : forall {CS: compspecs} Delta e2 t rho phi (TC: typecheck_environ Delta rho), denote_tc_assert (typecheck_expr Delta e2) rho phi -> denote_tc_assert (isCastResultType (typeof e2) t e2) rho phi -> sem_cast (typeof e2) t (eval_expr e2 rho) = Some (force_val (sem_cast (typeof e2) t (eval_expr e2 rho))).
Lemma func_tycontext_v_sound : func_tycontext_v_denote.
Lemma func_tycontext_t_sound : func_tycontext_t_denote.
Lemma eqb_type_eq: forall t1 t2, eqb_type t1 t2 = proj_sumbool (type_eq t1 t2).
Lemma In_fst_split : forall A B i (l: list (A * B)), In i (fst (split l)) <-> exists b : B, In (i,b) l.
Lemma tycontext_evolve_trans: forall Delta1 Delta2 Delta3, tycontext_evolve Delta1 Delta2 -> tycontext_evolve Delta2 Delta3 -> tycontext_evolve Delta1 Delta3.
Lemma tc_val_ptr_lemma {CS: compspecs} : forall rho m Delta id t a, typecheck_environ Delta rho -> denote_tc_assert (typecheck_expr Delta (Etempvar id (Tpointer t a))) rho m -> (*(temp_types Delta) ! id = Some (Tpointer t a, init) ->*) (*modified for init changes*) strict_bool_val (eval_id id rho) (Tpointer t a) = Some true -> tc_val (Tpointer t a) (eval_id id rho).
Lemma tycontext_evolve_refl : forall Delta, tycontext_evolve Delta Delta.
Lemma body_SHA256_Update: semax_body Vprog Gtot f_SHA256_Update SHA256_Update_spec.
Lemma body_hmac_simple: semax_body HmacVarSpecs HmacFunSpecs f_HMAC HMAC_spec.
Lemma int_unsigned_mod: forall i, Int.unsigned i mod Int.modulus = Int.unsigned i.
Lemma Z_div_mul: forall a b, b <> 0 -> (a/b*b = a - a mod b)%Z.
Lemma eqm_mod1: forall a b, Int.eqm a b <-> Int.eqm (a mod Int.modulus) b.
Lemma eqm_mod2: forall a b, Int.eqm a b <-> Int.eqm a (b mod Int.modulus).
Lemma addlength_assist: forall (a b : Z), Int.eqm (((a / Int.modulus) mod Int.modulus + (a mod Int.modulus + b mod Int.modulus - (a mod Int.modulus + b) mod Int.modulus) / Int.modulus) mod Int.modulus + (b / Int.modulus) mod Int.modulus) ((a + b) / Int.modulus).
Lemma body_SHA256_Final: semax_body Vprog Gtot f_SHA256_Final SHA256_Final_spec.
Lemma toBlocks_injective: forall l1 l2 (BLKS: toBlocks l1 = toBlocks l2) (F1: InBlocks 512 l1) (F2: InBlocks 512 l2), l1 = l2.
Lemma split_eq: forall m (v2 : Bvector m) n (v1 : Bvector n), splitVector n m (Vector.append v1 v2) = (v1, v2).
Lemma key_vector l: length (bytesToBits (HMAC_SHA256.mkKey l)) = b.
Lemma splitAndPad_v_to_sha_splitandpad_blocks l: map Vector.to_list (splitAndPad_v l) = sha_splitandpad_blocks l.
Lemma splitAndPad_v_eq_inverse: forall l m, splitAndPad_v l = splitAndPad_v m -> sha_splitandpad_blocks l = sha_splitandpad_blocks m.
Lemma splitAndPad_1to1 b1 b2 (B:splitAndPad_v b1 = splitAndPad_v b2) (L1: NPeano.Nat.divide 8 (length b1)) (L2: NPeano.Nat.divide 8 (length b2)): b1 = b2.
Lemma haslengthK_simple: forall l, 0 < l <= Int.max_signed -> l * 8 < two_p 64.
Lemma body_sha256_block_data_order: semax_body Vprog Gtot f_sha256_block_data_order sha256_block_data_order_spec.
Lemma Zland_15: forall i, Z.land i 15 = i mod 16.
Lemma Znth_nthi: forall i b, (0 <= i < Zlength b)%Z -> Znth i b = nthi b i.
Lemma Zland_in_range: forall i, (0 <= Z.land i 15 < 16)%Z.
Lemma and_mone': forall x, Int.and x (Int.repr (-1)) = x.
Lemma Sigma_1_eq: forall f_, Sigma_1 f_ = (Int.xor (Int.xor (Int.or (Int.shl f_ (Int.repr 26)) (Int.shru (Int.and f_ (Int.repr (-1))) (Int.sub (Int.repr 32) (Int.repr 26)))) (Int.or (Int.shl f_ (Int.repr 21)) (Int.shru (Int.and f_ (Int.repr (-1))) (Int.sub (Int.repr 32) (Int.repr 21))))) (Int.or (Int.shl f_ (Int.repr 7)) (Int.shru (Int.and f_ (Int.repr (-1))) (Int.sub (Int.repr 32) (Int.repr 7))))).
Lemma Sigma_0_eq: forall b_, Sigma_0 b_ = (Int.xor (Int.xor (Int.or (Int.shl b_ (Int.repr 30)) (Int.shru (Int.and b_ (Int.repr (-1))) (Int.sub (Int.repr 32) (Int.repr 30)))) (Int.or (Int.shl b_ (Int.repr 19)) (Int.shru (Int.and b_ (Int.repr (-1))) (Int.sub (Int.repr 32) (Int.repr 19))))) (Int.or (Int.shl b_ (Int.repr 10)) (Int.shru (Int.and b_ (Int.repr (-1))) (Int.sub (Int.repr 32) (Int.repr 10))))).
Lemma Ch_eq: forall f_ g_ h_, Ch f_ g_ h_ = (Int.xor (Int.and f_ g_) (Int.and (Int.not f_) h_)).
Lemma Maj_eq: forall b c d, Maj b c d = (Int.xor (Int.xor (Int.and b c) (Int.and b d)) (Int.and c d)).
Lemma sigma_1_eq: forall s, sigma_1 s = Int.xor (Int.xor (Int.or (Int.shl s (Int.repr 15)) (Int.shru s (Int.sub (Int.repr 32) (Int.repr 15)))) (Int.or (Int.shl s (Int.repr 13)) (Int.shru s (Int.sub (Int.repr 32) (Int.repr 13))))) (Int.shru s (Int.repr 10)).
Lemma sigma_0_eq: forall s, sigma_0 s = Int.xor (Int.xor (Int.or (Int.shl s (Int.repr 25)) (Int.shru s (Int.sub (Int.repr 32) (Int.repr 25)))) (Int.or (Int.shl s (Int.repr 14)) (Int.shru s (Int.sub (Int.repr 32) (Int.repr 14))))) (Int.shru s (Int.repr 3)).
Lemma and_mod_15_lem: forall (n: Z), (0 <= Int.signed (Int.and (Int.repr n) (Int.repr 15)) < 16)%Z.
Lemma rearrange_aux: forall h f c k l, Int.add (Int.add (Int.add (Int.add h f) c) k) l = Int.add (Int.add (Int.add (Int.add l h) f) c) k.
Lemma loop1_aux_lemma1: forall i b, (0 <= i < Zlength b) -> Zlength b <= 16 -> upd_Znth i (map Vint (sublist 0 i b) ++ list_repeat (Z.to_nat (16 - i)) Vundef) (Vint (Znth i b)) = map Vint (sublist 0 (i+1) b) ++ list_repeat (Z.to_nat (16 - (i+1))) Vundef.
Lemma sha_splitandpad_fpad : forall (l m : Blist), length l = b -> InBlocks 8 m -> sha_splitandpad (l ++ m) = l ++ HMAC_Concat.app_fpad fpad m.
Theorem HMAC_concat_pad_sap_instantiated h (HH: forall x y, length x = c -> length y = b -> length (h x y) = c) iv (IV: length iv = c) (op ip : Blist) (IL: length ip = b) (OL: length op = b) : forall (k m : Blist), length k = b -> sha.HMAC_spec_pad.HMAC c p B h iv sha_splitandpad op ip k m = HMAC_Concat.HMAC c p B h iv sha_splitandpad_inc fpad op ip k m.
Theorem HMAC_concat_pad_explicit : forall (k m : Blist) (op ip : Blist), length k = b -> length ip = b -> length op = b -> sha.HMAC_spec_pad.HMAC c p B sha_h sha_iv sha_splitandpad op ip k m = HMAC_Concat.HMAC c p B sha_h sha_iv sha_splitandpad_inc fpad op ip k m.
Lemma str_to_bytes_length: forall k, String.length k = length (str_to_bytes k).
Lemma first64_sixtyfour {A} (a:A): firstn 64 (HMAC_SHA256.sixtyfour a) = HMAC_SHA256.sixtyfour a.
Lemma length_SF {A} (x:A): length (HMAC_SHA256.sixtyfour x) = 64%nat.
Lemma Zlength_mkArgZ k pad: Zlength (HMAC_SHA256.mkArg k pad) = Z.of_nat (min (length k) 64).
Lemma nth_zeropad_left {d d'}: forall l i (I: 0<= i < Zlength l), nth (Z.to_nat i) (HMAC_SHA256.zeroPad l) d = nth (Z.to_nat i) l d'.
Lemma nth_zeropad_right {d} l i (I: Zlength l <= i < 64): nth (Z.to_nat i) (HMAC_SHA256.zeroPad l) d = Byte.zero.
Lemma zeroPad_BlockSize: forall k, (length k <= SHA256.BlockSize)%nat -> length (HMAC_SHA256.zeroPad k) = SHA256.BlockSize%nat.
Lemma length_SHA256': forall l, length (functional_prog.SHA_256' l) = SHA256.DigestLength.
Lemma mkKey_length l: length (HMAC_SHA256.mkKey l) = SHA256.BlockSize.
Lemma mkKey_atBlockSize s: length s = SHA256.BlockSize%nat -> HMAC_SHA256.mkKey s = s.
Lemma HMAC_length d k: length (HMAC256 d k) = 32%nat.
Lemma HMAC_Zlength d k: Zlength (HMAC256 d k) = 32.
Lemma body_SHA256: semax_body Vprog Gtot f_SHA256 SHA256_spec.
Lemma body_hmac_init: semax_body HmacVarSpecs HmacFunSpecs f_HMAC_Init HMAC_Init_spec.
Lemma isbyte_zeroExt8: forall x, 0 <= x <= Byte.max_unsigned -> Int.repr x = (Int.zero_ext 8 (Int.repr x)).
Lemma isbyte_zeroExt8' : forall x, Int.unsigned (Int.zero_ext 8 x) <= Byte.max_unsigned.
Lemma UPD_IPAD: forall (key : list byte) (ZLI : Zlength (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Ipad) = 64) (i : Z) (I : 0 <= i < 64) (X : Znth i (map Vubyte (HMAC_SHA256.mkKey key)) = Vubyte (nth (Z.to_nat i) (HMAC_SHA256.mkKey key) Byte.zero)), upd_Znth i (sublist 0 i (map Vubyte (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Ipad)) ++ sublist i 64 (default_val (Tarray tuchar 64 noattr))) (Vubyte (Byte.xor (nth (Z.to_nat i) (HMAC_SHA256.mkKey key) Byte.zero) (Byte.repr 54))) = sublist 0 (i + 1) (map Vubyte (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Ipad)) ++ sublist (i + 1) 64 (default_val (Tarray tuchar 64 noattr)).
Lemma UPD_OPAD: forall (key : list byte) (ZLI : Zlength (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Ipad) = 64) (ZLO : Zlength (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Opad) = 64) (i : Z) (I : 0 <= i < 64) (X : Znth i (map Vubyte (HMAC_SHA256.mkKey key)) = Vubyte (nth (Z.to_nat i) (HMAC_SHA256.mkKey key) Byte.zero)),upd_Znth i (sublist 0 i (map Vubyte (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Opad)) ++ sublist i 64 (map Vubyte (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Ipad))) (Vubyte (Byte.xor (Byte.repr 92) (nth (Z.to_nat i) (HMAC_SHA256.mkKey key) Byte.zero))) = sublist 0 (i + 1) (map Vubyte (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Opad)) ++ sublist (i + 1) 64 (map Vubyte (HMAC_SHA256.mkArg (HMAC_SHA256.mkKey key) Ipad)).
Lemma Zlength_intlist_to_bytelist: forall l : list int, Zlength (intlist_to_bytelist l) = (Zlength l * 4)%Z.
Lemma skipn_intlist_to_bytelist: forall i m, skipn (4*i) (intlist_to_bytelist m) = intlist_to_bytelist (skipn i m).
Lemma firstn_intlist_to_bytelist: forall i m, firstn (4*i) (intlist_to_bytelist m) = intlist_to_bytelist (firstn i m).
Lemma sublist_intlist_to_bytelist: forall i j m, sublist (i * WORD) (j * WORD) (intlist_to_bytelist m) = intlist_to_bytelist (sublist i j m).
Lemma bytelist_to_intlist_to_bytelist': forall nl: list byte, Nat.divide (Z.to_nat WORD) (length nl) -> intlist_to_bytelist (bytelist_to_intlist nl) = nl.
Lemma bytelist_to_intlist_to_bytelist: forall nl: list byte, Z.divide WORD (Zlength nl) -> intlist_to_bytelist (bytelist_to_intlist nl) = nl.
Lemma length_bytelist_to_intlist: forall n l, length l = (Z.to_nat WORD * n)%nat -> length (bytelist_to_intlist l) = n.
Lemma big_endian_integer4: forall c0 c1 c2 c3, big_endian_integer (c0::c1::c2::c3::nil) = Int.or (Int.shl (Int.repr (Byte.unsigned c0)) (Int.repr 24)) (Int.or (Int.shl (Int.repr (Byte.unsigned c1)) (Int.repr 16)) (Int.or (Int.shl (Int.repr (Byte.unsigned c2)) (Int.repr 8)) (Int.repr (Byte.unsigned c3)))).
Lemma length_Round: forall regs f n, length regs = 8%nat -> length (Round regs f n) = 8%nat.
Lemma length_hash_block: forall regs block, length regs = 8%nat -> length block = 16%nat -> length (hash_block regs block) = 8%nat.
Lemma withspacer_refl: forall sh a P, withspacer sh a a P = P.
Lemma body_hmac_final: semax_body HmacVarSpecs HmacFunSpecs f_HMAC_Final HMAC_Final_spec.
Lemma body_SHA256_Init: semax_body Vprog Gtot f_SHA256_Init SHA256_Init_spec.
Lemma Zlength_list_repeat: forall {A} n (x:A), Zlength (list_repeat (Z.to_nat n) x) = Z.max 0 n.
Lemma splice_into_list_simplify0: forall {A} n (src dst: list A), Zlength src = n -> Zlength dst = n -> splice_into_list 0 n src dst = src.
Lemma splice_into_list_self: forall {A} lo hi (l: list A), (0 <= lo <= hi)%Z -> (hi <= Zlength l)%Z -> splice_into_list lo hi (sublist lo hi l) l = l.
Lemma JMeq_skipn: forall ta tb n (la: list ta) (lb: list tb), ta=tb -> JMeq la lb -> JMeq (skipn n la) (skipn n lb).
Lemma JMeq_firstn: forall ta tb n (la: list ta) (lb: list tb), ta=tb -> JMeq la lb -> JMeq (firstn n la) (firstn n lb).
Lemma JMeq_length: forall ta tb (la: list ta) (lb: list tb), ta=tb -> JMeq la lb -> length la = length lb.
Lemma JMeq_sublist: forall ta tb lo hi (la: list ta) (lb: list tb), ta=tb -> JMeq la lb -> JMeq (sublist lo hi la) (sublist lo hi lb).
Lemma body_hkdf: semax_body Hkdf_VarSpecs Hkdf_FunSpecs f_HKDF HKDF_spec.
Lemma Hblocks_lem: forall {blocks: list int} {frag: list byte} {data}, intlist_to_bytelist blocks = frag ++ sublist 0 (Zlength blocks * 4 - Zlength frag) data -> Zlength frag <= Zlength blocks * 4.
Lemma big_endian_integer_bytelist: forall bl, Zlength bl = 4-> bytelist_to_intlist bl = big_endian_integer bl :: nil.
Lemma nth_big_endian_integer: forall i bl w, nth_error bl i = Some w -> w = big_endian_integer (sublist (Z.of_nat i * WORD) (Z.succ (Z.of_nat i) * WORD) (intlist_to_bytelist bl)).
Lemma Znth_big_endian_integer: forall i bl, 0 <= i < Zlength bl -> Znth i bl = big_endian_integer (sublist (i * WORD) (Z.succ i * WORD) (intlist_to_bytelist bl)).
Lemma body_hmac_update: semax_body HmacVarSpecs HmacFunSpecs f_HMAC_Update HMAC_Update_spec.
Lemma of_length_proof_irrel {A:Set} n (l: list A) M: Vector.to_list (@of_list_length _ n l M) = l.
Lemma splitandpad_equiv : forall (bits : Blist) (bytes : list byte), bytes_bits_lists bits bytes -> bytes_bits_lists (sha_splitandpad bits) (pad bytes).
Lemma gap_divide16 bits: NPeano.Nat.divide 16 (length (generate_and_pad' (bitsToBytes bits))).
Lemma change_compspecs_t_struct_SHA256state_st': @data_at_ spec_sha.CompSpecs Ews t_struct_SHA256state_st = @data_at_ CompSpecs Ews t_struct_SHA256state_st.
Lemma body_hmac_cleanup: semax_body HmacVarSpecs HmacFunSpecs f_HMAC_cleanup HMAC_Cleanup_spec.
Lemma body_hmac_cleanup1: semax_body HmacVarSpecs HmacFunSpecs f_HMAC_cleanup HMAC_Cleanup_spec1.
Lemma body_hkdf_extract: semax_body Hkdf_VarSpecs Hkdf_FunSpecs f_HKDF_extract HKDF_extract_spec.
Lemma loc_arguments_acceptable_2: forall s l, In l (regs_of_rpairs (loc_arguments s)) -> loc_argument_acceptable l.
Lemma functional_extensionality_dep: forall {A: Type} {B : A -> Type} (f g : forall x : A, B x), (forall x, f x = g x) -> f = g.
Lemma functional_extensionality: forall {A B: Type} (f g : A -> B), (forall x, f x = g x) -> f = g.
Lemma extensionality: forall {A B: Type} (f g : A -> B), (forall x, f x = g x) -> f = g.
Theorem Zopp_le_cancel : forall x y : Z, (-y <= -x)%Z -> Zle x y.
Theorem Zgt_not_eq : forall x y : Z, (y < x)%Z -> (x <> y)%Z.
Theorem round_val_of_pred : forall rnd : R -> R -> Prop, round_pred rnd -> forall x, { f : R | rnd x f }.
Theorem round_fun_of_pred : forall rnd : R -> R -> Prop, round_pred rnd -> { f : R -> R | forall x, rnd x (f x) }.
Theorem round_unicity : forall rnd : R -> R -> Prop, round_pred_monotone rnd -> forall x f1 f2, rnd x f1 -> rnd x f2 -> f1 = f2.
Theorem Rnd_DN_pt_monotone : forall F : R -> Prop, round_pred_monotone (Rnd_DN_pt F).
Theorem Rnd_DN_pt_unicity : forall F : R -> Prop, forall x f1 f2 : R, Rnd_DN_pt F x f1 -> Rnd_DN_pt F x f2 -> f1 = f2.
Theorem Rnd_DN_unicity : forall F : R -> Prop, forall rnd1 rnd2 : R -> R, Rnd_DN F rnd1 -> Rnd_DN F rnd2 -> forall x, rnd1 x = rnd2 x.
Theorem Rnd_UP_pt_monotone : forall F : R -> Prop, round_pred_monotone (Rnd_UP_pt F).
Theorem Rnd_UP_pt_unicity : forall F : R -> Prop, forall x f1 f2 : R, Rnd_UP_pt F x f1 -> Rnd_UP_pt F x f2 -> f1 = f2.
Theorem Rnd_UP_unicity : forall F : R -> Prop, forall rnd1 rnd2 : R -> R, Rnd_UP F rnd1 -> Rnd_UP F rnd2 -> forall x, rnd1 x = rnd2 x.
Theorem Rnd_DN_UP_pt_sym : forall F : R -> Prop, ( forall x, F x -> F (- x) ) -> forall x f : R, Rnd_DN_pt F x f -> Rnd_UP_pt F (-x) (-f).
Theorem Rnd_UP_DN_pt_sym : forall F : R -> Prop, ( forall x, F x -> F (- x) ) -> forall x f : R, Rnd_UP_pt F x f -> Rnd_DN_pt F (-x) (-f).
Theorem Rnd_DN_UP_sym : forall F : R -> Prop, ( forall x, F x -> F (- x) ) -> forall rnd1 rnd2 : R -> R, Rnd_DN F rnd1 -> Rnd_UP F rnd2 -> forall x, rnd1 (- x) = - rnd2 x.
Theorem Rnd_DN_UP_pt_split : forall F : R -> Prop, forall x d u, Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> forall f, F f -> (f <= d) \/ (u <= f).
Theorem Rnd_DN_pt_refl : forall F : R -> Prop, forall x : R, F x -> Rnd_DN_pt F x x.
Theorem Rnd_DN_pt_idempotent : forall F : R -> Prop, forall x f : R, Rnd_DN_pt F x f -> F x -> f = x.
Theorem Rnd_UP_pt_refl : forall F : R -> Prop, forall x : R, F x -> Rnd_UP_pt F x x.
Theorem Rnd_UP_pt_idempotent : forall F : R -> Prop, forall x f : R, Rnd_UP_pt F x f -> F x -> f = x.
Theorem Only_DN_or_UP : forall F : R -> Prop, forall x fd fu f : R, Rnd_DN_pt F x fd -> Rnd_UP_pt F x fu -> F f -> (fd <= f <= fu)%R -> f = fd \/ f = fu.
Theorem Rnd_ZR_abs : forall (F : R -> Prop) (rnd: R-> R), Rnd_ZR F rnd -> forall x : R, (Rabs (rnd x) <= Rabs x)%R.
Theorem Rnd_ZR_pt_monotone : forall F : R -> Prop, F 0 -> round_pred_monotone (Rnd_ZR_pt F).
Theorem Rnd_N_pt_DN_or_UP : forall F : R -> Prop, forall x f : R, Rnd_N_pt F x f -> Rnd_DN_pt F x f \/ Rnd_UP_pt F x f.
Theorem Rnd_N_pt_DN_or_UP_eq : forall F : R -> Prop, forall x fd fu f : R, Rnd_DN_pt F x fd -> Rnd_UP_pt F x fu -> Rnd_N_pt F x f -> f = fd \/ f = fu.
Theorem Rnd_N_pt_sym : forall F : R -> Prop, ( forall x, F x -> F (- x) ) -> forall x f : R, Rnd_N_pt F (-x) (-f) -> Rnd_N_pt F x f.
Theorem Rnd_N_pt_monotone : forall F : R -> Prop, forall x y f g : R, Rnd_N_pt F x f -> Rnd_N_pt F y g -> x < y -> f <= g.
Theorem Rnd_N_pt_unicity : forall F : R -> Prop, forall x d u f1 f2 : R, Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> x - d <> u - x -> Rnd_N_pt F x f1 -> Rnd_N_pt F x f2 -> f1 = f2.
Theorem Rnd_N_pt_refl : forall F : R -> Prop, forall x : R, F x -> Rnd_N_pt F x x.
Theorem Rnd_N_pt_idempotent : forall F : R -> Prop, forall x f : R, Rnd_N_pt F x f -> F x -> f = x.
Theorem Rnd_N_pt_0 : forall F : R -> Prop, F 0 -> Rnd_N_pt F 0 0.
Theorem Rnd_N_pt_pos : forall F : R -> Prop, F 0 -> forall x f, 0 <= x -> Rnd_N_pt F x f -> 0 <= f.
Theorem Rnd_N_pt_neg : forall F : R -> Prop, F 0 -> forall x f, x <= 0 -> Rnd_N_pt F x f -> f <= 0.
Theorem Rnd_N_pt_abs : forall F : R -> Prop, F 0 -> ( forall x, F x -> F (- x) ) -> forall x f : R, Rnd_N_pt F x f -> Rnd_N_pt F (Rabs x) (Rabs f).
Theorem Rnd_DN_UP_pt_N : forall F : R -> Prop, forall x d u f : R, F f -> Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> (Rabs (f - x) <= x - d)%R -> (Rabs (f - x) <= u - x)%R -> Rnd_N_pt F x f.
Theorem Rnd_DN_pt_N : forall F : R -> Prop, forall x d u : R, Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> (x - d <= u - x)%R -> Rnd_N_pt F x d.
Theorem Rnd_UP_pt_N : forall F : R -> Prop, forall x d u : R, Rnd_DN_pt F x d -> Rnd_UP_pt F x u -> (u - x <= x - d)%R -> Rnd_N_pt F x u.
Theorem Rle_0_minus : forall x y, (x <= y)%R -> (0 <= y - x)%R.
Theorem Rabs_eq_Rabs : forall x y : R, Rabs x = Rabs y -> x = y \/ x = Ropp y.
Theorem Rabs_minus_le: forall x y : R, (0 <= y)%R -> (y <= 2*x)%R -> (Rabs (x-y) <= x)%R.
Theorem Rplus_eq_reg_r : forall r r1 r2 : R, (r1 + r = r2 + r)%R -> (r1 = r2)%R.
Theorem Rplus_lt_reg_l : forall r r1 r2 : R, (r + r1 < r + r2)%R -> (r1 < r2)%R.
Theorem Rplus_lt_reg_r : forall r r1 r2 : R, (r1 + r < r2 + r)%R -> (r1 < r2)%R.
Theorem Rplus_le_reg_r : forall r r1 r2 : R, (r1 + r <= r2 + r)%R -> (r1 <= r2)%R.
Theorem Rmult_lt_reg_r : forall r r1 r2 : R, (0 < r)%R -> (r1 * r < r2 * r)%R -> (r1 < r2)%R.
Theorem Rmult_le_reg_r : forall r r1 r2 : R, (0 < r)%R -> (r1 * r <= r2 * r)%R -> (r1 <= r2)%R.
Theorem Rmult_lt_compat : forall r1 r2 r3 r4, (0 <= r1)%R -> (0 <= r3)%R -> (r1 < r2)%R -> (r3 < r4)%R -> (r1 * r3 < r2 * r4)%R.
Theorem Rmult_eq_reg_r : forall r r1 r2 : R, (r1 * r)%R = (r2 * r)%R -> r <> 0%R -> r1 = r2.
Theorem Rmult_minus_distr_r : forall r r1 r2 : R, ((r1 - r2) * r = r1 * r - r2 * r)%R.
Lemma Rmult_neq_reg_r: forall r1 r2 r3:R, (r2 * r1 <> r3 * r1)%R -> r2 <> r3.
Lemma Rmult_neq_compat_r: forall r1 r2 r3:R, (r1 <> 0)%R -> (r2 <> r3)%R -> (r2 *r1 <> r3*r1)%R.
Theorem Rmult_min_distr_r : forall r r1 r2 : R, (0 <= r)%R -> (Rmin r1 r2 * r)%R = Rmin (r1 * r) (r2 * r).
Theorem Rmult_min_distr_l : forall r r1 r2 : R, (0 <= r)%R -> (r * Rmin r1 r2)%R = Rmin (r * r1) (r * r2).
Lemma Rmin_opp: forall x y, (Rmin (-x) (-y) = - Rmax x y)%R.
Lemma Rmax_opp: forall x y, (Rmax (-x) (-y) = - Rmin x y)%R.
Theorem exp_le : forall x y : R, (x <= y)%R -> (exp x <= exp y)%R.
Theorem Rinv_lt : forall x y, (0 < x)%R -> (x < y)%R -> (/y < /x)%R.
Theorem Rinv_le : forall x y, (0 < x)%R -> (x <= y)%R -> (/y <= /x)%R.
Theorem sqrt_ge_0 : forall x : R, (0 <= sqrt x)%R.
Lemma sqrt_neg : forall x, (x <= 0)%R -> (sqrt x = 0)%R.
Theorem Rabs_le : forall x y, (-y <= x <= y)%R -> (Rabs x <= y)%R.
Theorem Rabs_le_inv : forall x y, (Rabs x <= y)%R -> (-y <= x <= y)%R.
Theorem Rabs_ge : forall x y, (y <= -x \/ x <= y)%R -> (x <= Rabs y)%R.
Theorem Rabs_ge_inv : forall x y, (x <= Rabs y)%R -> (y <= -x \/ x <= y)%R.
Theorem Rabs_lt : forall x y, (-y < x < y)%R -> (Rabs x < y)%R.
Theorem Rabs_lt_inv : forall x y, (Rabs x < y)%R -> (-y < x < y)%R.
Theorem Rabs_gt : forall x y, (y < -x \/ x < y)%R -> (x < Rabs y)%R.
Theorem Rabs_gt_inv : forall x y, (x < Rabs y)%R -> (y < -x \/ x < y)%R.
Lemma Included_Full : forall {A} E, Included E (Full_set A).
Lemma int64_eq_e: forall i j, Int64.eq i j = true -> i=j.
Lemma ptrofs_eq_e: forall i j, Ptrofs.eq i j = true -> i=j.
Lemma allp_andp1 {A}{ND: NatDed A}: forall B (any: B) (p: B -> A) q, andp (allp p) q = (allp (fun x => andp (p x) q)).
Lemma allp_andp2 {A}{ND: NatDed A}: forall B (any: B) p (q: B -> A), andp p (allp q) = (allp (fun x => andp p (q x))).
Lemma valid_pointer_offset_val_zero: forall p, valid_pointer (offset_val 0 p) = valid_pointer p.
Lemma body_even : semax_body Vprog Gprog f_even even_spec.
Lemma body_main : semax_body Vprog Gprog f_main main_spec.
Lemma round13eq: forall buf S12 S13, S13 = mbed_tls_fround S12 buf 52 -> Int.xor (Int.xor (Int.xor (Int.xor (Int.repr (Znth 52 buf)) (Znth (Z.land (Int.unsigned (col 0 S12)) (Int.unsigned (Int.repr 255))) FT0)) (Znth (Z.land (Int.unsigned (Int.shru (col 1 S12) (Int.repr 8))) (Int.unsigned (Int.repr 255))) FT1)) (Znth (Z.land (Int.unsigned (Int.shru (col 2 S12) (Int.repr 16))) (Int.unsigned (Int.repr 255))) FT2)) (Znth (Z.land (Int.unsigned (Int.shru (col 3 S12) (Int.repr 24))) (Int.unsigned (Int.repr 255))) FT3) = col 0 S13 /\ Int.xor (Int.xor (Int.xor (Int.xor (Int.repr (Znth 53 buf)) (Znth (Z.land (Int.unsigned (col 1 S12)) (Int.unsigned (Int.repr 255))) FT0)) (Znth (Z.land (Int.unsigned (Int.shru (col 2 S12) (Int.repr 8))) (Int.unsigned (Int.repr 255))) FT1)) (Znth (Z.land (Int.unsigned (Int.shru (col 3 S12) (Int.repr 16))) (Int.unsigned (Int.repr 255))) FT2)) (Znth (Z.land (Int.unsigned (Int.shru (col 0 S12) (Int.repr 24))) (Int.unsigned (Int.repr 255))) FT3) = col 1 S13 /\ Int.xor (Int.xor (Int.xor (Int.xor (Int.repr (Znth 54 buf)) (Znth (Z.land (Int.unsigned (col 2 S12)) (Int.unsigned (Int.repr 255))) FT0)) (Znth (Z.land (Int.unsigned (Int.shru (col 3 S12) (Int.repr 8))) (Int.unsigned (Int.repr 255))) FT1)) (Znth (Z.land (Int.unsigned (Int.shru (col 0 S12) (Int.repr 16))) (Int.unsigned (Int.repr 255))) FT2)) (Znth (Z.land (Int.unsigned (Int.shru (col 1 S12) (Int.repr 24))) (Int.unsigned (Int.repr 255))) FT3) = col 2 S13 /\ Int.xor (Int.xor (Int.xor (Int.xor (Int.repr (Znth 55 buf)) (Znth (Z.land (Int.unsigned (col 3 S12)) (Int.unsigned (Int.repr 255))) FT0)) (Znth (Z.land (Int.unsigned (Int.shru (col 0 S12) (Int.repr 8))) (Int.unsigned (Int.repr 255))) FT1)) (Znth (Z.land (Int.unsigned (Int.shru (col 1 S12) (Int.repr 16))) (Int.unsigned (Int.repr 255))) FT2)) (Znth (Z.land (Int.unsigned (Int.shru (col 2 S12) (Int.repr 24))) (Int.unsigned (Int.repr 255))) FT3) = col 3 S13.
Lemma round14eq: forall buf S13 S14, S14 = mbed_tls_final_fround S13 buf 56 -> Int.xor (Int.xor (Int.xor (Int.xor (Int.repr (Znth 56 buf)) (Znth (Z.land (Int.unsigned (col 0 S13)) (Int.unsigned (Int.repr 255))) FSb)) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 1 S13) (Int.repr 8))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 8))) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 2 S13) (Int.repr 16))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 16))) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 3 S13) (Int.repr 24))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 24)) = col 0 S14 /\ Int.xor (Int.xor (Int.xor (Int.xor (Int.repr (Znth 57 buf)) (Znth (Z.land (Int.unsigned (col 1 S13)) (Int.unsigned (Int.repr 255))) FSb)) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 2 S13) (Int.repr 8))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 8))) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 3 S13) (Int.repr 16))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 16))) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 0 S13) (Int.repr 24))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 24)) = col 1 S14 /\ Int.xor (Int.xor (Int.xor (Int.xor (Int.repr (Znth 58 buf)) (Znth (Z.land (Int.unsigned (col 2 S13)) (Int.unsigned (Int.repr 255))) FSb)) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 3 S13) (Int.repr 8))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 8))) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 0 S13) (Int.repr 16))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 16))) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 1 S13) (Int.repr 24))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 24)) = col 2 S14 /\ Int.xor (Int.xor (Int.xor (Int.xor (Int.repr (Znth 59 buf)) (Znth (Z.land (Int.unsigned (col 3 S13)) (Int.unsigned (Int.repr 255))) FSb)) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 0 S13) (Int.repr 8))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 8))) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 1 S13) (Int.repr 16))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 16))) (Int.shl (Znth (Z.land (Int.unsigned (Int.shru (col 2 S13) (Int.repr 24))) (Int.unsigned (Int.repr 255))) FSb) (Int.repr 24)) = col 3 S14.
Lemma round13_eq_assemble_general: forall i buf plaintext S0 S12 S13, S0 = mbed_tls_initial_add_round_key plaintext buf -> S12 = mbed_tls_enc_rounds i S0 buf 4 -> S13 = mbed_tls_fround S12 buf (4 + 4 * Z.of_nat i) -> S13 = mbed_tls_enc_rounds (S i) (mbed_tls_initial_add_round_key plaintext buf) buf 4.
Lemma round13_eq_assemble: forall buf plaintext S0 S12 S13, S0 = mbed_tls_initial_add_round_key plaintext buf -> S12 = mbed_tls_enc_rounds 12 S0 buf 4 -> S13 = mbed_tls_fround S12 buf 52 -> S13 = mbed_tls_enc_rounds 13 (mbed_tls_initial_add_round_key plaintext buf) buf 4.
Lemma Znth_fill_list: forall {T: Type}{d: Inhabitant T} (i n: Z) (f: Z -> T) , 0 <= i < n -> Znth i (fill_list n f) = f i.
Lemma times2_equiv: forall b, 0 <= Int.unsigned b < 256 -> times2 b = ff_mult (Int.repr 2) b.
Lemma times3_equiv: forall b, 0 <= Int.unsigned b < 256 -> times3 b = ff_mult (Int.repr 3) b.
Lemma byte0_word_to_int: forall b0 b1 b2 b3, byte0 (word_to_int (b0, b1, b2, b3)) = Int.unsigned b0.
Lemma byte1_word_to_int: forall b0 b1 b2 b3, byte1 (word_to_int (b0, b1, b2, b3)) = Int.unsigned b1.
Lemma byte2_word_to_int: forall b0 b1 b2 b3, byte2 (word_to_int (b0, b1, b2, b3)) = Int.unsigned b2.
Lemma byte3_word_to_int: forall b0 b1 b2 b3, byte3 (word_to_int (b0, b1, b2, b3)) = Int.unsigned b3.
Lemma xor_byte0_with_FSb: forall b0 b1 b2 b3 i, Int.xor (word_to_int (b0, b1, b2, b3)) (Znth i tablesLL.FSb) = word_to_int ((Int.xor b0 (Znth i tablesLL.FSb)), b1, b2, b3).
Lemma xor_byte1_with_FSb: forall b0 b1 b2 b3 i, Int.xor (word_to_int (b0, b1, b2, b3)) (Int.shl (Znth i tablesLL.FSb) (Int.repr 8)) = word_to_int (b0, (Int.xor b1 (Znth i tablesLL.FSb)), b2, b3).
Lemma xor_byte2_with_FSb: forall b0 b1 b2 b3 i, Int.xor (word_to_int (b0, b1, b2, b3)) (Int.shl (Znth i tablesLL.FSb) (Int.repr 16)) = word_to_int (b0, b1, (Int.xor b2 (Znth i tablesLL.FSb)), b3).
Lemma xor_byte3_with_FSb: forall b0 b1 b2 b3 i, Int.xor (word_to_int (b0, b1, b2, b3)) (Int.shl (Znth i tablesLL.FSb) (Int.repr 24)) = word_to_int (b0, b1, b2, (Int.xor b3 (Znth i tablesLL.FSb))).
Lemma equiv_sbox: forall b, Znth (Int.unsigned b) tablesLL.FSb = look_sbox b.
Lemma xor_word_to_int: forall a0 a1 a2 a3 b0 b1 b2 b3, Int.xor (word_to_int (a0, a1, a2, a3)) (word_to_int (b0, b1, b2, b3)) = word_to_int ((Int.xor a0 b0), (Int.xor a1 b1), (Int.xor a2 b2), (Int.xor a3 b3)).
Lemma rot8_word_to_int: forall b0 b1 b2 b3, rot8 (word_to_int (b0, b1, b2, b3)) = word_to_int (b3, b0, b1, b2).
Lemma mask_byte_nop: forall i, 0 <= Int.unsigned i < 256 -> Int.and i (Int.repr 255) = i.
Lemma FSb_range: forall i, 0 <= Int.unsigned (Znth i FSb) < 256.
Lemma zero_ext_nop: forall i, 0 <= (Int.unsigned i) < 256 -> Int.zero_ext 8 i = i.
Lemma FSb_inj: forall i j, 0 <= i < 256 -> 0 <= j < 256 -> Znth i FSb = Znth j FSb -> i = j.
Lemma FSb_RSb_id: forall j, 0 <= j < 256 -> j = Int.unsigned (Znth (Int.unsigned (Znth j RSb)) FSb).
Lemma RSb_inj: forall i j, 0 <= i < 256 -> 0 <= j < 256 -> Znth i RSb = Znth j RSb -> i = j.
Lemma RSb_range: forall i, 0 <= Int.unsigned (Znth i RSb) < 256.
Lemma xor_is_or_4_bytes: forall b0 b1 b2 b3, (Int.xor (Int.xor (Int.xor b0 (Int.shl b1 (Int.repr 8))) (Int.shl b2 (Int.repr 16))) (Int.shl b3 (Int.repr 24))) = (Int.or (Int.or (Int.or b0 (Int.shl b1 (Int.repr 8))) (Int.shl b2 (Int.repr 16))) (Int.shl b3 (Int.repr 24))).
Lemma masked_byte_range: forall i, 0 <= Z.land i 255 < 256.
Lemma zero_ext_mask: forall i, Int.zero_ext 8 i = Int.and i (Int.repr 255).
Lemma split_quad_eq: forall {T : Type} (c0 c1 c2 c3 c0' c1' c2' c3' : T), c0 = c0' -> c1 = c1' -> c2 = c2' -> c3 = c3' -> (c0, c1, c2, c3) = (c0', c1', c2', c3').
Lemma split_4eq: forall (T : Type) (c0 c1 c2 c3 c0' c1' c2' c3' : T), (c0, c1, c2, c3) = (c0', c1', c2', c3') -> c0 = c0' /\ c1 = c1' /\ c2 = c2' /\ c3 = c3'.
Lemma get_uint32_le_sublist: forall i l, 0 <= i <= Zlength l - 4 -> get_uint32_le l i = get_uint32_le (sublist i (i+4) l) 0.
Lemma get_uint32_le_word_to_int: forall b0 b1 b2 b3, get_uint32_le (map Int.unsigned [b0; b1; b2; b3]) 0 = word_to_int (b0, b1, b2, b3).
Lemma initial_round_equiv: forall S K, (mbed_tls_initial_add_round_key (map Int.unsigned (state_to_list S)) (map Int.unsigned (block_to_ints K)) ) = state_to_four_ints (AddRoundKey S K).
Lemma body_aes_encrypt: semax_body Vprog Gprog f_mbedtls_aes_encrypt encryption_spec_ll.
Lemma extra_expansion_sublist : forall k : list word, Zlength k = Nk -> sublist 0 (Nb*(Nr+1)) (blocks_to_ints (extra_key_expansion k)) = blocks_to_ints (KeyExpansion k).
Lemma subbytes_shiftrows_comm : forall b : block, ShiftRows (SubBytes b) = SubBytes (ShiftRows b).
Lemma invsubbytes_invshiftrows_comm : forall b : block, InvShiftRows (InvSubBytes b) = InvSubBytes (InvShiftRows b).
Lemma sbox_invsbox_inverse : forall a : nat, (a < 256)%nat -> let b := Z.to_nat (Int.unsigned (nth a sbox Int.zero)) in nth b inv_sbox Int.zero = Int.repr (Z.of_nat a).
Lemma invsbox_sbox_inverse : forall a : nat, (a < 256)%nat -> let b := Z.to_nat (Int.unsigned (nth a inv_sbox Int.zero)) in nth b sbox Int.zero = Int.repr (Z.of_nat a).
Lemma ft0_equiv : forall n : nat, (n < 256)%nat -> let b := nth n sbox Int.zero in nth n FT0 Int.zero = word_to_int (ff_mult b (Int.repr 2), b, b, ff_mult b (Int.repr 3)).
Lemma ft1_equiv : forall n : nat, (n < 256)%nat -> let b := nth n sbox Int.zero in nth n FT1 Int.zero = word_to_int (ff_mult b (Int.repr 3), ff_mult b (Int.repr 2), b, b).
Lemma ft2_equiv : forall n : nat, (n < 256)%nat -> let b := nth n sbox Int.zero in nth n FT2 Int.zero = word_to_int (b, ff_mult b (Int.repr 3), ff_mult b (Int.repr 2), b).
Lemma ft3_equiv : forall n : nat, (n < 256)%nat -> let b := nth n sbox Int.zero in nth n FT3 Int.zero = word_to_int (b, b, ff_mult b (Int.repr 3), ff_mult b (Int.repr 2)).
Lemma rt0_equiv : forall n : nat, (n < 256)%nat -> let b := nth n inv_sbox Int.zero in (* (0x0e, 0x09, 0x0d, 0x0b) *) nth n RT0 Int.zero = word_to_int (ff_mult b (Int.repr 14), ff_mult b (Int.repr 9), ff_mult b (Int.repr 13), ff_mult b (Int.repr 11)).
Lemma rt1_equiv : forall n : nat, (n < 256)%nat -> let b := nth n inv_sbox Int.zero in (* (0x0b, 0x0e, 0x09, 0x0d) *) nth n RT1 Int.zero = word_to_int (ff_mult b (Int.repr 11), ff_mult b (Int.repr 14), ff_mult b (Int.repr 9), ff_mult b (Int.repr 13)).
Lemma rt2_equiv : forall n : nat, (n < 256)%nat -> let b := nth n inv_sbox Int.zero in (* (0x0d, 0x0b, 0x0e, 0x09) *) nth n RT2 Int.zero = word_to_int (ff_mult b (Int.repr 13), ff_mult b (Int.repr 11), ff_mult b (Int.repr 14), ff_mult b (Int.repr 9)).
Lemma rt3_equiv : forall n : nat, (n < 256)%nat -> let b := nth n inv_sbox Int.zero in (* (0x09, 0x0d, 0x0b, 0x0e) *) nth n RT3 Int.zero = word_to_int (ff_mult b (Int.repr 9), ff_mult b (Int.repr 13), ff_mult b (Int.repr 11), ff_mult b (Int.repr 14)).
Lemma nth_cons_S: forall {T: Type} (n: nat) (h: T) (tl: list T), nth (S n) (h :: tl) = nth n tl.