Module Make(WS: WORDSIZE).
Definition wordsize: nat := WS.wordsize.
Definition zwordsize: Z := Z.of_nat wordsize.
Definition modulus : Z := two_power_nat wordsize.
Definition half_modulus : Z := modulus / 2.
Definition max_unsigned : Z := modulus - 1.
Definition max_signed : Z := half_modulus - 1.
Definition min_signed : Z := - half_modulus.
Remark wordsize_pos: zwordsize > 0.
Remark modulus_power: modulus = two_p zwordsize.
Remark modulus_gt_one: modulus > 1.
Remark modulus_pos: modulus > 0.
Hint Resolve modulus_pos: ints.
(** * Representation of machine integers *)
(** A machine integer (type [int]) is represented as a Coq arbitrary-precision integer (type [Z]) plus a proof that it is in the range 0 (included) to [modulus] (excluded). *)
Record int: Type := mkint { intval: Z; intrange: -1 < intval < modulus }.
(** Fast normalization modulo [2^wordsize] *)
Definition Z_mod_modulus (x: Z) : Z :=
match x with
| Z0 => 0
| Zpos p => P_mod_two_p p wordsize
| Zneg p => let r := P_mod_two_p p wordsize in if zeq r 0 then 0 else modulus - r
end.
Proof (Z_mod_two_p_range wordsize).
Proof (Z_mod_two_p_eq wordsize).
(** The [unsigned] and [signed] functions return the Coq integer corresponding to the given machine integer, interpreted as unsigned or signed respectively. *)
Definition unsigned (n: int) : Z := intval n.
Definition signed (n: int) : Z :=
let x := unsigned n in
if zlt x half_modulus then x else x - modulus.
(** Conversely, [repr] takes a Coq integer and returns the corresponding machine integer.  The argument is treated modulo [modulus]. *)
Definition repr (x: Z) : int :=
mkint (Z_mod_modulus x) (Z_mod_modulus_range' x).
Definition zero := repr 0.
Definition one  := repr 1.
Definition mone := repr (-1).
Definition iwordsize := repr zwordsize.
Remark half_modulus_modulus: modulus = 2 * half_modulus.
(** Relative positions, from greatest to smallest: << max_unsigned max_signed 2*wordsize-1 wordsize 0 min_signed >> *)
Remark half_modulus_pos: half_modulus > 0.
Remark min_signed_neg: min_signed < 0.
Remark max_signed_pos: max_signed >= 0.
Remark wordsize_max_unsigned: zwordsize <= max_unsigned.
Remark two_wordsize_max_unsigned: 2 * zwordsize - 1 <= max_unsigned.
Remark max_signed_unsigned: max_signed < max_unsigned.
(** ** Modulo arithmetic *)
(** [eqm] is equality modulo $2^{wordsize}$ #2<sup>wordsize</sup>#. *)
Definition eqm := eqmod modulus.
Proof (eqmod_refl modulus).
Hint Resolve eqm_refl: ints.
Proof (eqmod_refl2 modulus).
Hint Resolve eqm_refl2: ints.
Proof (eqmod_sym modulus).
Hint Resolve eqm_sym: ints.
Proof (eqmod_trans modulus).
Hint Resolve eqm_trans: ints.
Proof (eqmod_small_eq modulus).
Hint Resolve eqm_small_eq: ints.
Proof (eqmod_add modulus).
Hint Resolve eqm_add: ints.
Proof (eqmod_neg modulus).
Hint Resolve eqm_neg: ints.
Proof (eqmod_sub modulus).
Hint Resolve eqm_sub: ints.
Proof (eqmod_mult modulus).
Hint Resolve eqm_mult: ints.
Proof (eqmod_same_bits wordsize).
Proof (same_bits_eqmod wordsize).
(** ** Properties of the coercions between [Z] and [int] *)
Hint Resolve eqm_unsigned_repr: ints.
Hint Resolve eqm_unsigned_repr_l: ints.
Hint Resolve eqm_unsigned_repr_r: ints.
Hint Resolve unsigned_range: ints.
Hint Resolve unsigned_range_2: ints.
Hint Resolve repr_unsigned: ints.
Hint Resolve repr_signed: ints.
Opaque repr.
Hint Resolve unsigned_repr: ints.
(** ** Properties of zero, one, minus one *)
(** ** Properties of equality *)
(** ** Properties of addition *)
(** ** Properties of negation *)
(** ** Properties of subtraction *)
(** ** Properties of multiplication *)
(** ** Properties of division and modulus *)
(** ** Bit-level properties *)
Definition testbit (x: int) (i: Z) : bool := Z.testbit (unsigned x) i.
Remark bits_one: forall n, testbit one n = zeq n 0.
Hint Rewrite bits_zero bits_mone : ints.
Ltac bit_solve :=
intros; apply same_bits_eq; intros; autorewrite with ints; auto with bool.
(** ** Properties of bitwise and, or, xor *)
Hint Rewrite bits_and bits_or bits_xor bits_not: ints.
(** ** Properties of bitwise complement.*)
(** ** Connections between [add] and bitwise logical operations. *)
(** ** Properties of shifts *)
Hint Rewrite bits_shl bits_shru bits_shr: ints.
(** ** Properties of rotations *)
Hint Rewrite bits_rol bits_ror: ints.
(** ** Properties of [is_power2]. *)
Remark two_p_range:
forall n,
0 <= n < zwordsize ->
0 <= two_p n <= max_unsigned.
(** ** Relation between bitwise operations and multiplications / divisions by powers of 2 *)
(** Left shifts and multiplications by powers of 2. *)
(** Unsigned right shifts and unsigned divisions by powers of 2. *)
(** Signed right shifts and signed divisions by powers of 2. *)
(** Unsigned modulus over [2^n] is masking with [2^n-1]. *)
(** ** Properties of [shrx] (signed division by a power of 2) *)
(** Connections between [shr] and [shru]. *)
(** ** Properties of integer zero extension and sign extension. *)
Hint Rewrite bits_zero_ext bits_sign_ext: ints.
(** [zero_ext n x] is the unique integer congruent to [x] modulo [2^n] in the range [0...2^n-1]. *)
(** [sign_ext n x] is the unique integer congruent to [x] modulo [2^n] in the range [-2^(n-1)...2^(n-1) - 1]. *)
(** ** Properties of [one_bits] (decomposition in sum of powers of two) *)
Fixpoint int_of_one_bits (l: list int) : int :=
match l with
| nil => zero
| a :: b => add (shl one a) (int_of_one_bits b)
end.
(** ** Properties of comparisons *)
(** ** Non-overlapping test *)
Definition no_overlap (ofs1: int) (sz1: Z) (ofs2: int) (sz2: Z) : bool :=
let x1 := unsigned ofs1 in let x2 := unsigned ofs2 in
zlt (x1 + sz1) modulus && zlt (x2 + sz2) modulus
&& (zle (x1 + sz1) x2 || zle (x2 + sz2) x1).

Lemma no_overlap_sound:
forall ofs1 sz1 ofs2 sz2 base,
sz1 > 0 -> sz2 > 0 -> no_overlap ofs1 sz1 ofs2 sz2 = true ->
unsigned (add base ofs1) + sz1 <= unsigned (add base ofs2)
\/ unsigned (add base ofs2) + sz2 <= unsigned (add base ofs1).