(* Specifications: *)
Lemma Tsh_split: forall sh, exists sh', sepalg.join sh sh' Tsh.
Module VerifHeadSwitch.
Lemma ramify_PPQQ {A: Type} {NA: NatDed A} {SA: SepLog A} {CA: ClassicalSep A}: forall P Q,
P |-- P * (Q -* Q).
Lemma modus_ponens_wand' {A}{ND: NatDed A}{SL: SepLog A}:
forall P Q R: A, P |-- Q -> P * (Q -* R) |-- R.
Lemma if_trueb: forall {A: Type} b (a1 a2: A), b = true -> (if b then a1 else a2) = a1.
Lemma body_turn_left: semax_body Vprog Gprog f_turn_left turn_left_spec.
Definition pushdown_left_inv (b_res: val) (t_res: tree val): environ -> mpred :=
EX b: val, EX ta: tree val, EX x: nat, EX v: val, EX tb: tree val, EX P: tree val -> tree val,
PROP  (P (pushdown_left ta tb) = t_res)
LOCAL (temp _t b)
SEP   (treebox_rep (T ta x v tb) b; partial_treebox_rep P b_res b).
Lemma body_pushdown_left: semax_body Vprog Gprog f_pushdown_left pushdown_left_spec.
Definition delete_inv (b0: val) (t0: tree val) (x: nat): environ -> mpred :=
EX b: val, EX t: tree val, EX P: tree val -> tree val,
PROP(P (delete x t) = delete x t0)
LOCAL(temp _t b; temp _x (Vint (Int.repr (Z.of_nat x))))
SEP(treebox_rep t b; partial_treebox_rep P b0 b).
Lemma body_delete: semax_body Vprog Gprog f_delete delete_spec.
Lemma HMAC_DRBG_generate_helper_Z_any_prop_fst:
forall (P: list byte -> Prop) HMAC key v z,
0 <= z ->
P v ->
(forall x y, P (HMAC x y)) ->
P (fst (HMAC_DRBG_generate_helper_Z HMAC key v z)).
Lemma HMAC_DRBG_generate_helper_Z_incremental_fst:
forall HMAC key v z v',
0 <= z ->
v' = fst (HMAC_DRBG_generate_helper_Z HMAC key v z) ->
HMAC v' key = fst (HMAC_DRBG_generate_helper_Z HMAC key v (z + 32)).
Lemma HMAC_DRBG_generate_helper_Z_incremental_snd:
forall HMAC key v z v',
0 <= z ->
v' = fst (HMAC_DRBG_generate_helper_Z HMAC key v (z + 32)) ->
snd (HMAC_DRBG_generate_helper_Z HMAC key v z) ++ v' = snd (HMAC_DRBG_generate_helper_Z HMAC key v (z + 32)).
Lemma HMAC_DRBG_generate_helper_Z_Zlength_fst:
forall HMAC key v z,
0 <= z ->
Zlength v = 32 ->
(forall x y, Zlength (HMAC x y) = 32) ->
Zlength (fst (HMAC_DRBG_generate_helper_Z HMAC key v z)) = 32.
Lemma HMAC_DRBG_generate_helper_Z_Zlength_snd:
forall HMAC key v z,
0 <= z ->
(forall x y, Zlength (HMAC x y) = 32) ->
(exists n, z = n * 32) ->
Zlength (snd (HMAC_DRBG_generate_helper_Z HMAC key v z)) = z.
Lemma HMAC_DRBG_generate_helper_Z_incremental_equiv:
forall HMAC key v z incr,
0 <= z ->
0 < incr <= 32 ->
(exists n, z = n * 32) ->
HMAC_DRBG_generate_helper_Z HMAC key v (z + incr) = HMAC_DRBG_generate_helper_Z HMAC key v (z + 32).
Lemma hmac256drbgabs_hmac_drbg_update_any_prop_key:
forall (P: list byte -> Prop) a additional_data,
(forall x y, P (HMAC256 x y)) ->
P (hmac256drbgabs_key (hmac256drbgabs_hmac_drbg_update a additional_data)).
Lemma hmac256drbgabs_hmac_drbg_update_any_prop_V:
forall (P: list byte -> Prop) a additional_data,
(forall x y, P (HMAC256 x y)) ->
P (hmac256drbgabs_value (hmac256drbgabs_hmac_drbg_update a additional_data)).
Lemma hmac256drbgabs_hmac_drbg_update_Zlength_key:
forall a additional_data,
Zlength (hmac256drbgabs_key (hmac256drbgabs_hmac_drbg_update a additional_data)) = Z.of_nat SHA256.DigestLength.
Lemma hmac256drbgabs_hmac_drbg_update_Zlength_V:
forall a additional_data,
Zlength (hmac256drbgabs_value (hmac256drbgabs_hmac_drbg_update a additional_data)) = Z.of_nat SHA256.DigestLength.
Lemma hmac256drbgabs_reseed_any_prop_key:
forall (P: list byte -> Prop) a s additional_data,
P (hmac256drbgabs_key a) ->
(forall x y, P (HMAC256 x y)) ->
P (hmac256drbgabs_key (hmac256drbgabs_reseed a s additional_data)).
Lemma hmac256drbgabs_reseed_any_prop_V:
forall (P: list byte -> Prop) a s additional_data,
P (hmac256drbgabs_value a) ->
(forall x y, P (HMAC256 x y)) ->
P (hmac256drbgabs_value (hmac256drbgabs_reseed a s additional_data)).
Lemma hmac256drbgabs_reseed_Zlength_key:
forall a s additional_data,
Zlength (hmac256drbgabs_key a) = Z.of_nat SHA256.DigestLength ->
Zlength (hmac256drbgabs_key (hmac256drbgabs_reseed a s additional_data)) = Z.of_nat SHA256.DigestLength.
Lemma hmac256drbgabs_reseed_Zlength_V:
forall a s additional_data,
Zlength (hmac256drbgabs_value a) = Z.of_nat SHA256.DigestLength ->
Zlength (hmac256drbgabs_value (hmac256drbgabs_reseed a s additional_data)) = Z.of_nat SHA256.DigestLength.
Lemma hmac256drbgabs_update_key_ident:
forall a key, key = hmac256drbgabs_key a -> hmac256drbgabs_update_key a key = a.
Lemma hmac256drbgabs_update_value_ident:
forall a value, value = hmac256drbgabs_value a -> hmac256drbgabs_update_value a value = a.
Lemma hmac256drbgabs_update_key_update_value_commute:
forall a key value, hmac256drbgabs_update_value (hmac256drbgabs_update_key a key) value = hmac256drbgabs_update_key (hmac256drbgabs_update_value a value) key.
Lemma HMAC_DRBG_update_value l key V key' V'
(P:(key', V') = HMAC_DRBG_update HMAC256 l key V):
Zlength V' = 32.
Lemma Zlength_hmac256drbgabs_reseed_value abs s c
(HC: Zlength c >? 256 = false) (HV: Zlength (hmac256drbgabs_value abs)=32):
Zlength (hmac256drbgabs_value (hmac256drbgabs_reseed abs s c)) = 32.
Lemma Zlength_hmac256drbgabs_update_value abs c:
Zlength (hmac256drbgabs_value (hmac256drbgabs_hmac_drbg_update abs c)) = 32.
Lemma HMAC256_DRBG_reseed_algorithmWFaux d l y A B zz
(H: (A, B, zz) = HMAC256_DRBG_functional_prog.HMAC256_DRBG_reseed_algorithm d l y):
0 <= zz < Int.max_signed /\ Zlength A = 32.
Lemma HMAC256_DRBG_reseed_functionWFaux a b c s t x y A B zz C D ss
(H: ENTROPY.success (A, B, zz, C, D) ss =
HMAC256_DRBG_functional_prog.HMAC256_DRBG_reseed_function a b c s t x y):
0 <= zz < Int.max_signed /\ Zlength A = 32.
Lemma mbedtls_HMAC256_DRBG_reseed_functionWFaux a s data ss A B zz C D
(H: mbedtls_HMAC256_DRBG_reseed_function s a data =
ENTROPY.success (A, B, zz, C, D)  ss):
0 <= zz < Int.max_signed /\ Zlength A = 32.
Lemma false_zgt z a: false = (z >? a) -> z<=a.
Lemma HMAC256_DRBG_generate_algorithmWF a v k rc n l bytes V K RC (N:n >=0)
(A: 0<= a +1< Int.max_signed) (Rc: 0<=rc)
(H: DRBG_functions.generate_algorithm_success bytes (V, K, RC) =
HMAC256_DRBG_functional_prog.HMAC256_DRBG_generate_algorithm a (v,k,rc) n l):
Zlength V = 32 /\ 0 <= RC < Int.max_signed.
Lemma HMAC256_DRBG_generate_functionWF f a b c s v k rc d pr n e l V K RC z PR ss bytes
(A: 0<= a+1 < Int.max_signed) (N: n>=0) (Rc: 0<=rc)
(F: forall s d z b x y zz A B C D ss, ENTROPY.success (A, B, zz, C, D) ss = f s (d, z, b) x y -> 0<=zz)
(H : ENTROPY.success (bytes, (V, K, RC, z, PR)) ss =
HMAC256_DRBG_functional_prog.HMAC256_DRBG_generate_function f a b c s (v, k, rc, d, pr) n e pr l):
Zlength V = 32 /\ 0 <= RC < Int.max_signed.
Lemma mbedtls_HMAC256_DRBG_generate_functionWF_success s k v rc el pr rsi n l bytes V K RC z PR ss
(N: n>=0) (Rc: 0<=rc) (HRSI: 0 <= rsi+1 < Int.max_signed)
(H: ENTROPY.success (bytes, (V, K, RC, z, PR)) ss =
mbedtls_HMAC256_DRBG_generate_function s (HMAC256DRBGabs k v rc el pr rsi) n l):
Zlength V = 32 /\ 0 <= RC < Int.max_signed.
Lemma hmac256drbgabs_generateWF I s n l K V RC el PR rsi (N:n>=0)
(HI: Zlength (hmac256drbgabs_value I) = 32 /\
0 <= hmac256drbgabs_reseed_counter I < Int.max_signed)
(HRSI: 0 <= rsi +1< Int.max_signed)
(G: hmac256drbgabs_generate I s n l = HMAC256DRBGabs K V RC el PR rsi):
Zlength V = 32 /\ 0 <= RC < Int.max_signed.
Lemma ReseedRes: forall X r v, @return_value_relate_result X r (Vint v) -> Int.eq v (Int.repr (-20864)) = false.
Lemma hmac_interp_empty d r: hmac_interp d r |-- md_empty r.
Lemma instantiate256_reseed d s pr_flag rc ri (ZLc'256F : (Zlength d >? 256) = false):
instantiate_function_256 s pr_flag  d =
mbedtls_HMAC256_DRBG_reseed_function s (HMAC256DRBGabs initial_key initial_value rc 48 pr_flag ri) d.
Lemma perm_of_glb_not_Freeable: forall sh,
~ perm_of_sh (Share.glb Share.Rsh sh) = Some Freeable.
Lemma join_bot_bot_eq sh :
sepalg.join Share.bot Share.bot sh ->
sh = Share.bot.
Lemma join_to_bot_l {sh1 sh2} :
sepalg.join sh1 sh2 Share.bot ->
sh1 = Share.bot.
Lemma join_to_bot_r {sh1 sh2} :
sepalg.join sh1 sh2 Share.bot ->
sh2 = Share.bot.
Lemma join_top_l {sh2 sh3} :
sepalg.join Share.top sh2 sh3 ->
sh2 = Share.bot.
Lemma join_top {sh2 sh3} :
sepalg.join Share.top sh2 sh3 ->
sh3 = Share.top.
Lemma join_pfullshare {sh2 sh3 : pshare} : ~sepalg.join pfullshare sh2 sh3.
Lemma join_with_bot_r sh1 sh2 : join sh1 Share.bot sh2 -> sh1 = sh2.
Lemma join_with_bot_l sh1 sh2 : join Share.bot sh1 sh2 -> sh1 = sh2.
intros [H H'].
Lemma approx_derives_ge : forall n m P, (n <= m)%nat -> approx n P |-- approx m P.
Lemma approx_derives : forall P n, approx n P |-- P.
Definition exclusive_mpred (R : mpred) :=
(R * R |-- FF)%logic.
Lemma compose_meminjI_Some: forall j k b1 b2 d1 b3 d2
(J:j b1 = Some(b2,d1)) (K:k b2 = Some(b3,d2)),
compose_meminj j k b1 = Some(b3, d1+d2).
Lemma compose_meminjI_None: forall j k b1
(H: (j b1 = None) \/
(exists b2 d1, j b1 =Some(b2,d1) /\ k b2=None)),
compose_meminj j k b1 = None.
Lemma inject_incr_coincide: forall f g (INC: inject_incr f g) b p
(G:g b = Some p) q (F:f b = Some q),p=q.
Lemma inject_incr_inv: forall f g (INC: inject_incr f g) b
(G: g b =None), f b = None.
Lemma forall2_val_inject_D: forall vals1 vals2 j (ValInjMu : Forall2 (val_inject j) vals1 vals2)
v1 (IN: In v1 vals1), exists v2, val_inject j v1 v2 /\ In v2 vals2.
(* rule for if in weakest precondition form *)
Lemma wp_if : forall t x v s1 s2 P1 P2 G R Q,
let wp :=
EX val:value,
store_op (fun r => r#v = Some val) &&
(
((!!(val = value_label (L 0)) && P1))
||
((EX x1:value, (EX x2:value,
!!(val = (value_cons x1 x2)))) && P2)
)
in
hoare t x G R P1 s1 Q ->
hoare t x G R P2 s2 Q ->
hoare t x G R wp (instr_if_nil v s1 s2) Q.
Lemma typecheck_binop_sound:
forall op {CS: compspecs} (rho : environ) m (e1 e2 : expr) (t : type)
(IBR: denote_tc_assert (isBinOpResultType op e1 e2 t) rho m)
(TV2: tc_val (typeof e2) (eval_expr e2 rho))
(TV1: tc_val (typeof e1) (eval_expr e1 rho)),
tc_val t
(eval_binop op (typeof e1) (typeof e2) (eval_expr e1 rho) (eval_expr e2 rho)).
Lemma eval_expr_any:
forall {CS: compspecs} rho e v,
eval_expr e any_environ = v ->
v <> Vundef ->
eval_expr e rho = v
with eval_lvalue_any:
forall {CS: compspecs} rho e v,
eval_lvalue e any_environ = v ->
v <> Vundef ->
eval_lvalue e rho = v.
Lemma denote_tc_assert_ilt':
forall {CS: compspecs} e j, denote_tc_assert (tc_ilt e j) = denote_tc_assert (tc_ilt' e j).
Lemma denote_tc_assert_llt':
forall {CS: compspecs} e j, denote_tc_assert (tc_llt e j) = denote_tc_assert (tc_llt' e j).
Lemma tc_val_void:
forall v, tc_val Tvoid v <-> False.
Lemma typecheck_Otest_order_sound:
forall op {CS: compspecs} (rho : environ) m (e1 e2 : expr) (t : type)
(IBR: denote_tc_assert (isBinOpResultType op e1 e2 t) rho m)
(TV2: tc_val (typeof e2) (eval_expr e2 rho))
(TV1: tc_val (typeof e1) (eval_expr e1 rho))
(OP: op = Ole \/ op = Olt \/ op = Oge \/ op = Ogt),
tc_val t
(eval_binop op (typeof e1) (typeof e2) (eval_expr e1 rho) (eval_expr e2 rho)).
Lemma mem_lessdef_sem_cast:
forall m1 m2, mem_lessdef m1 m2 ->
forall v1 v1', Val.lessdef v1 v1' ->
forall t1 t2 v,
classify_cast t1 t2 <> Cop.cast_case_void ->
sem_cast v1 t1 t2 m1 = Some v ->
sem_cast v1' t1 t2 m2 = Some v.
Lemma mem_lessdef_sem_binarith:
forall m1 m2, mem_lessdef m1 m2 ->
forall v1 v1', Val.lessdef v1 v1' ->
forall v2 v2', Val.lessdef v2 v2' ->
forall (sem_int: signedness -> int -> int -> option val)
(sem_long: signedness -> int64 -> int64 -> option val)
(sem_float: float -> float -> option val)
(sem_single: float32 -> float32 -> option val)
(t1: type) (t2: type) v,
sem_binarith sem_int sem_long sem_float sem_single v1 t1 v2 t2 m1 = Some v ->
sem_binarith sem_int sem_long sem_float sem_single v1' t1 v2' t2 m2 = Some v.
Lemma mem_lessdef_sem_shift:
forall m1 m2, mem_lessdef m1 m2 ->
forall v1 v1', Val.lessdef v1 v1' ->
forall v2 v2', Val.lessdef v2 v2' ->
forall (sem_int: signedness -> int -> int -> int)
(sem_long: signedness -> int64 -> int64 -> int64)
(t1: type) (t2: type) v,
sem_shift sem_int sem_long v1 t1 v2 t2 = Some v ->
sem_shift sem_int sem_long v1' t1 v2' t2 = Some v.
Lemma mem_lessdef_cmp_ptr:
forall m1 m2, mem_lessdef m1 m2 ->
forall v1 v1', Val.lessdef v1 v1' ->
forall v2 v2', Val.lessdef v2 v2' ->
forall op v,
cmp_ptr m1 op v1 v2 = Some v ->
cmp_ptr m2 op v1' v2' = Some v.
Lemma mem_lessdef_sem_cmp:
forall m1 m2, mem_lessdef m1 m2 ->
forall v1 v1', Val.lessdef v1 v1' ->
forall v2 v2', Val.lessdef v2 v2' ->
forall op (t1: type) (t2: type) v,
sem_cmp op v1 t1 v2 t2 m1 = Some v ->
sem_cmp op v1' t1 v2' t2 m2 = Some v.
Lemma classify_cast_void_e:
forall t ty, classify_cast t ty = cast_case_void -> ty=Tvoid.
Lemma mem_lessdef_eval_expr: forall ge ve te m1 m2 a v1,
mem_lessdef m1 m2 ->
eval_expr ge ve te m1 a v1 ->
exists v2, eval_expr ge ve te m2 a v2 /\ Val.lessdef v1 v2
with mem_lessdef_eval_lvalue: forall ge ve te m1 m2 a b z,
mem_lessdef m1 m2 ->
eval_lvalue ge ve te m1 a b z ->
eval_lvalue ge ve te m2 a b z.
Lemma unaryop_mem_lessaloc {op u t m v m2}
(V: sem_unary_operation op u t m = Some v)
(M:mem_lessalloc m m2):
sem_unary_operation op u t m2 = Some v.
Lemma sem_cast_mem_lessaloc {v t d m m2} (M:mem_lessalloc m m2):
sem_cast v t d m = sem_cast v t d m2.
Lemma sem_cmp_mem_lessalloc {f v1 t1 v2 t2 m m2} (M : mem_lessalloc m m2):
sem_cmp f v1 t1 v2 t2 m2 = sem_cmp f v1 t1 v2 t2 m.
Lemma binaryop_mem_lessaloc {ge op v1 t1 v2 t2 m v m2}
(V: sem_binary_operation ge op v1 t1 v2 t2 m = Some v)
(M:mem_lessalloc m m2):
sem_binary_operation ge op v1 t1 v2 t2 m2 = Some v.
Lemma eval_expr_eval_lvalue_mem_lessalloc ge ve te m:
(forall (e : expr) (v : val),
eval_expr ge ve te m e v ->
forall m2 : mem, mem_lessalloc m m2 -> eval_expr ge ve te m2 e v) /\
(forall (e : expr) (b : block) (i : ptrofs),
eval_lvalue ge ve te m e b i ->
forall m2 : mem, mem_lessalloc m m2 -> eval_lvalue ge ve te m2 e b i).
Lemma eval_expr_mem_lessalloc {ge ve te m m2 e v} (M:mem_lessalloc m m2):
eval_expr ge ve te m e v -> eval_expr ge ve te m2 e v.
Lemma eval_lvalue_mem_lessalloc {ge ve te m m2 e b i} (M:mem_lessalloc m m2):
eval_lvalue ge ve te m e b i -> eval_lvalue ge ve te m2 e b i.
Lemma jsafeN_mem_lessdef {Z Jspec ge n z c jm1 jm2} :
juicy_mem_lessdef jm1 jm2 ->
ext_spec_stable juicy_mem_lessdef (JE_spec _ Jspec) ->
@jsafeN Z Jspec ge n z c jm1 ->
@jsafeN Z Jspec ge n z c jm2.
Lemma typecheck_Otest_eq_sound:
forall op {CS: compspecs} (rho : environ) m (e1 e2 : expr) (t : type)
(IBR: denote_tc_assert (isBinOpResultType op e1 e2 t) rho m)
(TV2: tc_val (typeof e2) (eval_expr e2 rho))
(TV1: tc_val (typeof e1) (eval_expr e1 rho))
(OP: op = Oeq \/ op = One),
tc_val t
(eval_binop op (typeof e1) (typeof e2) (eval_expr e1 rho) (eval_expr e2 rho)).
Lemma closed_wrt_modvars_switch:
forall a sl n F,
closed_wrt_modvars (Sswitch a sl) F ->
closed_wrt_modvars (seq_of_labeled_statement (select_switch n sl)) F.
(* TODO: This is obviously true. Ask Xavior to remove the definition list_norepet.*)
Axiom list_norepet_NoDup: forall {A: Type} (l: list A), list_norepet l <-> NoDup l.
Lemma PTree_In_fst_elements {A: Type}: forall (T: PTree.t A) i,
In i (map fst (PTree.elements T)) <-> exists a, PTree.get i T = Some a.
Lemma PTree_gs {A: Type}: forall (T: PTree.t A) i j x,
(exists a, PTree.get i T= Some a) ->
exists a, PTree.get i (PTree.set j x T) = Some a.
Lemma PTree_gs_equiv {A: Type}: forall (T: PTree.t A) i j x,
(exists a, PTree.get i T= Some a) \/ i = j <->
exists a, PTree.get i (PTree.set j x T) = Some a.
Lemma PTree_set_In_fst_elements {A: Type}: forall (T: PTree.t A) i i' a',
In i (map fst (PTree.elements T)) ->
In i (map fst (PTree.elements (PTree.set i' a' T))).
Lemma denote_tc_test_eq_Vint_l: forall m i v,
(denote_tc_test_eq (Vint i) v) m ->
i = Int.zero.
Lemma denote_tc_test_eq_Vint_r: forall m i v,
(denote_tc_test_eq v (Vint i)) m ->
i = Int.zero.
Lemma sameblock_eq_block:
forall p q r s,
is_true (sameblock (Vptr p r) (Vptr q s)) -> p=q.
Lemma denote_tc_test_eq_Vint_l': forall m i v,
(denote_tc_test_eq (Vint i) v) m ->
Int.eq i Int.zero = true.
Lemma denote_tc_test_eq_Vint_r': forall m i v,
(denote_tc_test_eq v (Vint i)) m ->
Int.eq i Int.zero = true.
Lemma denote_tc_test_eq_Vlong_l': forall m i v,
(denote_tc_test_eq (Vlong i) v) m ->
Int64.eq i Int64.zero = true.
Lemma denote_tc_test_eq_Vlong_r': forall m i v,
(denote_tc_test_eq v (Vlong i)) m ->
Int64.eq i Int64.zero = true.
Lemma denote_tc_test_order_eqblock:
forall phi b0 i0 b i,
app_pred (denote_tc_test_order (Vptr b0 i0) (Vptr b i)) phi ->
b0 = b.
Lemma valid_pointer_dry:
forall b ofs d m, app_pred (valid_pointer' (Vptr b ofs) d) (m_phi m) ->
Mem.valid_pointer (m_dry m) b (Ptrofs.unsigned ofs + d) = true.
Lemma weak_valid_pointer_dry:
forall b ofs m, app_pred (weak_valid_pointer (Vptr b ofs)) (m_phi m) ->
(Mem.valid_pointer (m_dry m) b (Ptrofs.unsigned ofs)
|| Mem.valid_pointer (m_dry m) b (Ptrofs.unsigned ofs - 1))%bool = true.
Lemma test_eq_relate':
forall v1 v2 op m
(OP: op = Ceq \/ op = Cne),
(denote_tc_test_eq v1 v2) (m_phi m) ->
cmp_ptr (m_dry m) op v1 v2 =
Some (force_val (sem_cmp_pp op v1 v2)).
Lemma sem_cast_relate:
forall i sz si a si' a' m,
Cop.sem_cast (Vint i) (Tint sz si a) (Tint I32 si' a') m =
sem_cast (Tint sz si a)  (Tint I32 si' a') (Vint i).
Lemma sem_cast_int_lemma:
forall sz si a si' a' i,
sem_cast (Tint sz si a)  (Tint I32 si' a') (Vint i) = Some (Vint i).
Lemma sem_cast_relate_int_long:
forall i sz si a si' a' m,
Cop.sem_cast (Vint i) (Tint sz si a) (Tlong si' a') m =
sem_cast (Tint sz si a)  (Tlong si' a') (Vint i).
Lemma sem_cast_relate_long:
forall i si a si' a' m,
Cop.sem_cast (Vlong i) (Tlong si a) (Tlong si' a') m =
sem_cast (Tlong si a)  (Tlong si' a') (Vlong i).
Lemma sem_cast_int_long_lemma:
forall sz si a si' a' i,
sem_cast (Tint sz si a)  (Tlong si' a') (Vint i) = Some (Vlong (cast_int_long si i)).
Lemma sem_cast_long_lemma:
forall si a si' a' i,
sem_cast (Tlong si a)  (Tlong si' a') (Vlong i) = Some (Vlong i).
Lemma denote_tc_test_eq_xx:
forall v si i phi,
app_pred (denote_tc_test_eq v (Vint i)) phi ->
app_pred (denote_tc_test_eq v (Vptrofs (ptrofs_of_int si i))) phi.
Lemma denote_tc_test_eq_yy:
forall v si i phi,
app_pred (denote_tc_test_eq (Vint i) v) phi ->
app_pred (denote_tc_test_eq (Vptrofs (ptrofs_of_int si i)) v) phi.
Lemma sem_cast_long_intptr_lemma:
forall si a i,
force_val1 (sem_cast (Tlong si a) size_t) (Vlong i)
= Vptrofs (Ptrofs.of_int64 i).
Lemma test_order_relate':
forall v1 v2 op m,
(denote_tc_test_order v1 v2) (m_phi m) ->
cmp_ptr (m_dry m) op v1 v2 = Some (force_val (sem_cmp_pp op v1 v2)).
Lemma sem_cast_int_intptr_lemma:
forall sz si a i,
force_val1 (sem_cast (Tint sz si a) size_t) (Vint i)
= Vptrofs (ptrofs_of_int si i).
Lemma test_eq_fiddle_signed_xx:
forall si si' v i phi,
app_pred (denote_tc_test_eq v (Vptrofs (ptrofs_of_int si i))) phi ->
app_pred (denote_tc_test_eq v (Vptrofs (ptrofs_of_int si' i))) phi.
Lemma test_eq_fiddle_signed_yy:
forall si si' v i phi,
app_pred (denote_tc_test_eq (Vptrofs (ptrofs_of_int si i)) v) phi ->
app_pred (denote_tc_test_eq (Vptrofs (ptrofs_of_int si' i)) v) phi.
Lemma test_order_fiddle_signed_xx:
forall si si' v i phi,
app_pred (denote_tc_test_order v (Vptrofs (ptrofs_of_int si i))) phi ->
app_pred (denote_tc_test_order v (Vptrofs (ptrofs_of_int si' i))) phi.
Lemma test_order_fiddle_signed_yy:
forall si si' v i phi,
app_pred (denote_tc_test_order (Vptrofs (ptrofs_of_int si i)) v) phi ->
app_pred (denote_tc_test_order (Vptrofs (ptrofs_of_int si' i)) v) phi.
Lemma denote_tc_nonzero_e':
forall i m, app_pred (denote_tc_nonzero (Vint i)) m -> Int.eq i Int.zero = false.
Lemma denote_tc_nodivover_e':
forall i j m, app_pred (denote_tc_nodivover (Vint i) (Vint j)) m ->
Int.eq i (Int.repr Int.min_signed) && Int.eq j Int.mone = false.
Lemma denote_tc_nonzero_e64':
forall i m, app_pred (denote_tc_nonzero (Vlong i)) m -> Int64.eq i Int64.zero = false.
Lemma denote_tc_nodivover_e64_ll':
forall i j m, app_pred (denote_tc_nodivover (Vlong i) (Vlong j)) m ->
Int64.eq i (Int64.repr Int64.min_signed) && Int64.eq j Int64.mone = false.
Lemma denote_tc_nodivover_e64_il':
forall s i j m, app_pred (denote_tc_nodivover (Vint i) (Vlong j)) m ->
Int64.eq (cast_int_long s i) (Int64.repr Int64.min_signed) && Int64.eq j Int64.mone = false.
Lemma denote_tc_nodivover_e64_li':
forall s i j m, app_pred (denote_tc_nodivover (Vlong i) (Vint j)) m ->
Int64.eq i (Int64.repr Int64.min_signed) && Int64.eq (cast_int_long s j) Int64.mone = false.
Lemma Int64_eq_repr_signed32_nonzero':
forall i, Int.eq i Int.zero = false ->
Int64.eq (Int64.repr (Int.signed i)) Int64.zero = false.
Lemma Int64_eq_repr_unsigned32_nonzero':
forall i, Int.eq i Int.zero = false ->
Int64.eq (Int64.repr (Int.unsigned i)) Int64.zero = false.
Lemma Int64_eq_repr_int_nonzero':
forall s i, Int.eq i Int.zero = false ->
Int64.eq (cast_int_long s i) Int64.zero = false.
Lemma denote_tc_igt_e':
forall m i j, app_pred (denote_tc_igt j (Vint i)) m ->
Int.ltu i j = true.
Lemma denote_tc_lgt_e':
forall m i j, app_pred (denote_tc_lgt j (Vlong i)) m ->
Int64.ltu i j = true.
Lemma denote_tc_iszero_long_e':
forall m i,
app_pred (denote_tc_iszero (Vlong i)) m ->
Int64.eq (Int64.repr (Int64.unsigned i)) Int64.zero = true.
Lemma eval_binop_relate':
forall {CS: compspecs} (ge: genv) te ve rho b e1 e2 t m
(Hcenv: genv_cenv ge = @cenv_cs CS)
(H1: Clight.eval_expr ge ve te (m_dry m) e1 (eval_expr e1 rho))
(H2: Clight.eval_expr ge ve te (m_dry m) e2 (eval_expr e2 rho))
(H3: app_pred (denote_tc_assert (isBinOpResultType b e1 e2 t) rho) (m_phi m))
(TC1 : tc_val (typeof e1) (eval_expr e1 rho))
(TC2 : tc_val (typeof e2) (eval_expr e2 rho)),
Clight.eval_expr ge ve te (m_dry m) (Ebinop b e1 e2 t)
(force_val2 (sem_binary_operation' b (typeof e1) (typeof e2))
(eval_expr e1 rho) (eval_expr e2 rho)).
Lemma alloc_variables_mem_step: forall cenv vars m e e2 m'
(M: alloc_variables cenv e m vars e2 m'), mem_step m m'.
Lemma bind_parameters_mem_step: forall cenv e m pars vargs m'
(M: bind_parameters cenv e m pars vargs m'), mem_step m m'.
Lemma denote_tc_nonzero_e:
forall i m, app_pred (denote_tc_nonzero (Vint i)) m -> i <> Int.zero.
Lemma denote_tc_nodivover_e:
forall i j m, app_pred (denote_tc_nodivover (Vint i) (Vint j)) m ->
~ (i =Int.repr Int.min_signed /\ j = Int.mone).
Lemma denote_tc_nonzero_e64:
forall i m, app_pred (denote_tc_nonzero (Vlong i)) m -> i <> Int64.zero.
Lemma denote_tc_nodivover_e64_ll:
forall i j m, app_pred (denote_tc_nodivover (Vlong i) (Vlong j)) m ->
~ (i =Int64.repr Int64.min_signed /\ j = Int64.mone).
Lemma denote_tc_nodivover_e64_il:
forall s i j m, app_pred (denote_tc_nodivover (Vint i) (Vlong j)) m ->
~ (cast_int_long s i = Int64.repr Int64.min_signed /\ j = Int64.mone).
Lemma alloc_variables_mem_step: forall cenv vars m e e2 m'
(M: alloc_variables cenv e m vars e2 m'), mem_step m m'.
Lemma assign_loc_mem_step g t m b z v m' (A:assign_loc g t m b z v m'):
mem_step m m'.
Lemma bind_parameters_mem_step: forall cenv e m pars vargs m'
(M: bind_parameters cenv e m pars vargs m'), semantics.mem_step m m'.
Lemma inline_assembly_memstep: forall text sg g vargs m t vres m' (IA:Events.inline_assembly_sem text sg g vargs m t vres m'),
mem_step m m'.
Lemma eqb_type_eq: forall t1 t2, eqb_type t1 t2 = proj_sumbool (type_eq t1 t2).
Lemma In_fst_split : forall A B i (l: list (A * B)), In i (fst (split l)) <-> exists b : B, In (i,b) l.
Definition tycontext_evolve (Delta Delta' : tycontext) :=
(forall id, match (temp_types Delta) ! id, (temp_types Delta') ! id with
| Some t, Some t' => t=t'
| None, None => True
| _, _ => False
end)
/\ (forall id, (var_types Delta) ! id = (var_types Delta') ! id)
/\ ret_type Delta = ret_type Delta'
/\ (forall id, (glob_types Delta) ! id = (glob_types Delta') ! id)
/\ (forall id, (glob_specs Delta) ! id = (glob_specs Delta') ! id)
/\ (forall id, (annotations Delta) ! id = (annotations Delta') ! id).
Lemma splitAndPad_v_to_sha_splitandpad_blocks l:
map Vector.to_list (splitAndPad_v l) = sha_splitandpad_blocks l.
Lemma splitAndPad_1to1 b1 b2 (B:splitAndPad_v b1 = splitAndPad_v b2)
(L1: NPeano.Nat.divide 8 (length b1))
(L2: NPeano.Nat.divide 8 (length b2)): b1 = b2.
Lemma Zland_15:
forall i, Z.land i 15 = i mod 16.
Lemma Znth_nthi:
forall i b,
(0 <= i < Zlength b)%Z -> Znth i b = nthi b i.
Lemma of_length_proof_irrel {A:Set} n (l: list A) M:
Vector.to_list (@of_list_length _ n l M) = l.
Lemma times2_equiv: forall b,
0 <= Int.unsigned b < 256 ->
times2 b = ff_mult (Int.repr 2) b.
Lemma split_quad_eq: forall {T : Type} (c0 c1 c2 c3 c0' c1' c2' c3' : T),
c0 = c0' -> c1 = c1' -> c2 = c2' -> c3 = c3' -> (c0, c1, c2, c3) = (c0', c1', c2', c3').
Lemma split_4eq: forall (T : Type) (c0 c1 c2 c3 c0' c1' c2' c3' : T),
(c0, c1, c2, c3) = (c0', c1', c2', c3') ->
c0 = c0' /\ c1 = c1' /\ c2 = c2' /\ c3 = c3'.
Lemma get_uint32_le_sublist: forall i l,
0 <= i <= Zlength l - 4 ->
get_uint32_le l i = get_uint32_le (sublist i (i+4) l) 0.
Lemma get_uint32_le_word_to_int: forall b0 b1 b2 b3,
get_uint32_le (map Int.unsigned [b0; b1; b2; b3]) 0 = word_to_int (b0, b1, b2, b3).
Lemma initial_round_equiv: forall S K,
(mbed_tls_initial_add_round_key
(map Int.unsigned (state_to_list S))
(map Int.unsigned (block_to_ints K))
) = state_to_four_ints (AddRoundKey S K).