(*(*
 * Vericert: Verified high-level synthesis.
 * Copyright (C) 2020 Yann Herklotz <yann@yannherklotz.com>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *)

(* begin hide *)
From bbv Require Import Word.
From bbv Require HexNotation WordScope.
From Coq Require Import ZArith.ZArith FSets.FMapPositive Lia.
From compcert Require Import lib.Integers common.Values.
From vericert Require Import Vericertlib.
(* end hide *)

(** * Value

A [value] is a bitvector with a specific size. We are using the implementation
of the bitvector by mit-plv/bbv, because it has many theorems that we can reuse.
However, we need to wrap it with an [Inductive] so that we can specify and match
on the size of the [value]. This is necessary so that we can easily store
[value]s of different sizes in a list or in a map.

Using the default [word], this would not be possible, as the size is part of the type. *)

Record value : Type :=
  mkvalue {
    vsize: nat;
    vword: word vsize
  }.

(** ** Value conversions

Various conversions to different number types such as [N], [Z], [positive] and
[int], where the last one is a theory of integers of powers of 2 in CompCert. *)

Definition wordToValue : forall sz : nat, word sz -> value := mkvalue.

Definition valueToWord : forall v : value, word (vsize v) := vword.

Definition valueToNat (v :value) : nat :=
  wordToNat (vword v).

Definition natToValue sz (n : nat) : value :=
  mkvalue sz (natToWord sz n).

Definition valueToN (v : value) : N :=
  wordToN (vword v).

Definition NToValue sz (n : N) : value :=
  mkvalue sz (NToWord sz n).

Definition ZToValue (s : nat) (z : Z) : value :=
  mkvalue s (ZToWord s z).

Definition valueToZ (v : value) : Z :=
  wordToZ (vword v).

Definition uvalueToZ (v : value) : Z :=
  uwordToZ (vword v).

Definition posToValue sz (p : positive) : value :=
  ZToValue sz (Zpos p).

Definition posToValueAuto (p : positive) : value :=
  let size := Pos.to_nat (Pos.size p) in
  ZToValue size (Zpos p).

Definition valueToPos (v : value) : positive :=
  Z.to_pos (uvalueToZ v).

Definition intToValue (i : Integers.int) : value :=
  ZToValue Int.wordsize (Int.unsigned i).

Definition valueToInt (i : value) : Integers.int :=
  Int.repr (uvalueToZ i).

Definition ptrToValue (i : Integers.ptrofs) : value :=
  ZToValue Ptrofs.wordsize (Ptrofs.unsigned i).

Definition valueToPtr (i : value) : Integers.ptrofs :=
  Ptrofs.repr (uvalueToZ i).

Definition valToValue (v : Values.val) : option value :=
  match v with
  | Values.Vint i => Some (intToValue i)
  | Values.Vptr b off => if Z.eqb (Z.modulo (uvalueToZ (ptrToValue off)) 4) 0%Z
                         then Some (ptrToValue off)
                         else None
  | Values.Vundef => Some (ZToValue 32 0%Z)
  | _ => None
  end.

(** Convert a [value] to a [bool], so that choices can be made based on the
result. This is also because comparison operators will give back [value] instead
of [bool], so if they are in a condition, they will have to be converted before
they can be used. *)

Definition valueToBool (v : value) : bool :=
  negb (weqb (@wzero (vsize v)) (vword v)).

Definition boolToValue (sz : nat) (b : bool) : value :=
  natToValue sz (if b then 1 else 0).

(** ** Arithmetic operations *)

Definition unify_word (sz1 sz2 : nat) (w1 : word sz2): sz1 = sz2 -> word sz1.
intros; subst; assumption. Defined.

Lemma unify_word_unfold :
  forall sz w,
  unify_word sz sz w eq_refl = w.
Proof. auto. Qed.

Definition value_eq_size:
  forall v1 v2 : value, { vsize v1 = vsize v2 } + { True }.
Proof.
  intros; destruct (Nat.eqb (vsize v1) (vsize v2)) eqn:?.
  left; apply Nat.eqb_eq in Heqb; assumption.
  right; trivial.
Defined.

Definition map_any {A : Type} (v1 v2 : value) (f : word (vsize v1) -> word (vsize v1) -> A)
           (EQ : vsize v1 = vsize v2) : A :=
    let w2 := unify_word (vsize v1) (vsize v2) (vword v2) EQ in
    f (vword v1) w2.

Definition map_any_opt {A : Type} (sz : nat) (v1 v2 : value) (f : word (vsize v1) -> word (vsize v1) -> A)
  : option A :=
  match value_eq_size v1 v2 with
  | left EQ =>
    Some (map_any v1 v2 f EQ)
  | _ => None
  end.

Definition map_word (f : forall sz : nat, word sz -> word sz) (v : value) : value :=
  mkvalue (vsize v) (f (vsize v) (vword v)).

Definition map_word2 (f : forall sz : nat, word sz -> word sz -> word sz) (v1 v2 : value)
           (EQ : (vsize v1 = vsize v2)) : value :=
    let w2 := unify_word (vsize v1) (vsize v2) (vword v2) EQ in
    mkvalue (vsize v1) (f (vsize v1) (vword v1) w2).

Definition map_word2_opt (f : forall sz : nat, word sz -> word sz -> word sz) (v1 v2 : value)
  : option value :=
  match value_eq_size v1 v2 with
  | left EQ => Some (map_word2 f v1 v2 EQ)
  | _ => None
  end.

Definition eq_to_opt (v1 v2 : value) (f : vsize v1 = vsize v2 -> value)
  : option value :=
  match value_eq_size v1 v2 with
  | left EQ => Some (f EQ)
  | _ => None
  end.

Lemma eqvalue {sz : nat} (x y : word sz) : x = y <-> mkvalue sz x = mkvalue sz y.
Proof.
  split; intros.
  subst. reflexivity. inversion H. apply existT_wordToZ in H1.
  apply wordToZ_inj. assumption.
Qed.

Lemma eqvaluef {sz : nat} (x y : word sz) : x = y -> mkvalue sz x = mkvalue sz y.
Proof. apply eqvalue. Qed.

Lemma nevalue {sz : nat} (x y : word sz) : x <> y <-> mkvalue sz x <> mkvalue sz y.
Proof. split; intros; intuition. apply H. apply eqvalue. assumption.
       apply H. rewrite H0. trivial.
Qed.

Lemma nevaluef {sz : nat} (x y : word sz) : x <> y -> mkvalue sz x <> mkvalue sz y.
Proof. apply nevalue. Qed.

(*Definition rewrite_word_size (initsz finalsz : nat) (w : word initsz)
  : option (word finalsz) :=
  match Nat.eqb initsz finalsz return option (word finalsz) with
  | true => Some _
  | false => None
  end.*)

Definition valueeq (sz : nat) (x y : word sz) :
  {mkvalue sz x = mkvalue sz y} + {mkvalue sz x <> mkvalue sz y} :=
  match weq x y with
  | left eq => left (eqvaluef x y eq)
  | right ne => right (nevaluef x y ne)
  end.

Definition valueeqb (x y : value) : bool :=
  match value_eq_size x y with
  | left EQ =>
    weqb (vword x) (unify_word (vsize x) (vsize y) (vword y) EQ)
  | right _ => false
  end.

Definition value_projZ_eqb (v1 v2 : value) : bool := Z.eqb (valueToZ v1) (valueToZ v2).

Theorem value_projZ_eqb_true :
  forall v1 v2,
  v1 = v2 -> value_projZ_eqb v1 v2 = true.
Proof. intros. subst. unfold value_projZ_eqb. apply Z.eqb_eq. trivial. Qed.

Theorem valueeqb_true_iff :
  forall v1 v2,
  valueeqb v1 v2 = true <-> v1 = v2.
Proof.
  split; intros.
  unfold valueeqb in H. destruct (value_eq_size v1 v2) eqn:?.
  - destruct v1, v2. simpl in H.
Abort.

Definition value_int_eqb (v : value) (i : int) : bool :=
  Z.eqb (valueToZ v) (Int.unsigned i).

(** Arithmetic operations over [value], interpreting them as signed or unsigned
depending on the operation.

The arithmetic operations over [word] are over [N] by default, however, can also
be called over [Z] explicitly, which is where the bits are interpreted in a
signed manner. *)

Definition vplus v1 v2 := map_word2 wplus v1 v2.
Definition vplus_opt v1 v2 := map_word2_opt wplus v1 v2.
Definition vminus v1 v2 := map_word2 wminus v1 v2.
Definition vmul v1 v2 := map_word2 wmult v1 v2.
Definition vdiv v1 v2 := map_word2 wdiv v1 v2.
Definition vmod v1 v2 := map_word2 wmod v1 v2.

Definition vmuls v1 v2 := map_word2 wmultZ v1 v2.
Definition vdivs v1 v2 := map_word2 wdivZ v1 v2.
Definition vmods v1 v2 := map_word2 wremZ v1 v2.

(** ** Bitwise operations

Bitwise operations over [value], which is independent of whether the number is
signed or unsigned. *)

Definition vnot v := map_word wnot v.
Definition vneg v := map_word wneg v.
Definition vbitneg v := boolToValue (vsize v) (negb (valueToBool v)).
Definition vor v1 v2 := map_word2 wor v1 v2.
Definition vand v1 v2 := map_word2 wand v1 v2.
Definition vxor v1 v2 := map_word2 wxor v1 v2.

(** ** Comparison operators

Comparison operators that return a bool, there should probably be an equivalent
which returns another number, however I might just add that as an explicit
conversion. *)

Definition veqb v1 v2 := map_any v1 v2 (@weqb (vsize v1)).
Definition vneb v1 v2 EQ := negb (veqb v1 v2 EQ).

Definition veq v1 v2 EQ := boolToValue (vsize v1) (veqb v1 v2 EQ).
Definition vne v1 v2 EQ := boolToValue (vsize v1) (vneb v1 v2 EQ).

Definition vltb v1 v2 := map_any v1 v2 wltb.
Definition vleb v1 v2 EQ := negb (map_any v2 v1 wltb (eq_sym EQ)).
Definition vgtb v1 v2 EQ := map_any v2 v1 wltb (eq_sym EQ).
Definition vgeb v1 v2 EQ := negb (map_any v1 v2 wltb EQ).

Definition vltsb v1 v2 := map_any v1 v2 wsltb.
Definition vlesb v1 v2 EQ := negb (map_any v2 v1 wsltb (eq_sym EQ)).
Definition vgtsb v1 v2 EQ := map_any v2 v1 wsltb (eq_sym EQ).
Definition vgesb v1 v2 EQ := negb (map_any v1 v2 wsltb EQ).

Definition vlt v1 v2 EQ := boolToValue (vsize v1) (vltb v1 v2 EQ).
Definition vle v1 v2 EQ := boolToValue (vsize v1) (vleb v1 v2 EQ).
Definition vgt v1 v2 EQ := boolToValue (vsize v1) (vgtb v1 v2 EQ).
Definition vge v1 v2 EQ := boolToValue (vsize v1) (vgeb v1 v2 EQ).

Definition vlts v1 v2 EQ := boolToValue (vsize v1) (vltsb v1 v2 EQ).
Definition vles v1 v2 EQ := boolToValue (vsize v1) (vlesb v1 v2 EQ).
Definition vgts v1 v2 EQ := boolToValue (vsize v1) (vgtsb v1 v2 EQ).
Definition vges v1 v2 EQ := boolToValue (vsize v1) (vgesb v1 v2 EQ).

(** ** Shift operators

Shift operators on values. *)

Definition shift_map (sz : nat) (f : word sz -> nat -> word sz) (w1 w2 : word sz) :=
  f w1 (wordToNat w2).

Definition vshl v1 v2 := map_word2 (fun sz => shift_map sz (@wlshift sz)) v1 v2.
Definition vshr v1 v2 := map_word2 (fun sz => shift_map sz (@wrshift sz)) v1 v2.

Module HexNotationValue.
  Export HexNotation.
  Import WordScope.

  Notation "sz ''h' a" := (NToValue sz (hex a)) (at level 50).

End HexNotationValue.

Inductive val_value_lessdef: val -> value -> Prop :=
| val_value_lessdef_int:
    forall i v',
    i = valueToInt v' ->
    val_value_lessdef (Vint i) v'
| val_value_lessdef_ptr:
    forall b off v',
    off = valueToPtr v' ->
    (Z.modulo (uvalueToZ v') 4) = 0%Z ->
    val_value_lessdef (Vptr b off) v'
| lessdef_undef: forall v, val_value_lessdef Vundef v.

Inductive opt_val_value_lessdef: option val -> value -> Prop :=
| opt_lessdef_some:
    forall v v', val_value_lessdef v v' -> opt_val_value_lessdef (Some v) v'
| opt_lessdef_none: forall v, opt_val_value_lessdef None v.

Lemma valueToZ_ZToValue :
  forall n z,
  (- Z.of_nat (2 ^ n) <= z < Z.of_nat (2 ^ n))%Z ->
  valueToZ (ZToValue (S n) z) = z.
Proof.
  unfold valueToZ, ZToValue. simpl.
  auto using wordToZ_ZToWord.
Qed.

Lemma uvalueToZ_ZToValue :
  forall n z,
  (0 <= z < 2 ^ Z.of_nat n)%Z ->
  uvalueToZ (ZToValue n z) = z.
Proof.
  unfold uvalueToZ, ZToValue. simpl.
  auto using uwordToZ_ZToWord.
Qed.

Lemma uvalueToZ_ZToValue_full :
  forall sz : nat,
  (0 < sz)%nat ->
  forall z : Z, uvalueToZ (ZToValue sz z) = (z mod 2 ^ Z.of_nat sz)%Z.
Proof. unfold uvalueToZ, ZToValue. simpl. auto using uwordToZ_ZToWord_full. Qed.

Lemma ZToValue_uvalueToZ :
  forall v,
  ZToValue (vsize v) (uvalueToZ v) = v.
Proof.
  intros.
  unfold ZToValue, uvalueToZ.
  rewrite ZToWord_uwordToZ. destruct v; auto.
Qed.

Lemma valueToPos_posToValueAuto :
  forall p, valueToPos (posToValueAuto p) = p.
Proof.
  intros. unfold valueToPos, posToValueAuto.
  rewrite uvalueToZ_ZToValue. auto. rewrite positive_nat_Z.
  split. apply Zle_0_pos.

  assert (p < 2 ^ (Pos.size p))%positive by apply Pos.size_gt.
  inversion H. rewrite <- Z.compare_lt_iff. rewrite <- H1.
  simpl. rewrite <- Pos2Z.inj_pow_pos. trivial.
Qed.

Lemma valueToPos_posToValue :
  forall p, valueToPos (posToValueAuto p) = p.
Proof.
  intros. unfold valueToPos, posToValueAuto.
  rewrite uvalueToZ_ZToValue. auto. rewrite positive_nat_Z.
  split. apply Zle_0_pos.

  assert (p < 2 ^ (Pos.size p))%positive by apply Pos.size_gt.
  inversion H. rewrite <- Z.compare_lt_iff. rewrite <- H1.
  simpl. rewrite <- Pos2Z.inj_pow_pos. trivial.
Qed.

Lemma valueToInt_intToValue :
  forall v,
  valueToInt (intToValue v) = v.
Proof.
  intros.
  unfold valueToInt, intToValue. rewrite uvalueToZ_ZToValue. auto using Int.repr_unsigned.
  split. apply Int.unsigned_range_2.
  assert ((Int.unsigned v <= Int.max_unsigned)%Z) by apply Int.unsigned_range_2.
  apply Z.lt_le_pred in H. apply H.
Qed.

Lemma valueToPtr_ptrToValue :
  forall v,
  valueToPtr (ptrToValue v) = v.
Proof.
  intros.
  unfold valueToPtr, ptrToValue. rewrite uvalueToZ_ZToValue. auto using Ptrofs.repr_unsigned.
  split. apply Ptrofs.unsigned_range_2.
  assert ((Ptrofs.unsigned v <= Ptrofs.max_unsigned)%Z) by apply Ptrofs.unsigned_range_2.
  apply Z.lt_le_pred in H. apply H.
Qed.

Lemma intToValue_valueToInt :
  forall v,
  vsize v = 32%nat ->
  intToValue (valueToInt v) = v.
Proof.
  intros. unfold valueToInt, intToValue. rewrite Int.unsigned_repr_eq.
  unfold ZToValue, uvalueToZ. unfold Int.modulus. unfold Int.wordsize. unfold Wordsize_32.wordsize.
  pose proof (uwordToZ_bound (vword v)).
  rewrite Z.mod_small. rewrite <- H. rewrite ZToWord_uwordToZ. destruct v; auto.
  rewrite <- H. rewrite two_power_nat_equiv. apply H0.
Qed.

Lemma ptrToValue_valueToPtr :
  forall v,
  vsize v = 32%nat ->
  ptrToValue (valueToPtr v) = v.
Proof.
  intros. unfold valueToPtr, ptrToValue. rewrite Ptrofs.unsigned_repr_eq.
  unfold ZToValue, uvalueToZ. unfold Ptrofs.modulus. unfold Ptrofs.wordsize. unfold Wordsize_Ptrofs.wordsize.
  pose proof (uwordToZ_bound (vword v)).
  rewrite Z.mod_small. rewrite <- H. rewrite ZToWord_uwordToZ. destruct v; auto.
  rewrite <- H. rewrite two_power_nat_equiv. apply H0.
Qed.

Lemma valToValue_lessdef :
  forall v v',
    valToValue v = Some v' ->
    val_value_lessdef v v'.
Proof.
  intros.
  destruct v; try discriminate; constructor.
  unfold valToValue in H. inversion H.
  symmetry. apply valueToInt_intToValue.
  inv H. destruct (uvalueToZ (ptrToValue i) mod 4 =? 0); try discriminate.
  inv H1. symmetry. apply valueToPtr_ptrToValue.
  inv H. destruct (uvalueToZ (ptrToValue i) mod 4 =? 0) eqn:?; try discriminate.
  inv H1. apply Z.eqb_eq. apply Heqb0.
Qed.

Lemma boolToValue_ValueToBool :
  forall b,
  valueToBool (boolToValue 32 b) = b.
Proof. destruct b; auto. Qed.

Local Open Scope Z.

Ltac word_op_value H :=
  intros; unfold uvalueToZ, ZToValue; simpl; rewrite unify_word_unfold;
  rewrite <- H; rewrite uwordToZ_ZToWord_full; auto; omega.

Lemma zadd_vplus :
  forall sz z1 z2,
  (sz > 0)%nat ->
  uvalueToZ (vplus (ZToValue sz z1) (ZToValue sz z2) eq_refl) = (z1 + z2) mod 2 ^ Z.of_nat sz.
Proof. word_op_value ZToWord_plus. Qed.

Lemma zadd_vplus2 :
  forall z1 z2,
  vplus (ZToValue 32 z1) (ZToValue 32 z2) eq_refl = ZToValue 32 (z1 + z2).
Proof.
  intros. unfold vplus, ZToValue, map_word2. rewrite unify_word_unfold. simpl.
  rewrite ZToWord_plus; auto.
Qed.

Lemma ZToValue_eq :
  forall w1,
  (mkvalue 32 w1) = (ZToValue 32 (wordToZ w1)). Abort.

Lemma wordsize_32 :
  Int.wordsize = 32%nat.
Proof. auto. Qed.

Lemma intadd_vplus :
  forall i1 i2,
  valueToInt (vplus (intToValue i1) (intToValue i2) eq_refl) = Int.add i1 i2.
Proof.
  intros. unfold Int.add, valueToInt, intToValue. rewrite zadd_vplus.
  rewrite <- Int.unsigned_repr_eq.
  rewrite Int.repr_unsigned. auto. rewrite wordsize_32. omega.
Qed.

(*Lemma intadd_vplus2 :
  forall v1 v2 EQ,
  vsize v1 = 32%nat ->
  Int.add (valueToInt v1) (valueToInt v2) = valueToInt (vplus v1 v2 EQ).
Proof.
  intros. unfold Int.add, valueToInt, intToValue. repeat (rewrite Int.unsigned_repr).
  rewrite (@vadd_vplus v1 v2 EQ). trivial.
  unfold uvalueToZ. pose proof (@uwordToZ_bound (vsize v2) (vword v2)).
  rewrite H in EQ. rewrite <- EQ in H0 at 3.*)
  (*rewrite zadd_vplus3. trivia*)

Lemma valadd_vplus :
  forall v1 v2 v1' v2' v v' EQ,
  val_value_lessdef v1 v1' ->
  val_value_lessdef v2 v2' ->
  Val.add v1 v2 = v ->
  vplus v1' v2' EQ = v' ->
  val_value_lessdef v v'.
Proof.
  intros. inv H; inv H0; constructor; simplify.
  Abort.

Lemma zsub_vminus :
  forall sz z1 z2,
  (sz > 0)%nat ->
  uvalueToZ (vminus (ZToValue sz z1) (ZToValue sz z2) eq_refl) = (z1 - z2) mod 2 ^ Z.of_nat sz.
Proof. word_op_value ZToWord_minus. Qed.

Lemma zmul_vmul :
  forall sz z1 z2,
  (sz > 0)%nat ->
  uvalueToZ (vmul (ZToValue sz z1) (ZToValue sz z2) eq_refl) = (z1 * z2) mod 2 ^ Z.of_nat sz.
Proof. word_op_value ZToWord_mult. Qed.

Local Open Scope N.
Lemma zdiv_vdiv :
  forall n1 n2,
  n1 < 2 ^ 32 ->
  n2 < 2 ^ 32 ->
  n1 / n2 < 2 ^ 32 ->
  valueToN (vdiv (NToValue 32 n1) (NToValue 32 n2) eq_refl) = n1 / n2.
Proof.
  intros; unfold valueToN, NToValue; simpl; rewrite unify_word_unfold. unfold wdiv.
  unfold wordBin. repeat (rewrite wordToN_NToWord_2); auto.
Qed.

Lemma ZToValue_valueToNat :
  forall x sz,
  (sz > 0)%nat ->
  (0 <= x < 2^(Z.of_nat sz))%Z ->
  valueToNat (ZToValue sz x) = Z.to_nat x.
Proof.
  destruct x; intros; unfold ZToValue, valueToNat; crush.
  - rewrite wzero'_def. apply wordToNat_wzero.
  - rewrite posToWord_nat. rewrite wordToNat_natToWord_2. trivial.
    clear H1.
    lazymatch goal with
    | [ H : context[(_ < ?x)%Z] |- _ ] => replace x with (Z.of_nat (Z.to_nat x)) in H
    end.
    2: { apply Z2Nat.id; apply Z.pow_nonneg; lia. }

    rewrite Z2Nat.inj_pow in H2; crush.
    replace (Pos.to_nat 2) with 2%nat in H2 by reflexivity.
    rewrite Nat2Z.id in H2.
    rewrite <- positive_nat_Z in H2.
    apply Nat2Z.inj_lt in H2.
    assumption.
Qed.
*)