***********************************************************************
*                                                                     *
*            The CertiKOS Certified Kit Operating System              *
*                                                                     *
*                   The FLINT Group, Yale University                  *
*                                                                     *
*  Copyright The FLINT Group, Yale University.  All rights reserved.  *
*  This file is distributed under the terms of the Yale University    *
*  Non-Commercial License Agreement.                                  *
*                                                                     *
*********************************************************************** 

Require Import Coqlib.
Require Import Errors.
Require Import AST.
Require Import Integers.
Require Import Floats.
Require Import Op.
Require Import Asm.
Require Import Events.
Require Import Globalenvs.
Require Import Smallstep.
Require Import Values.
Require Import Memory.
Require Import Maps.
Require Import AuxLemma.
Require Import FlatMemory.
Require Import AuxStateDataType.
Require Import Constant.
Require Import GlobIdent.
Require Import RealParams.
Require Import AsmImplLemma.
Require Import GenSem.
Require Import PrimSemantics.

Require Import liblayers.logic.PTreeModules.
Require Import liblayers.logic.LayerLogicImpl.
Require Import liblayers.compcertx.Stencil.
Require Import liblayers.compcertx.MakeProgram.
Require Import liblayers.compat.CompatLayers.
Require Import liblayers.compat.CompatGenSem.
Require Import compcert.cfrontend.Ctypes.

Require Import AbstractDataType.
Require Import DAbsHandler.

Local Open Scope string_scope.
Local Open Scope error_monad_scope.
Local Open Scope Z_scope.

Section CONTAINERGEN_DEFINE.

  Context `{real_params: RealParams}.

  Notation LDATAOps := (cdata RData).

  Definition QUOTA := 0.
  Definition USAGE := 4.
  Definition PARENT := 8.
  Definition NCHILDREN := 12.
  Definition USED := 16.
  Definition CSIZE := 20.

  Inductive container_init_low_step `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}:
    sextcall_sem (mem := mwd LDATAOps) :=
  | container_init_low_intro s (WB: _ → Prop) (m m´ m1 m2 m3 m4: mem) labd labd´ b0 mbi:
      bootloader0_spec (Int.unsigned mbi) labd = Some labd´ →
      find_symbol s AC_LOC = Some b0 →
      Mem.store Mint32 m b0 QUOTA (Vint (Int.repr root_quota)) = Some m1 →
      Mem.store Mint32 m1 b0 USAGE (Vint Int.zero) = Some m2 →
      Mem.store Mint32 m2 b0 PARENT (Vint Int.zero) = Some m3 →
      Mem.store Mint32 m3 b0 NCHILDREN (Vint Int.zero) = Some m4 →
      Mem.store Mint32 m4 b0 USED (Vint Int.one) = Some m´ →
      kernel_mode labd →
      container_init_low_step s WB (Vint mbi :: nil) (m,labd) Vundef (m´,labd´).

  Inductive container_get_parent_low_step `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}:
    sextcall_sem (mem := mwd LDATAOps) :=
  | container_get_parent_low_intro s (WB: _ → Prop) (m´0: mwd LDATAOps) b0 i v:
      find_symbol s AC_LOC = Some b0 →
      Mem.load Mint32 m´0 b0 (Int.unsigned i × CSIZE + PARENT) = Some (Vint v) →
      0 ≤ Int.unsigned i < num_id →
      kernel_mode (snd m´0) →
      container_get_parent_low_step s WB (Vint i :: nil) m´0 (Vint v) m´0.

  Inductive container_get_quota_low_step `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}:
    sextcall_sem (mem := mwd LDATAOps) :=
  | container_get_quota_low_intro s (WB: _ → Prop) (m´0: mwd LDATAOps) b0 i v:
      find_symbol s AC_LOC = Some b0 →
      Mem.load Mint32 m´0 b0 (Int.unsigned i × CSIZE + QUOTA) = Some (Vint v) →
      0 ≤ Int.unsigned i < num_id →
      kernel_mode (snd m´0) →
      container_get_quota_low_step s WB (Vint i :: nil) m´0 (Vint v) m´0.

  Inductive container_get_usage_low_step `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}:
    sextcall_sem (mem := mwd LDATAOps) :=
  | container_get_usage_low_intro s (WB: _ → Prop) (m´0: mwd LDATAOps) b0 i v:
      find_symbol s AC_LOC = Some b0 →
      Mem.load Mint32 m´0 b0 (Int.unsigned i × CSIZE + USAGE) = Some (Vint v) →
      0 ≤ Int.unsigned i < num_id →
      kernel_mode (snd m´0) →
      container_get_usage_low_step s WB (Vint i :: nil) m´0 (Vint v) m´0.

  Inductive container_can_consume_low_step `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}:
    sextcall_sem (mem := mwd LDATAOps) :=
  | container_can_consume_low_intro s (WB: _ → Prop) (m´0: mwd LDATAOps) b0 i n q u:
      find_symbol s AC_LOC = Some b0 →
      Mem.load Mint32 m´0 b0 (Int.unsigned i × CSIZE + QUOTA) = Some (Vint q) →
      Mem.load Mint32 m´0 b0 (Int.unsigned i × CSIZE + USAGE) = Some (Vint u) →
      0 ≤ Int.unsigned i < num_id →
      kernel_mode (snd m´0) →
      container_can_consume_low_step s WB (Vint i :: Vint n :: nil) m´0
        (Vint (match (Int.unsigned n <=? Int.unsigned q,
                      Int.unsigned u <=? Int.unsigned q - Int.unsigned n) with
               | (true, true) ⇒ Int.one
               | _ ⇒ Int.zero end)) m´0.

  Definition is_unused_low `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}
     (m: mwd LDATAOps) (b: block) (i: Z) : bool :=
      match Mem.load Mint32 m b (i × CSIZE + USED) with
      | Some (Vint v) ⇒ Int.eq_dec v Int.zero
      | _ ⇒ false
      end.

  Definition container_first_unused_low `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}
    (m: mwd LDATAOps) (b : block) (size: Z) :
      {iii | 0 < iii < size ∧ is_unused_low m b iii = true ∧
           ∀ x, 0 < x < iii → is_unused_low m b x ≠ true} +
      {∀ x, 0 < x < size → is_unused_low m b x ≠ true}.
  Proof.
    apply min_ex; intros.
    destruct (is_unused_low m b n); [left; auto | right; discriminate].
  Defined.

  Inductive container_split_low_step `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}:
    sextcall_sem (mem := mwd LDATAOps) :=
  | container_split_low_step_intro s (WB: _ → Prop) (m m´ m1 m2 m3 m4 m5 m6: mwd LDATAOps)
                                   b0 i n j u nc:
      find_symbol s AC_LOC = Some b0 →
      0 ≤ Int.unsigned i < num_id → 0 ≤ Int.unsigned j < num_id →
      Mem.load Mint32 m b0 (Int.unsigned i × CSIZE + USED) = Some (Vint Int.one) →
      Mem.load Mint32 m b0 (Int.unsigned j × CSIZE + USED) = Some (Vint Int.zero) →
      Mem.load Mint32 m b0 (Int.unsigned i × CSIZE + USAGE) = Some (Vint u) →
      Mem.load Mint32 m b0 (Int.unsigned i × CSIZE + NCHILDREN) = Some (Vint nc) →
      Mem.store Mint32 m b0 (Int.unsigned j × CSIZE + USED) (Vint Int.one) = Some m1 →
      Mem.store Mint32 m1 b0 (Int.unsigned j × CSIZE + QUOTA) (Vint n) = Some m2 →
      Mem.store Mint32 m2 b0 (Int.unsigned j × CSIZE + USAGE) (Vint Int.zero) = Some m3 →
      Mem.store Mint32 m3 b0 (Int.unsigned j × CSIZE + PARENT) (Vint i) = Some m4 →
      Mem.store Mint32 m4 b0 (Int.unsigned j × CSIZE + NCHILDREN) (Vint Int.zero) = Some m5 →
      Mem.store Mint32 m5 b0 (Int.unsigned i × CSIZE + USAGE) (Vint (Int.add u n)) = Some m6 →
      Mem.store Mint32 m6 b0 (Int.unsigned i × CSIZE + NCHILDREN) (Vint (Int.add nc Int.one)) = Some m´ →
      kernel_mode (snd m) →
      container_split_low_step s WB (Vint i :: Vint n :: Vint j :: nil) m (Vint j) m´.



  Inductive container_alloc_low_step `{StencilOps} `{Mem.MemoryModelOps} `{UseMemWithData mem}:
    sextcall_sem (mem := mwd LDATAOps) :=
  | container_alloc_low_step_intro0 s (WB: _ → Prop) (m: mwd LDATAOps) b0 i u:
      find_symbol s AC_LOC = Some b0 →
      0 ≤ Int.unsigned i < num_id →
      Mem.load Mint32 m b0 (Int.unsigned i × CSIZE + USAGE) = Some (Vint u) →
      Mem.load Mint32 m b0 (Int.unsigned i × CSIZE + QUOTA) = Some (Vint u) →
      kernel_mode (snd m) →
      container_alloc_low_step s WB (Vint i :: nil) m Vzero m
  | container_alloc_low_step_intro1 s (WB: _ → Prop) (m m´: mwd LDATAOps) b0 i u q:
      find_symbol s AC_LOC = Some b0 →
      0 ≤ Int.unsigned i < num_id → Int.unsigned u < Int.unsigned q →
      Mem.load Mint32 m b0 (Int.unsigned i × CSIZE + USAGE) = Some (Vint u) →
      Mem.load Mint32 m b0 (Int.unsigned i × CSIZE + QUOTA) = Some (Vint q) →
      Mem.store Mint32 m b0 (Int.unsigned i × CSIZE + USAGE) (Vint (Int.add u Int.one)) = Some m´ →
      kernel_mode (snd m) →
      container_alloc_low_step s WB (Vint i :: nil) m Vone m´.


  Section WITHMEM.

    Context `{Hstencil: Stencil}.
    Context `{Hmem: Mem.MemoryModel}.
    Context `{Hmwd: UseMemWithData mem}.

    Definition container_init_spec_low: compatsem LDATAOps :=
      csem container_init_low_step (type_of_list_type (Tint32::nil)) Tvoid.

    Definition container_get_parent_spec_low: compatsem LDATAOps :=
      csem container_get_parent_low_step (type_of_list_type (Tint32::nil)) Tint32.

    Definition container_get_quota_spec_low: compatsem LDATAOps :=
      csem container_get_quota_low_step (type_of_list_type (Tint32::nil)) Tint32.

    Definition container_get_usage_spec_low: compatsem LDATAOps :=
      csem container_get_usage_low_step (type_of_list_type (Tint32::nil)) Tint32.

    Definition container_can_consume_spec_low: compatsem LDATAOps :=
      csem container_can_consume_low_step (type_of_list_type (Tint32::Tint32::nil)) Tint32.

    Definition container_split_spec_low: compatsem LDATAOps :=
      csem container_split_low_step (type_of_list_type (Tint32::Tint32::Tint32::nil)) Tint32.


    Definition container_alloc_spec_low: compatsem LDATAOps :=
      csem container_alloc_low_step (type_of_list_type (Tint32::nil)) Tint32.


  End WITHMEM.

End CONTAINERGEN_DEFINE.