-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathWellFormed2.v
2884 lines (2829 loc) · 114 KB
/
WellFormed2.v
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
From Coq Require Import Lists.List.
From Coq Require Import Bool.Bool.
From Coq Require Import FSets.FMapList.
From Coq Require Import FSets.FMapFacts.
From Coq Require Import Init.Nat.
From Coq Require Import Structures.OrderedTypeEx.
Require Import RuntimeDefinitions.
Require Import AppendixD.
Require Import AppendixC.
Require Import AppendixF.
Require Import AppendixE.
Require Import Semantics.
Require Import MLCOperations.
Require Import WellFormed.
Require Import WellFormedEnclaveState.
Module NatMapFacts := NatMapProperties.F.
Module CacheletMapFacts := CacheletMapProperties.F.
(* Disjoint VPT (used in wf3) *)
Definition disjoint_VPT (V: VPT): Prop :=
forall e ranV, NatMap.find e V = Some ranV ->
(forall e' ranV', e <> e' -> NatMap.find e' V = Some ranV' ->
(forall c, In c ranV -> ~In c ranV') /\ (forall c, In c ranV' -> ~In c ranV)).
Lemma disjoint_VPT_remove : forall r V,
disjoint_VPT V -> disjoint_VPT (NatMap.remove r V).
Proof.
intros.
unfold disjoint_VPT in *; intros.
assert (NatMap.find (elt:=remapping_list) r (NatMap.remove r V) = None).
apply NatMapFacts.remove_eq_o; reflexivity.
case_eq (eqb e r); intros.
apply cmp_to_eq in H4; subst.
rewrite -> H0 in H3; discriminate.
case_eq (eqb e' r); intros.
apply cmp_to_eq in H5; subst.
rewrite -> H2 in H3; discriminate.
apply cmp_to_uneq in H4, H5.
assert (NatMap.find (elt:=remapping_list) e (NatMap.remove r V) = NatMap.find e V).
apply NatMapFacts.remove_neq_o; apply not_eq_sym; exact H4.
assert (NatMap.find (elt:=remapping_list) e' (NatMap.remove r V) = NatMap.find e' V).
apply NatMapFacts.remove_neq_o; apply not_eq_sym; exact H5.
rewrite -> H0 in H6; rewrite -> H2 in H7; apply eq_sym in H6, H7.
specialize (H e ranV H6 e' ranV' H1 H7).
exact H.
Qed.
Lemma disjoint_VPT_add : forall r V q l,
NatMap.find r V = Some (q :: l) ->
disjoint_VPT V -> disjoint_VPT (NatMap.add r l V).
Proof.
intros.
unfold disjoint_VPT in *; intros.
case_eq (eqb e r); case_eq (eqb e' r); intros.
apply cmp_to_eq in H4, H5; subst.
unfold not in H2; destruct H2; reflexivity.
apply cmp_to_uneq in H4; apply cmp_to_eq in H5; subst.
assert (NatMap.find (elt:=remapping_list) r (NatMap.add r l V) = Some l).
apply NatMapFacts.add_eq_o; reflexivity.
assert (NatMap.find (elt:=remapping_list) e' (NatMap.add r l V)
= NatMap.find (elt:=remapping_list) e' V).
apply NatMapFacts.add_neq_o; exact H2.
rewrite -> H1 in H5; injection H5; intros; subst.
rewrite -> H3 in H6; apply eq_sym in H6.
specialize (H0 r (q :: l) H e' ranV' H2 H6); destruct H0.
split; intros.
apply (in_cons q c l) in H8. apply H0 in H8. exact H8.
apply H7 in H8. intros contra. apply (in_cons q c l) in contra.
apply H8 in contra. exact contra.
apply cmp_to_uneq in H5; apply cmp_to_eq in H4; subst.
assert (NatMap.find (elt:=remapping_list) r (NatMap.add r l V) = Some l).
apply NatMapFacts.add_eq_o; reflexivity.
assert (NatMap.find (elt:=remapping_list) e (NatMap.add r l V)
= NatMap.find (elt:=remapping_list) e V).
apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H2.
rewrite -> H3 in H4; injection H4; intros; subst.
rewrite -> H1 in H6; apply eq_sym in H6.
specialize (H0 e ranV H6 r (q :: l) H2 H); destruct H0.
split; intros.
apply H0 in H8. intros contra. apply (in_cons q c l) in contra.
apply H8 in contra. exact contra.
apply (in_cons q c l) in H8. apply H7 in H8. exact H8.
apply cmp_to_uneq in H4, H5.
assert (NatMap.find (elt:=remapping_list) e (NatMap.add r l V)
= NatMap.find (elt:=remapping_list) e V).
apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H5.
assert (NatMap.find (elt:=remapping_list) e' (NatMap.add r l V)
= NatMap.find (elt:=remapping_list) e' V).
apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H4.
rewrite -> H1 in H6; rewrite -> H3 in H7; apply eq_sym in H6, H7.
apply (H0 e ranV H6 e' ranV' H2 H7).
Qed.
Lemma disjoint_VPT_add2 : forall r V q l,
NatMap.find r V = Some l ->
(forall e l', NatMap.find e V = Some l' -> ~In q l') ->
disjoint_VPT V -> disjoint_VPT (NatMap.add r (q :: l) V).
Proof.
intros.
unfold disjoint_VPT in *; intros.
case_eq (eqb e r); case_eq (eqb e' r); intros.
apply cmp_to_eq in H5, H6; subst.
assert (r = r). reflexivity. apply H3 in H5. destruct H5.
apply cmp_to_eq in H6. apply cmp_to_uneq in H5. subst e.
assert (Some ranV = Some (q :: l)).
rewrite <- H2. apply NatMapFacts.add_eq_o; reflexivity.
injection H6; intros; subst.
assert (NatMap.find (elt:=remapping_list) e' V = Some ranV').
apply eq_sym. rewrite <- H4. apply NatMapFacts.add_neq_o; exact H3.
split; intros. intros contra. apply in_inv in H8. destruct H8. subst.
specialize (H0 e' ranV' H7). apply H0 in contra. exact contra.
specialize (H1 r l H e' ranV' H3 H7). destruct H1. apply H1 in H8.
apply H8 in contra. exact contra.
intros contra. apply in_inv in contra. destruct contra. subst.
specialize (H0 e' ranV' H7). apply H0 in H8. exact H8.
specialize (H1 r l H e' ranV' H3 H7). destruct H1. apply H1 in H9.
apply H9 in H8. exact H8.
apply cmp_to_uneq in H6. apply cmp_to_eq in H5. subst e'.
assert (Some ranV' = Some (q :: l)).
rewrite <- H4. apply NatMapFacts.add_eq_o; reflexivity.
injection H5; intros; subst.
assert (NatMap.find (elt:=remapping_list) e V = Some ranV).
apply eq_sym. rewrite <- H2. apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H3.
split; intros. intros contra. apply in_inv in contra. destruct contra. subst.
specialize (H0 e ranV H7). apply H0 in H8. exact H8.
specialize (H1 e ranV H7 r l H3 H). destruct H1. apply H1 in H8.
apply H8 in H9. exact H9.
intros contra. apply in_inv in H8. destruct H8. subst.
specialize (H0 e ranV H7). apply H0 in contra. exact contra.
specialize (H1 e ranV H7 r l H3 H). destruct H1. apply H9 in H8.
apply H8 in contra. exact contra.
apply cmp_to_uneq in H5, H6.
assert (NatMap.find e V = Some ranV). apply eq_sym.
rewrite <- H2. apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H6.
assert (NatMap.find e' V = Some ranV'). apply eq_sym.
rewrite <- H4. apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H5.
specialize (H1 e ranV H7 e' ranV' H3 H8). destruct H1.
split; intros.
apply H1. exact H10.
apply H9. exact H10.
Qed.
Lemma disjoint_VPT_add_none : forall r V q,
NatMap.find r V = None ->
(forall e l', NatMap.find e V = Some l' -> ~In q l') ->
disjoint_VPT V -> disjoint_VPT (NatMap.add r (q :: nil) V).
Proof.
intros.
unfold disjoint_VPT in *; intros.
case_eq (eqb e r); case_eq (eqb e' r); intros.
apply cmp_to_eq in H5, H6; subst.
assert (r = r). reflexivity. apply H3 in H5. destruct H5.
apply cmp_to_eq in H6. apply cmp_to_uneq in H5. subst e.
assert (Some ranV = Some (q :: nil)).
rewrite <- H2. apply NatMapFacts.add_eq_o; reflexivity.
injection H6; intros; subst.
assert (NatMap.find (elt:=remapping_list) e' V = Some ranV').
apply eq_sym. rewrite <- H4. apply NatMapFacts.add_neq_o; exact H3.
split; intros. intros contra. apply in_inv in H8. destruct H8. subst.
specialize (H0 e' ranV' H7). apply H0 in contra. exact contra.
unfold In in H8. exact H8.
intros contra. apply in_inv in contra. destruct contra. subst.
specialize (H0 e' ranV' H7). apply H0 in H8. exact H8.
unfold In in H9. exact H9.
apply cmp_to_uneq in H6. apply cmp_to_eq in H5. subst e'.
assert (Some ranV' = Some (q :: nil)).
rewrite <- H4. apply NatMapFacts.add_eq_o; reflexivity.
injection H5; intros; subst.
assert (NatMap.find (elt:=remapping_list) e V = Some ranV).
apply eq_sym. rewrite <- H2. apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H3.
split; intros. intros contra. apply in_inv in contra. destruct contra. subst.
specialize (H0 e ranV H7). apply H0 in H8. exact H8.
unfold In in H9. exact H9.
intros contra. apply in_inv in H8. destruct H8. subst.
specialize (H0 e ranV H7). apply H0 in contra. exact contra.
unfold In in H8. exact H8.
apply cmp_to_uneq in H5, H6.
assert (NatMap.find e V = Some ranV). apply eq_sym.
rewrite <- H2. apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H6.
assert (NatMap.find e' V = Some ranV'). apply eq_sym.
rewrite <- H4. apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H5.
specialize (H1 e ranV H7 e' ranV' H3 H8). destruct H1.
split; intros.
apply H1. exact H10.
apply H9. exact H10.
Qed.
(* Well-Formed 3 *)
Definition wf3 (sigma: runtime_state): Prop :=
(forall k mu rho pi lambda F V C R,
(sigma = runtime_state_value k mu rho pi) ->
(NatMap.find lambda k = Some (single_level_cache F V C R)) ->
(forall e ranV, NatMap.find e V = Some ranV -> (forall c, In c ranV -> ~In c F) /\ (forall c, In c F -> ~In c ranV) /\ NoDup(ranV))
/\ NoDup(F) /\ disjoint_VPT(V)).
(* WF3 MLC Read *)
Lemma mlc_read_v : forall lambda h_tree k e' m0 l0 D obs1 mu k' index F V C R F' V' C' R',
well_defined_cache_tree h_tree ->
mlc_read k e' m0 l0 lambda h_tree = mlc_read_valid D obs1 mu k' ->
NatMap.find index k = Some (single_level_cache F V C R) ->
NatMap.find index k' = Some (single_level_cache F' V' C' R') ->
V = V'.
Proof.
unfold mlc_read.
intros lambda h_tree.
case_eq (get_cache_ID_path lambda h_tree).
intros l.
generalize dependent lambda.
induction l.
{
intros.
unfold recursive_mlc_read in H1.
destruct l0. destruct (NatMap.find b m0).
injection H1; intros; subst.
rewrite -> H2 in H3.
injection H3; intros; subst F' V' C' R'.
reflexivity.
discriminate.
}
{
intros.
unfold recursive_mlc_read in H1.
fold recursive_mlc_read in H1.
case_eq (NatMap.find a k). intros.
assert (A0 := H4). destruct (NatMap.find a k) in A0, H1.
injection A0; intros; subst s0.
case_eq (cc_hit_read s e' l0). intros.
assert (A1 := H5). destruct (cc_hit_read s e' l0) in A1, H1.
injection A1; injection H1; intros; subst; clear A0 A1.
destruct s; destruct s0.
apply (cc_hit_read_v (single_level_cache c0 v w s) e' l0 d d0 c
(single_level_cache c1 v0 w0 s0) c0 v w s c1 v0 w0 s0) in H5.
subst v0.
{
case_eq (eqb index a); intros.
{
apply cmp_to_eq in H5; subst a.
rewrite -> H2 in H4.
injection H4; intros; subst c0 v w s.
assert (Some (single_level_cache F' V' C' R') = Some (single_level_cache c1 V w0 s0)).
rewrite <- H3. apply NatMapFacts.add_eq_o; reflexivity.
injection H5; intros; subst.
reflexivity.
}
{
apply cmp_to_uneq in H5.
assert (NatMap.find index k = Some (single_level_cache F' V' C' R')).
rewrite <- H3. apply eq_sym.
apply NatMapFacts.add_neq_o; apply not_eq_sym; exact H5.
rewrite -> H2 in H6.
injection H6; intros; subst.
reflexivity.
}
}
reflexivity.
reflexivity.
discriminate.
intros; destruct (cc_hit_read s e' l0).
discriminate.
clear A0.
case_eq (recursive_mlc_read k e' m0 l0 l); intros.
assert (A0 := H6). destruct (recursive_mlc_read k e' m0 l0 l) in A0, H1.
case_eq (cc_update s e' d1 l0); intros.
assert (A1 := H7). destruct (cc_update s e' d1 l0) in A1, H1.
injection A0; injection A1; injection H1; intros; subst; clear A0 A1.
{
case_eq (eqb index a); intros.
{
apply cmp_to_eq in H8. subst a.
destruct s. rewrite -> H2 in H4; injection H4; intros; subst c0 v w s.
destruct s0.
apply (cc_update_v (single_level_cache F V C R) e' d l0 c (single_level_cache c0 v w s)
F V C R c0 v w s) in H7.
subst v.
assert (NatMap.find index (NatMap.add index (single_level_cache c0 V w s) m) =
Some (single_level_cache c0 V w s)).
apply NatMapFacts.add_eq_o. reflexivity.
rewrite -> H3 in H7; injection H7; intros; subst c0 V' w s.
reflexivity.
reflexivity.
reflexivity.
}
{
apply cmp_to_uneq in H8.
assert (WFH := H0).
unfold well_defined_cache_tree in H0.
destruct H0 as [ WFH1 ]. destruct H0 as [ WFH2 ]. destruct H0 as [ WFH3 ].
destruct l.
{
apply (IHl root_node WFH1 k e' m0 l0 d d0 o m index F V C R F' V' C' R').
exact WFH. exact H6. exact H2.
rewrite <- H3. apply eq_sym.
apply NatMapFacts.add_neq_o.
apply not_eq_sym. exact H8.
}
{
destruct lambda.
rewrite -> WFH1 in H. discriminate.
specialize (WFH3 c0 a (p :: l) H).
unfold get_cache_ID_path in H. discriminate.
specialize (WFH2 p0 a (p :: l) H).
injection WFH2; intros; subst.
apply (H0 p0 p l) in H.
apply (IHl (cache_node p) H k e' m0 l0 d d0 o m index F V C R F' V' C' R').
exact WFH. exact H6. exact H2.
rewrite <- H3. apply eq_sym.
apply NatMapFacts.add_neq_o.
apply not_eq_sym. exact H8.
}
}
}
discriminate.
destruct (cc_update s e' d1 l0); discriminate.
discriminate.
destruct (recursive_mlc_read k e' m0 l0 l); discriminate.
discriminate.
intros; destruct (NatMap.find a k); discriminate.
}
intros; destruct (get_cache_ID_path lambda h_tree); discriminate.
Qed.
Lemma wf3_mlc_read : forall lambda h_tree k e' m0 l0 D obs1 mu k' index psi psi'
F V C R F' V' C' R',
well_defined_cache_tree h_tree ->
mlc_read k e' m0 l0 lambda h_tree = mlc_read_valid D obs1 mu k' ->
NatMap.find index k = Some psi ->
NatMap.find index k' = Some psi' ->
psi = single_level_cache F V C R ->
psi' = single_level_cache F' V' C' R' ->
(forall enc ranV, NatMap.find enc V = Some ranV -> (forall c, In c ranV -> ~In c F) /\ (forall c, In c F -> ~In c ranV) /\ NoDup(ranV))
/\ NoDup(F) /\ disjoint_VPT(V) ->
(forall enc ranV', NatMap.find enc V' = Some ranV' -> (forall c, In c ranV' -> ~In c F') /\ (forall c, In c F' -> ~In c ranV') /\ NoDup(ranV'))
/\ NoDup(F') /\ disjoint_VPT(V').
Proof.
unfold mlc_read.
intros lambda h_tree.
case_eq (get_cache_ID_path lambda h_tree).
intros l.
generalize dependent lambda.
induction l.
{
intros lambda H k e' m0 l0 D obs1 mu k' index psi psi' F V C R
F' V' C' R' H0 H1 H2 H3 H4 H5 H8.
unfold recursive_mlc_read in H1.
subst.
destruct l0.
destruct (NatMap.find b m0).
injection H1; intros; subst.
rewrite -> H2 in H3.
injection H3; intros; subst.
exact H8. discriminate.
}
{
intros lambda IHTREE k e' m0 l0 D obs1 mu k' index psi psi' F V C R
F' V' C' R' H H0 H1 H2 H3 H4 H7.
unfold recursive_mlc_read in H0.
fold recursive_mlc_read in H0.
case_eq (NatMap.find a k). intros.
assert (A0 := H5). destruct (NatMap.find a k) in A0, H0.
case_eq (cc_hit_read s0 e' l0). intros.
assert (A1 := H6). destruct (cc_hit_read s0 e' l0) in A1, H0.
injection H0; injection A0; injection A1; intros; subst; clear A0 A1.
assert (H8:= H6).
destruct s; destruct s1.
apply (cc_hit_read_f (single_level_cache c0 v w s) e' l0 D obs1 c
(single_level_cache c1 v0 w0 s0) c0 v w s c1 v0 w0 s0) in H6.
apply (cc_hit_read_v (single_level_cache c0 v w s) e' l0 D obs1 c
(single_level_cache c1 v0 w0 s0) c0 v w s c1 v0 w0 s0) in H8.
subst.
{
case_eq (eqb a index).
{
intros. apply cmp_to_eq in H3. subst.
rewrite -> H1 in H5.
injection H5; intros; subst c1 v0 w s.
assert (NatMap.find index (NatMap.add index (single_level_cache F V w0 s0) k) =
Some (single_level_cache F V w0 s0)).
apply NatMapFacts.add_eq_o. reflexivity.
rewrite -> H3 in H2.
injection H2; intros; subst F' V' w0 s0.
exact H7.
}
{
intros. apply cmp_to_uneq in H3.
assert (NatMap.find index (NatMap.add a (single_level_cache c1 v0 w0 s0) k) = NatMap.find index k).
apply NatMapFacts.add_neq_o. exact H3.
rewrite -> H2 in H4.
rewrite -> H1 in H4.
injection H4; intros; subst F' V' C' R'.
exact H7.
}
}
reflexivity.
reflexivity.
reflexivity.
reflexivity.
discriminate.
intros; destruct (cc_hit_read s0 e' l0).
discriminate.
case_eq (recursive_mlc_read k e' m0 l0 l). intros.
assert (A1 := H8). destruct (recursive_mlc_read k e' m0 l0 l) in A1, H0.
case_eq (cc_update s0 e' d1 l0). intros.
assert (A2 := H9). destruct (cc_update s0 e' d1 l0) in A2, H0.
injection H0; injection A0; injection A1; injection A2; intros; subst; clear A0 A1 A2.
{
case_eq (eqb index a).
{
intros. apply cmp_to_eq in H3. subst a.
destruct s.
assert (H10 := H9).
destruct s1.
apply (cc_update_f (single_level_cache c0 v w s) e' D l0 c (single_level_cache c1 v0 w0 s0)
c0 v w s c1 v0 w0 s0) in H9.
apply (cc_update_v (single_level_cache c0 v w s) e' D l0 c (single_level_cache c1 v0 w0 s0)
c0 v w s c1 v0 w0 s0) in H10.
subst.
assert (NatMap.find index (NatMap.add index (single_level_cache c1 v0 w0 s0) m) =
Some (single_level_cache c1 v0 w0 s0)).
apply NatMapFacts.add_eq_o. reflexivity.
rewrite -> H3 in H2.
rewrite -> H5 in H1.
injection H1; injection H2; intros; subst.
exact H7.
reflexivity.
reflexivity.
reflexivity.
reflexivity.
}
{
intros. apply cmp_to_uneq in H3.
assert (WFH := H).
unfold well_defined_cache_tree in H.
destruct H as [ WFH1 ]. destruct H as [ WFH2 ]. destruct H as [ WFH3 ].
destruct l.
{
apply (IHl root_node WFH1 k e' m0 l0 D obs1 o m index (single_level_cache F V C R)
(single_level_cache F' V' C' R') F V C R F' V' C' R').
exact WFH.
unfold mlc_write. exact H8.
exact H1.
rewrite <- H2. apply eq_sym.
apply NatMapFacts.add_neq_o.
apply not_eq_sym. exact H3.
reflexivity.
reflexivity.
exact H7.
}
{
destruct lambda.
rewrite -> WFH1 in IHTREE. discriminate.
specialize (WFH3 c0 a (p :: l) IHTREE).
unfold get_cache_ID_path in IHTREE. discriminate.
specialize (WFH2 p0 a (p :: l) IHTREE).
injection WFH2; intros; subst.
apply (H p0 p l) in IHTREE.
apply (IHl (cache_node p) IHTREE k e' m0 l0 D obs1 o m index (single_level_cache F V C R)
(single_level_cache F' V' C' R') F V C R F' V' C' R').
exact WFH.
unfold mlc_write. exact H8.
exact H1.
rewrite <- H2. apply eq_sym.
apply NatMapFacts.add_neq_o.
apply not_eq_sym. exact H3.
reflexivity.
reflexivity.
exact H7.
}
}
}
discriminate.
intros; destruct (cc_update s0 e' d1 l0).
discriminate.
discriminate.
discriminate.
intros; destruct (recursive_mlc_read k e' m0 l0 l).
discriminate.
discriminate.
discriminate.
intros; destruct (NatMap.find a k).
discriminate.
discriminate.
}
intros; destruct (get_cache_ID_path lambda h_tree).
discriminate.
discriminate.
Qed.
(* WF3 MLC Allocation *)
Lemma NoDup_append : forall l l' (c : cachelet_index),
NoDup(l) /\ NoDup(l') -> l = c :: nil -> ~In c l' -> NoDup(l ++ l').
Proof.
intros.
destruct H.
rewrite -> H0.
constructor. exact H1. exact H2.
Qed.
Lemma NoDup_remove : forall c F,
NoDup(F) -> NoDup(remove eq_dec_cachelet c F).
Proof.
intros.
induction F.
assert (~In c nil). unfold In; unfold not; auto.
apply (notin_remove eq_dec_cachelet nil c) in H0.
rewrite -> H0. exact H.
apply NoDup_cons_iff in H. destruct H.
unfold remove. case_eq (eq_dec_cachelet c a). intros.
apply IHF. exact H0.
intros. constructor. intros contra. apply H.
assert (In a F /\ a <> c -> In a F). intros. destruct H2. exact H2.
apply H2. apply (in_remove eq_dec_cachelet F a c). exact contra.
apply IHF. exact H0.
Qed.
Lemma remove_CAT_not_in : forall c F remF,
remove_CAT c F = Some remF -> ~In c remF.
Proof.
intros.
unfold remove_CAT in H.
destruct (in_bool c F).
injection H; intros; subst.
apply remove_In. discriminate.
Qed.
Lemma remove_CAT_in : forall b c F remF,
remove_CAT b F = Some remF -> b <> c -> In c F -> In c remF.
Proof.
intros.
unfold remove_CAT in H.
case_eq (in_bool b F); intros.
assert (A0 := H2). destruct (in_bool b F) in A0, H.
injection H; intros; subst.
apply in_bool_iff in H2. apply in_in_remove.
apply not_eq_sym; exact H0. exact H1.
discriminate.
assert (A0 := H2).
destruct (in_bool b F) in A0, H; discriminate.
Qed.
Lemma remove_CAT_inv_subset : forall w s w0 s0 F remF,
remove_CAT (w, s) F = Some remF ->
w0 <> w \/ s0 <> s ->
~In (w0, s0) F -> ~In (w0, s0) remF.
Proof.
intros. unfold remove_CAT in H.
destruct (in_bool (w, s) F).
injection H; intros; subst.
intros contra. apply in_remove in contra.
destruct contra. apply H1 in H2. exact H2.
discriminate.
Qed.
Lemma wf3_cachelet_allocation : forall n r F V C R F' V' C' R',
cachelet_allocation n r (single_level_cache F V C R) = Some (single_level_cache F' V' C' R') ->
(forall e' l', NatMap.find e' V = Some l' -> (forall c, In c l' -> ~ In c F) /\ (forall c, In c F -> ~ In c l')
/\ NoDup(l')) /\ NoDup(F) /\ disjoint_VPT(V) ->
(forall e' l', NatMap.find e' V' = Some l' -> (forall c, In c l' -> ~ In c F') /\ (forall c, In c F' -> ~ In c l')
/\ NoDup(l')) /\ NoDup(F') /\ disjoint_VPT(V').
Proof.
intros n r.
unfold cachelet_allocation.
destruct n.
intros; discriminate.
induction (S n).
{
intros.
unfold cachelet_allocation in H.
unfold recursive_cachelet_allocation in H.
injection H; intros; subst.
exact H0.
}
{
intros.
unfold recursive_cachelet_allocation in H.
fold recursive_cachelet_allocation in H.
case_eq (way_first_allocation F); intros.
assert (A0 := H1); destruct (way_first_allocation F) in H, A0.
destruct c0.
case_eq (NatMap.find s R); intros.
assert (A1 := H2); destruct (NatMap.find s R) in H, A1.
case_eq (remove_CAT (w, s) F). intros c0 F0.
assert (A3 := F0). destruct (remove_CAT (w, s) F) in H, A3.
case_eq (NatMap.find r V). intros r0 H5.
assert (A2 := H5). destruct (NatMap.find r V) in H, A2.
injection A0; injection A1; injection A2; injection A3;
intros X0 X1 X2 X3; subst; clear A0 A1 A2 A3.
{
apply (IHn0 c0 (NatMap.add r ((w, s) :: r0) V) C
(NatMap.add s (update p w (enclave_ID_active r)) R) F' V' C' R').
exact H.
split. intros; case_eq (eqb e' r); intros V0.
{
apply cmp_to_eq in V0; subst e'.
assert (NatMap.find (elt:=remapping_list) r (NatMap.add r ((w, s) :: r0) V)
= Some ((w, s) :: r0)).
apply NatMapFacts.add_eq_o; reflexivity.
rewrite -> H3 in H4; injection H4; intros; subst.
destruct H0.
specialize (H0 r r0 H5). destruct H0. destruct H7.
split. intros. apply in_inv in H9.
destruct H9. subst.
apply remove_CAT_not_in in F0. exact F0.
intros contra. apply (remove_CAT_f c (w, s) F c0 F0) in contra.
apply H7 in contra. apply contra in H9. exact H9.
split. intros; intros contra. apply in_inv in contra. destruct contra. subst.
apply (remove_CAT_not_in (w, s) F c0) in F0. apply F0 in H9. exact H9.
intros. apply (remove_CAT_f c (w, s) F c0 F0) in H9. apply H7 in H9.
apply H9 in H10. exact H10.
constructor. intros contra. unfold remove_CAT in F0.
case_eq (in_bool (w, s) F). intros.
apply in_bool_iff in H9. apply H7 in H9. apply H9 in contra. exact contra.
intros; destruct (in_bool (w, s) F); discriminate. exact H8.
}
{
apply cmp_to_uneq in V0.
assert (NatMap.find e' V = Some l').
rewrite <- H3. apply eq_sym. apply NatMapFacts.add_neq_o; apply not_eq_sym; exact V0.
destruct H0.
specialize (H0 e' l' H4).
destruct H0; destruct H7.
split; intros.
intros contra. apply (remove_CAT_f c (w, s) F c0 F0) in contra.
apply H7 in contra. apply contra in H9. exact H9.
split. intros; intros contra.
apply (remove_CAT_f c (w, s) F c0 F0) in H9.
apply H7 in H9. apply H9 in contra. exact contra.
exact H8.
}
destruct H0. destruct H3. split.
unfold remove_CAT in F0. destruct (in_bool (w, s) F).
injection F0; intros; subst.
apply NoDup_remove. exact H3. discriminate.
apply (disjoint_VPT_add2 r V (w, s) r0). exact H5.
intros. specialize (H0 e l' H6). destruct H0. destruct H7.
apply H7. unfold remove_CAT in F0. case_eq (in_bool (w, s) F); intros.
apply in_bool_iff. exact H9.
destruct (in_bool (w, s) F); discriminate. exact H4.
}
discriminate.
intros H5; assert (A2 := H5); destruct (NatMap.find r V) in A2, H.
discriminate.
assert (L0 := H2).
injection A0; injection A1; injection A3; intros X0 X1 X2; subst; clear A0 A1 A2 A3.
{
apply (IHn0 c0 (NatMap.add r ((w, s) :: nil) V) C
(NatMap.add s (update p w (enclave_ID_active r)) R) F' V' C' R').
unfold cachelet_allocation; exact H.
destruct H0.
split. intros.
case_eq (eqb e' r); intros V1.
{
apply cmp_to_eq in V1; subst e'.
assert (Some l' = Some ((w, s) :: nil)).
rewrite <- H4. apply NatMapFacts.add_eq_o; reflexivity.
injection H6; intros; subst.
split. intros. intros contra.
apply in_inv in H7. destruct H7. subst c.
apply remove_CAT_not_in in F0.
apply F0 in contra; exact contra.
unfold In in H7; exact H7.
split. intros. intros contra. apply in_inv in contra.
destruct contra. subst c.
apply remove_CAT_not_in in F0.
apply F0 in H7. exact H7.
unfold In in H8. exact H8.
constructor. unfold In. auto. constructor.
}
{
apply cmp_to_uneq in V1.
assert (NatMap.find e' V = Some l').
apply eq_sym; rewrite <- H4; apply NatMapFacts.add_neq_o; apply not_eq_sym; exact V1.
specialize (H0 e' l' H6). destruct H0. destruct H7.
split. intros. intros contra.
apply (remove_CAT_f c (w, s) F c0 F0) in contra.
apply H7 in contra. apply contra in H9. exact H9.
split. intros. apply H7. apply (remove_CAT_f c (w, s) F c0 F0).
exact H9. exact H8.
}
destruct H3. split.
unfold remove_CAT in F0. destruct (in_bool (w, s) F).
injection F0; intros; subst.
apply NoDup_remove. exact H3. discriminate.
apply (disjoint_VPT_add_none r V (w, s)). exact H5.
intros. specialize (H0 e l' H6). destruct H0. destruct H7.
apply H7. unfold remove_CAT in F0. case_eq (in_bool (w, s) F); intros.
apply in_bool_iff; exact H9.
destruct (in_bool (w, s) F); discriminate. exact H4.
}
discriminate.
intros; destruct (remove_CAT (w, s) F).
discriminate.
discriminate.
discriminate.
intros; destruct (NatMap.find s R).
discriminate.
discriminate.
discriminate.
intros; destruct (way_first_allocation F).
discriminate.
discriminate.
}
Qed.
Lemma wf3_mlc_alloc : forall lambda h_tree n state k k' index psi psi' F V C R F' V' C' R',
well_defined_cache_tree h_tree ->
mlc_allocation n state k lambda h_tree = Some k' ->
NatMap.find index k = Some psi ->
NatMap.find index k' = Some psi' ->
psi = single_level_cache F V C R ->
psi' = single_level_cache F' V' C' R' ->
(forall e' l', NatMap.find e' V = Some l' -> (forall c, In c l' -> ~ In c F) /\ (forall c, In c F -> ~ In c l')
/\ NoDup(l')) /\ NoDup(F) /\ disjoint_VPT(V) ->
(forall enc l', NatMap.find enc V' = Some l' -> (forall c, In c l' -> ~ In c F') /\ (forall c, In c F' -> ~ In c l')
/\ NoDup(l')) /\ NoDup(F') /\ disjoint_VPT(V').
Proof.
unfold mlc_allocation.
intros lambda h_tree.
case_eq (get_cache_ID_path lambda h_tree).
intros l0.
generalize dependent lambda.
destruct l0 as [|x].
{ intros; discriminate. }
induction (x :: l0).
{
intros lambda IHTREE n r k k' index psi psi' F V C R
F' V' C' R' WFH H H0 H1 H4 H5 H6.
unfold recursive_mlc_allocation in H.
injection H; intros; subst k'.
rewrite -> H0 in H1.
injection H1; intros; subst psi psi'.
injection H2; intros; subst F' V' C' R'.
exact H6.
}
{
intros lambda IHTREE n r k k' index psi psi' F V C R
F' V' C' R' WFH H H0 H1 H4 H5 H6.
unfold recursive_mlc_allocation in H.
fold recursive_mlc_allocation in H.
destruct n. discriminate.
case_eq (NatMap.find a k). intros.
assert (A0 := H2). destruct (NatMap.find a k) in A0, H.
case_eq (cachelet_allocation n r s0). intros.
assert (A1 := H3). destruct (cachelet_allocation n r s0) in A1, H.
injection A0; injection A1; intros; subst s0 s2; clear A0 A1.
assert (WFH1 := WFH).
unfold well_defined_cache_tree in WFH1.
destruct WFH1 as [ WFH1 WFH2 ]. destruct WFH2 as [ WFH2 WFH3 ]. destruct WFH3 as [ WFH3 WFH4 ].
case_eq (eqb index a).
{
intros; apply cmp_to_eq in H7; subst a.
rewrite -> H2 in H0.
injection H0; intros; subst s.
destruct s1.
destruct l.
{
apply (IHl root_node WFH1 n0 r (NatMap.add index (single_level_cache c v w s) k)
k' index (single_level_cache c v w s) psi' c v w s F' V' C' R').
exact WFH.
exact H.
apply NatMapFacts.add_eq_o. reflexivity.
exact H1.
reflexivity.
exact H5.
apply (wf3_cachelet_allocation n r F V C R c v w s).
subst psi; exact H3. exact H6.
}
{
destruct lambda.
rewrite -> WFH1 in IHTREE. discriminate.
specialize (WFH3 c0 index (p :: l) IHTREE).
unfold get_cache_ID_path in IHTREE. discriminate.
specialize (WFH2 p0 index (p :: l) IHTREE).
injection WFH2; intros; subst p0.
apply (WFH4 index p l) in IHTREE.
apply (IHl (cache_node p) IHTREE n0 r (NatMap.add index (single_level_cache c v w s) k)
k' index (single_level_cache c v w s) psi' c v w s F' V' C' R').
exact WFH.
exact H.
apply NatMapFacts.add_eq_o. reflexivity.
exact H1.
reflexivity.
exact H5.
apply (wf3_cachelet_allocation n r F V C R c v w s).
subst psi; exact H3. exact H6.
}
}
{
intros; apply cmp_to_uneq in H7.
destruct l.
{
apply (IHl root_node WFH1 n0 r (NatMap.add a s1 k) k' index psi psi' F V C R F' V' C' R').
exact WFH.
unfold mlc_allocation. exact H.
rewrite <- H0. apply NatMapFacts.add_neq_o.
apply not_eq_sym. exact H7.
exact H1.
exact H4.
exact H5.
exact H6.
}
{
destruct lambda.
rewrite -> WFH1 in IHTREE. discriminate.
specialize (WFH3 c a (p :: l) IHTREE).
unfold get_cache_ID_path in IHTREE. discriminate.
specialize (WFH2 p0 a (p :: l) IHTREE).
injection WFH2; intros; subst p0.
apply (WFH4 a p l) in IHTREE.
apply (IHl (cache_node p) IHTREE n0 r (NatMap.add a s1 k) k' index psi psi' F V C R F' V' C' R').
exact WFH.
unfold mlc_allocation. exact H.
rewrite <- H0. apply NatMapFacts.add_neq_o.
apply not_eq_sym. exact H7.
exact H1.
exact H4.
exact H5.
exact H6.
}
}
discriminate.
intros; destruct (cachelet_allocation n r s0).
discriminate.
discriminate.
discriminate.
intros; destruct (NatMap.find a k).
discriminate.
discriminate.
}
intros; destruct (get_cache_ID_path lambda h_tree); discriminate.
Qed.
(* WF3 MLC Write *)
Lemma wf3_mlc_write : forall lambda h_tree k e' m0 l0 v D obs1 mu k' index psi psi'
F V C R F' V' C' R',
well_defined_cache_tree h_tree ->
mlc_write k e' m0 l0 v lambda h_tree = mlc_write_valid D obs1 mu k' ->
NatMap.find index k = Some psi ->
NatMap.find index k' = Some psi' ->
psi = single_level_cache F V C R ->
psi' = single_level_cache F' V' C' R' ->
(forall e' l', NatMap.find e' V = Some l' -> (forall c, In c l' -> ~ In c F) /\ (forall c, In c F -> ~ In c l')
/\ NoDup(l')) /\ NoDup(F) /\ disjoint_VPT(V) ->
(forall e' l', NatMap.find e' V' = Some l' -> (forall c, In c l' -> ~ In c F') /\ (forall c, In c F' -> ~ In c l')
/\ NoDup(l')) /\ NoDup(F') /\ disjoint_VPT(V').
Proof.
unfold mlc_write.
intros lambda h_tree.
case_eq (get_cache_ID_path lambda h_tree).
intros l.
generalize dependent lambda.
induction l.
{
intros lambda IHTREE k e' m0 l0 v D obs1 mu k' index psi psi'
F V C R F' V' C' R' WFH1 H H0 H1 H2 H3 H6.
destruct (get_cache_ID_path lambda h_tree).
injection IHTREE; intros; subst.
unfold recursive_mlc_write in H.
subst. destruct l0.
destruct (NatMap.find b m0). destruct v.
discriminate.
injection H; intros; subst.
rewrite -> H0 in H1.
injection H1; intros; subst.
exact H6.
discriminate.
discriminate.
}
{
intros lambda IHTREE k e' m0 l0 v D obs1 mu k' index psi psi'
F V C R F' V' C' R' WFH1 H H0 H1 H2 H3 H6.
unfold recursive_mlc_write in H.
fold recursive_mlc_write in H.
case_eq (NatMap.find a k); intros.
assert (A0 := H4). destruct (NatMap.find a k) in A0, H.
case_eq (cc_hit_write s0 e' l0 v); intros.
assert (A1 := H5). destruct (cc_hit_write s0 e' l0 v) in A1, H. destruct l0.
injection H; injection A0; injection A1; intros; subst; clear A0 A1.
assert (H7 := H5).
destruct s; destruct s1.
apply (cc_hit_write_f (single_level_cache c0 v0 w s) e' (address b d1) v D c
(single_level_cache c1 v1 w0 s0) c0 v0 w s c1 v1 w0 s0) in H5.
apply (cc_hit_write_v (single_level_cache c0 v0 w s) e' (address b d1) v D c
(single_level_cache c1 v1 w0 s0) c0 v0 w s c1 v1 w0 s0) in H7.
subst.
{
case_eq (eqb a index).
{
intros. apply cmp_to_eq in H2. subst.
rewrite -> H0 in H4.
injection H4; intros; subst c1 v1 w s.
assert (NatMap.find index (NatMap.add index (single_level_cache F V w0 s0) k) =
Some (single_level_cache F V w0 s0)).
apply NatMapFacts.add_eq_o. reflexivity.
rewrite -> H2 in H1.
injection H1; intros; subst F' V' w0 s0.
exact H6.
}
{
intros. apply cmp_to_uneq in H2.
assert (NatMap.find index (NatMap.add a (single_level_cache c1 v1 w0 s0) k) = NatMap.find index k).
apply NatMapFacts.add_neq_o. exact H2.
rewrite -> H1 in H3.
rewrite -> H0 in H3.
injection H3; intros; subst F' V' C' R'.
exact H6.
}
}
reflexivity.
reflexivity.
reflexivity.
reflexivity.
discriminate.
intros; destruct (cc_hit_write s0 e' l0).
discriminate.
case_eq (recursive_mlc_write k e' m0 l0 v l). intros.
assert (A1 := H7). destruct (recursive_mlc_write k e' m0 l0 v l) in A1, H.
case_eq (cc_update s0 e' d0 l0). intros.
assert (A2 := H8). destruct (cc_update s0 e' d0 l0) in A2, H.
injection H; injection A0; injection A1; injection A2; intros; subst; clear A0 A1 A2.
{
case_eq (eqb index a).
{
intros. apply cmp_to_eq in H2. subst a.
destruct s.
assert (H9 := H8).
destruct s1.
apply (cc_update_f (single_level_cache c0 v0 w s) e' D l0 c (single_level_cache c1 v1 w0 s0)
c0 v0 w s c1 v1 w0 s0) in H8.
apply (cc_update_v (single_level_cache c0 v0 w s) e' D l0 c (single_level_cache c1 v1 w0 s0)
c0 v0 w s c1 v1 w0 s0) in H9.
subst.
assert (NatMap.find index (NatMap.add index (single_level_cache c1 v1 w0 s0) m1) =
Some (single_level_cache c1 v1 w0 s0)).
apply NatMapFacts.add_eq_o. reflexivity.
rewrite -> H2 in H1.
rewrite -> H4 in H0.
injection H0; injection H1; intros; subst.
exact H6.
reflexivity.
reflexivity.
reflexivity.
reflexivity.
}
{
intros. apply cmp_to_uneq in H2.
assert (WFH := WFH1).
unfold well_defined_cache_tree in WFH1.
destruct WFH1 as [ WFH1 WFH2 ]. destruct WFH2 as [ WFH2 WFH3 ]. destruct WFH3 as [ WFH3 WFH4 ].
destruct l.
{
apply (IHl root_node WFH1 k e' m0 l0 v D o mu m1 index (single_level_cache F V C R)
(single_level_cache F' V' C' R') F V C R F' V' C' R').
exact WFH.
unfold mlc_write. exact H7.
exact H0.
rewrite <- H1. apply eq_sym.
apply NatMapFacts.add_neq_o.
apply not_eq_sym. exact H2.
reflexivity.
reflexivity.
exact H6.
}
{
destruct lambda.
rewrite -> WFH1 in IHTREE. discriminate.
specialize (WFH3 c0 a (p :: l) IHTREE).
unfold get_cache_ID_path in IHTREE. discriminate.
specialize (WFH2 p0 a (p :: l) IHTREE).
injection WFH2; intros; subst.
apply (WFH4 p0 p l) in IHTREE.
apply (IHl (cache_node p) IHTREE k e' m0 l0 v D o mu m1 index (single_level_cache F V C R)
(single_level_cache F' V' C' R') F V C R F' V' C' R').
exact WFH.
unfold mlc_write. exact H7.
exact H0.
rewrite <- H1. apply eq_sym.
apply NatMapFacts.add_neq_o.
apply not_eq_sym. exact H2.
reflexivity.
reflexivity.
exact H6.
}
}
}
discriminate.
intros; destruct (cc_update s0 e' d0 l0); discriminate.
discriminate.
intros; destruct (recursive_mlc_write k e' m0 l0 v l); discriminate.
discriminate.
intros; destruct (NatMap.find a k); discriminate.
}
intros; destruct (get_cache_ID_path lambda h_tree); discriminate.
Qed.
(* WF3 MLC Deallocation *)
Lemma clear_remapping_list_ranV : forall r l F V C R F' V' C' R' e ranV ranV',
r <> e -> clear_remapping_list r l F V C R = Some (single_level_cache F' V' C' R') ->
NatMap.find e V = Some ranV ->
NatMap.find e V' = Some ranV' ->