x86.mm1

import "peano_hex.mm1";

@(add-eval @ fn (b n) (def a {(eval n) shl 1}) @ if (eval b) {a + 1} a)
@_ def consBit (b: wff) (n: nat): nat = $ if b (b1 n) (b0 n) $;

@(add-eval @ fn (n i) {{{(eval n) shr (eval i)} band 1} = 1})
@_ def bit (n i: nat): nat = $ nat (i e. n) $;
pub theorem bitT (n i: nat): $ bool (bit n i) $ = 'boolnat;

theorem bit01: $ bit 0 i = 0 $ = '(mpbir nateq0 nel0);
theorem bitb00: $ bit (b0 n) 0 = 0 $ = '(mpbir nateq0 elb00);
theorem bitb10: $ bit (b1 n) 0 = 1 $ = '(mpbir nateq1 elb10);
theorem bitb0S: $ bit (b0 n) (suc i) = bit n i $ = '(nateq elb0S);
theorem bitb1S: $ bit (b1 n) (suc i) = bit n i $ = '(nateq elb1S);

theorem bit_shr: $ bit (shr a k) i = bit a (i + k) $ = '(nateq elshr);

theorem bitb00i (h: $ a = b0 b $): $ bit a 0 = 0 $ = '(eqtr (biteq1 h) bitb00);
theorem bitb10i (h: $ a = b1 b $): $ bit a 0 = 1 $ = '(eqtr (biteq1 h) bitb10);
theorem bitb0Si (h: $ a = b0 b $) (h2: $ bit b n = c $): $ bit a (suc n) = c $ =
'(eqtr (biteq1 h) @ eqtr bitb0S h2);
theorem bitb1Si (h: $ a = b1 b $) (h2: $ bit b n = c $): $ bit a (suc n) = c $ =
'(eqtr (biteq1 h) @ eqtr bitb1S h2);

-- Adds theorems such as
-- theorem xbita3: $ bit xa 3 = 1 $;
-- which evaluate the bits of an individual hex digit.
-- Naming system is "xbit" + hex digit + index
do {
  (def (xbit n i) @ atom-app "xbit" (hexstring n) (hexstring i))
  (for 0 16 @ fn (n) @ for 0 4 @ fn (i)
    @ letrec ([(f n i)
      @ if {i = 0}
      '(,(atom-app "bitb" {n % 2} "0i") ,(hexnhalf n))
      '(,(atom-app "bitb" {n % 2} "Si")
        ,(hexnhalf n) ,(f {n // 2} {i - 1}))])
    (add-tac-thm! (xbit n i) () ()
      '(eq (bit (h2n (,(hexdigit n))) (,(dn i))) (,(dn {{n shr i} band 1}))) ()
      @ fn () (f n i)))
};

@(add-eval @ fn (a b) {(eval a) band (eval b)})
@_ abstract def bitAnd (a b: nat): nat = $ lower (a i^i b) $;
pub theorem bitAndEq (a b: nat): $ bitAnd a b == a i^i b $ =
'(eqscom @ mpbi eqlower @ infin1 finns);

theorem elbitAnd: $ i e. bitAnd a b <-> i e. a /\ i e. b $ =
'(bitr (eleq2 bitAndEq) elin);

theorem bitAnd_sym: $ bitAnd a b = bitAnd b a $ =
'(axext @ eqstr4 bitAndEq @ eqstr4 bitAndEq incom);
theorem bitAnd_ass: $ bitAnd (bitAnd a b) c = bitAnd a (bitAnd b c) $ =
'(axext @ eqstr4 bitAndEq @ eqstr4 bitAndEq @
  eqstr4 (ineq1 bitAndEq) @ eqstr4 (ineq2 bitAndEq) inass);

theorem bitAnd01 (a: nat): $ bitAnd 0 a = 0 $ = '(axext @ eqstr bitAndEq in01);
theorem bitAnd02 (a: nat): $ bitAnd a 0 = 0 $ = '(eqtr bitAnd_sym bitAnd01);
theorem bitAnd_idm (a: nat): $ bitAnd a a = a $ = '(axext @ eqstr bitAndEq inidm);

theorem bitAndb0l: $ bitAnd (b0 a) b = b0 (bitAnd a (b // 2)) $ =
(named '(axext @ ax_gen @ bitr elbitAnd @ bitr (aneq1i elb0) @
  bitr4 anass @ bitr elb0 @ aneq2a @ syl5bb elbitAnd @
  aneq2d @ syl5bb eldiv2 @ eleq1d @ syl sub1can ltner));
theorem bitAndb0r: $ bitAnd a (b0 b) = b0 (bitAnd (a // 2) b) $ =
'(eqtr bitAnd_sym @ eqtr4 bitAndb0l @ b0eq bitAnd_sym);

theorem bitAndb00: $ bitAnd (b0 a) (b0 b) = b0 (bitAnd a b) $ =
'(eqtr bitAndb0l @ b0eq @ bitAndeq2 b0div2);
theorem bitAndb01: $ bitAnd (b0 a) (b1 b) = b0 (bitAnd a b) $ =
'(eqtr bitAndb0l @ b0eq @ bitAndeq2 b1div2);
theorem bitAndb10: $ bitAnd (b1 a) (b0 b) = b0 (bitAnd a b) $ =
'(eqtr bitAndb0r @ b0eq @ bitAndeq1 b1div2);
theorem bitAndb11: $ bitAnd (b1 a) (b1 b) = b1 (bitAnd a b) $ =
(named '(axext @ ax_gen @ bitr elbitAnd @ bitr4 (aneq1i elb1) @
  bitr elb1 @ bitr (oreq2i elbitAnd) @ bitr4 ordi @ aneq2i elb1));

@(add-eval @ fn (a b) {(eval a) bor (eval b)})
@_ abstract def bitOr (a b: nat): nat = $ lower (a u. b) $;
pub theorem bitOrEq (a b: nat): $ bitOr a b == a u. b $ =
'(eqscom @ mpbi eqlower @ unfin finns finns);

theorem elbitOr: $ i e. bitOr a b <-> i e. a \/ i e. b $ =
'(bitr (eleq2 bitOrEq) elun);

theorem bitOr_sym: $ bitOr a b = bitOr b a $ =
'(axext @ eqstr4 bitOrEq @ eqstr4 bitOrEq uncom);
theorem bitOr_ass: $ bitOr (bitOr a b) c = bitOr a (bitOr b c) $ =
'(axext @ eqstr4 bitOrEq @ eqstr4 bitOrEq @
  eqstr4 (uneq1 bitOrEq) @ eqstr4 (uneq2 bitOrEq) unass);
theorem bitAnd_di: $ bitAnd a (bitOr b c) = bitOr (bitAnd a b) (bitAnd a c) $ =
'(axext @ eqstr4 bitAndEq @ eqstr4 bitOrEq @
  eqstr4 (ineq2 bitOrEq) @ eqstr4 (uneq bitAndEq bitAndEq) indi);

theorem bitOr01 (a: nat): $ bitOr 0 a = a $ = '(axext @ eqstr bitOrEq un01);
theorem bitOr02 (a: nat): $ bitOr a 0 = a $ = '(eqtr bitOr_sym bitOr01);
theorem bitOr_idm (a: nat): $ bitOr a a = a $ = '(axext @ eqstr bitOrEq unidm);

theorem bitOrb1l: $ bitOr (b1 a) b = b1 (bitOr a (b // 2)) $ =
(named '(axext @ ax_gen @ bitr elbitOr @ bitr (oreq1i elb1) @
  bitr4 orass @ bitr elb1 @ oreq2a @ syl5bb elbitOr @
  oreq2d @ syl5bb eldiv2 @ eleq1d sub1can));
theorem bitOrb1r: $ bitOr a (b1 b) = b1 (bitOr (a // 2) b) $ =
'(eqtr bitOr_sym @ eqtr4 bitOrb1l @ b1eq bitOr_sym);

theorem bitOrb00: $ bitOr (b0 a) (b0 b) = b0 (bitOr a b) $ =
(named '(axext @ ax_gen @ bitr elbitOr @ bitr4 (oreq1i elb0) @
  bitr elb0 @ bitr (aneq2i elbitOr) @ bitr4 andi @ oreq2i elb0));
theorem bitOrb01: $ bitOr (b0 a) (b1 b) = b1 (bitOr a b) $ =
'(eqtr bitOrb1r @ b1eq @ bitOreq1 b0div2);
theorem bitOrb10: $ bitOr (b1 a) (b0 b) = b1 (bitOr a b) $ =
'(eqtr bitOrb1l @ b1eq @ bitOreq2 b0div2);
theorem bitOrb11: $ bitOr (b1 a) (b1 b) = b1 (bitOr a b) $ =
'(eqtr bitOrb1l @ b1eq @ bitOreq2 b1div2);

theorem bitAnd_add_bitOr: $ bitAnd a b + bitOr a b = a + b $ =
(named @ focus
  (def h '(aleqd @ eqeqd (addeqd bitAndeq1 bitOreq1) addeq1))
  (def h2 '(eqeqd (addeqd bitAndeq2 bitOreq2) addeq2))
  '(eale ,h2 @ trud @ !! indstr _ _ ,h ,h @ sylib (cbval ,h2) @ iald @
    casesda (anwr @
      eqtr4d (addeqd (syl6eq bitAnd01 @ bitAndeq1) (syl6eq bitOr01 @ bitOreq1)) addeq1) _)
  (have 'hal '(rsyl anlr @ syl6 (eale ,h2) @ eale @ imeqd lteq1 ,h))
  (def (f x y0 y1)
    (def g @ match-fn @ (y z w1 w2 h)
      '(eqtr4d (addeqd (syl6eq ,y @ bitAndeqd anlr anr) (syl6eq ,z @ bitOreqd anlr anr)) @
        eqtr4d (addeqd anlr anr) @ syl5eq ,w1 @ syl6eqr ,w2
        ,(foldr h '(mpd (mpbird (lteq2d anlr) ,x) (anwll hal)) list)))
    (split-sop '{($b0 v$ => ,(g y0)) + ($b1 v$ => ,(g y1))}))
  (split-sop '{
    ($b0 u$ => ,(f '(sylib b0ltid @ sylib b0ne0 @ mpbid (neeq1d anlr) anllr)
      '(bitAndb00 bitOrb00 addb00 addb00 (b0eqd))
      '(bitAndb01 bitOrb01 addb01 addb01 (b1eqd)))) +
    ($b1 u$ => ,(f '(a1i b1ltid)
      '(bitAndb10 bitOrb10 addb01 addb10 (b1eqd))
      '(bitAndb11 bitOrb11 addb11 addb11 (b0eqd suceqd))))}));

theorem bitOr_eq_add2: $ bitAnd a b = 0 -> bitOr a b = a + b $ =
'(eqtr3g add01 bitAnd_add_bitOr @ addeq1d eqcom);

theorem bitOr_eq_add: $ a i^i b == 0 -> bitOr a b = a + b $ =
'(syl bitOr_eq_add2 @ syl axext @ syl5eqs bitAndEq id);

@(add-eval @ fn (a b) {(eval a) band (bnot (eval b))})
@_ abstract def bitDif (a b: nat): nat = $ lower (a i^i Compl b) $;
pub theorem bitDifEq (a b: nat): $ bitDif a b == a i^i Compl b $ =
'(eqscom @ mpbi eqlower @ infin1 finns);
theorem elbitDif (a b i: nat): $ i e. bitDif a b <-> i e. a /\ ~i e. b $ =
'(bitr (eleq2 bitDifEq) @ bitr elin @ aneq2i elcpl);

theorem bitDif01: $ bitDif 0 a = 0 $ = '(axext @ eqstr bitDifEq in01);
theorem bitDif02: $ bitDif a 0 = a $ = '(axext @ eqstr bitDifEq @ eqstr (ineq2 cpl0) inv2);
theorem bitDifid: $ bitDif a a = 0 $ = '(axext @ eqstr bitDifEq incpl2);
theorem bitDifeq0: $ bitDif a b = 0 <-> a C_ b $ =
'(bitr3 nsinj @ bitr (eqseq1 bitDifEq) incpleq0);

theorem bitDifAndss: $ a C_ c -> bitDif a (bitAnd c b) = bitDif a b $ =
'(syl axext @ !! alimi x @ bitr4g elbitDif elbitDif @
  syl aneq2a @ imim2i @ noteqd @ syl5bb elbitAnd bian1);
theorem bitDifAndid: $ bitDif a (bitAnd a b) = bitDif a b $ = '(bitDifAndss ssid);

theorem bitDifAnd: $ bitDif (bitAnd a b) c = bitAnd a (bitDif b c) $ =
'(axext @ eqstr4 bitDifEq @ eqstr4 bitAndEq @
  eqstr4 (ineq1 bitAndEq) @ eqstr4 (ineq2 bitDifEq) inass);

theorem bitDifadd: $ b C_ a -> bitDif a b + b = a $ =
'(syl5eqr (bitOr_eq_add @ mpbir ineq0 @ mpbir (sseq1 bitDifEq) inss2) @
  sylib nsinj @ !! alimi x @ syl5bb elbitOr @ syl5bb (oreq1 elbitDif) @
  syl5bb ordir @ syl5bb (bian2 emr) bior2a);

theorem bitDifsub: $ b C_ a -> bitDif a b = a - b $ =
'(syl5eqr pncan @ subeq1d bitDifadd);

theorem bitDif_upto: $ bitDif a (upto n) = shl (shr a n) n $ =
(named '(axext @ ax_gen @ bitr4 elbitDif @ bitr4 elshl @
  bitr4 ancomb @ bitr (aneq2a @ syl5bb elshr @ eleq1d npcan) @
  aneq1i @ con2b @ bitr elupto ltnle));

@(add-eval @ fn (a b) {(eval a) bxor (eval b)})
@_ abstract def bitXor (a b: nat): nat = $ lower {n | ~(n e. a <-> n e. b)} $;
pub theorem bitXor_mem (a b i: nat): $ i e. bitXor a b <-> ~(i e. a <-> i e. b) $ =
'(bitr (ellower @
    finss (mpbi ssab1 @ !! ax_gen n @
      sylibr elun @ con1 @ sylbi notor @ imp binth) @
    unfin finns finns) @
  elabe @ noteqd @ bieqd eleq1 eleq1);

@(add-eval 32) @_ def d32: nat = $ 2 ^ 5 $; prefix d32: $32$ prec max;
@(add-eval 64) @_ def d64: nat = $ 2 ^ 6 $; prefix d64: $64$ prec max;
@(add-eval 256) @_ def d256: nat = $ 2 ^ 8 $; prefix d256: $256$ prec max;

theorem d2mul16: $ 2 * 16 = 32 $ = '(eqtr2 powS @ muleq2 d2pow4);
theorem d2mul32: $ 2 * 32 = 64 $ = '(eqcom powS);
theorem d16mul16: $ 16 * 16 = 256 $ = '(eqcom @ pow22lem d2mul4 d2pow4);
theorem dec32: $ 32 = ,32 $ = '(eqtr3 d2mul16 ,to_hex);
do (insert! tohex-map 'd32 @ fn () '((hex (h2n (x2)) (x0)) (dec32)));
theorem d8mul4: $ 8 * 4 = 32 $ = norm_num;
theorem d32ne0: $ 32 != 0 $ = 'pow2ne0;
theorem d64ne0: $ 64 != 0 $ = 'pow2ne0;
theorem d256ne0: $ 256 != 0 $ = 'pow2ne0;
theorem dec64: $ 64 = ,64 $ = '(eqtr3 d2mul32 ,to_hex);
theorem dec256: $ 256 = ,256 $ = '(eqtr3 d16mul16 ,to_hex);
do (insert! tohex-map 'd64 @ fn () '((hex (h2n (x4)) (x0)) (dec64)));
do (insert! tohex-map 'd256 @ fn () '((hex (hex (h2n (x1)) (x0)) (x0)) (dec256)));
theorem d8mul8: $ 8 * 8 = 64 $ = norm_num;

theorem c2nlt256 (c: char): $ c < 256 $ = '(mpbi (lteq2 d16mul16) c2nlt);
theorem c2nlt256pow (c: char): $ c < 256 ^ suc k $ =
'(ltletr c2nlt256 @ mpbi (leeq1 pow12) @ lepow2a d256ne0 le11S);

theorem d8le32: $ 8 <= 32 $ = norm_num;
theorem d8le64: $ 8 <= 64 $ = norm_num;
theorem d8lt32: $ 8 < 32 $ = norm_num;
theorem d8lt64: $ 8 < 64 $ = norm_num;
theorem d16lt32: $ 16 < 32 $ = norm_num;
theorem d16lt64: $ 16 < 64 $ = norm_num;
theorem d16le64: $ 16 <= 64 $ = '(ltle d16lt64);
theorem d32le64: $ 32 <= 64 $ = norm_num;

@_ def Bits (k: nat): nat = $ upto (2 ^ k) $;

theorem Bitsle (m n v: nat): $ m <= n -> v e. Bits m -> v e. Bits n $ =
'(sylibr (imeqi elupto elupto) @ syl (com12 ltletr) @ lepow2a d2ne0);

theorem Bitsss (m n: nat): $ m <= n -> Bits m C_ Bits n $ = '(!! iald x Bitsle);

theorem Bits_eq_power: $ Bits n = power (upto n) $ = '(eqcom powerupto);

theorem elBits: $ a e. Bits n <-> a C_ upto n $ =
'(bitr (elneq2 Bits_eq_power) elpower);
theorem elBits2: $ a e. Bits n <-> a < 2 ^ n $ = 'elupto;

theorem elBitsS_el: $ a e. Bits (suc n) -> (a e. Bits n <-> ~n e. a) $ =
'(sylbi elBits @ sylbi (sseq2 @ nseq uptoS_ins) @
  syl5bb elBits @ ibid (a1i @ mpi ltirr @ con3d @ syl6ib elupto @ ssel) ssins);

theorem uptoT: $ upto n e. Bits n $ = '(mpbir elBits ssid);

theorem elBits8mul: $ n e. Bits (8 * k) <-> n < 256 ^ k $ =
'(bitr elBits2 @ lteq2 powmul);

theorem Bitsle1: $ v <= w -> w e. Bits n -> v e. Bits n $ =
'(sylibr (imeqi elBits2 elBits2) lelttr);

theorem Bits_mod: $ a e. Bits n -> a % 2 ^ n = a $ = '(sylbi elBits2 modlteq);
theorem Bits_eqm: $ a e. Bits n /\ b e. Bits n -> (mod(2 ^ n): a = b <-> a = b) $ =
'(eqeqd (anwl Bits_mod) (anwr Bits_mod));
theorem Bits_zeqm: $ a e. Bits n /\ b e. Bits n -> (modZ(2 ^ n): b0 a = b0 b <-> a = b) $ =
'(syl5bb zeqmeqm Bits_eqm);
theorem elBits0: $ a e. Bits 0 <-> a = 0 $ = '(bitr elBits2 @ bitr (lteq2 pow0) lt12);
theorem elBits01: $ 0 e. Bits n $ = '(mpbir elBits ss01);
theorem elBitsx01: $ x0 e. Bits n $ = '(mpbi (eleq1 dec0) elBits01);
theorem elBits1: $ a e. Bits 1 <-> bool a $ = '(bitr elBits2 @ lteq2 pow12);
theorem elBits11: $ 1 e. Bits n <-> n != 0 $ =
'(bitr4 elBits2 @ bitr3 lt01 @ bitr (ltpow2 d1lt2) (lteq1 pow0));
theorem Bits_zeqm_02: $ a e. Bits n -> (modZ(2 ^ n): b0 a = 0 <-> a = 0) $ =
'(syl5bbr (zeqmeq3 b00) @ mpand (a1i elBits01) Bits_zeqm);

theorem eq_bitAnd1: $ a C_ b <-> bitAnd a b = a $ = '(bitr eqin1 @ bitr3 (eqseq1 bitAndEq) nsinj);
theorem eq_bitAnd2: $ a C_ b <-> bitAnd b a = a $ = '(bitr eq_bitAnd1 @ eqeq1 bitAnd_sym);

theorem bitAndT1: $ a e. Bits n -> bitAnd a b e. Bits n $ =
'(sylbi elBits @ sylibr elBits @ sylibr (sseq1 bitAndEq) @ sstr inss1);
theorem bitAndT2: $ b e. Bits n -> bitAnd a b e. Bits n $ =
'(sylbi elBits @ sylibr elBits @ sylibr (sseq1 bitAndEq) @ sstr inss2);
theorem bitOrT: $ a e. Bits n /\ b e. Bits n <-> bitOr a b e. Bits n $ =
'(bitr4 (aneq elBits elBits) @ bitr elBits @ bitr (sseq1 bitOrEq) unss);
theorem bitDifT: $ a e. Bits n -> bitDif a b e. Bits n $ =
'(sylbi elBits @ sylibr elBits @ sylibr (sseq1 bitDifEq) @ sstr inss1);

theorem mulBitsT: $ a e. Bits m /\ b e. Bits n -> a * b e. Bits (m + n) $ =
'(sylibr elBits2 @ sylibr (lteq2 powadd) @ ltmuld (sylib elBits2 anl) (sylib elBits2 anr));

theorem shladdT: $ a e. Bits n /\ c e. Bits b -> shl a b + c e. Bits (n + b) $ =
'(sylibr elBits2 @ ltletrd (sylib ltadd2 @ sylib elBits2 anr) @
  sylib (leeq mulS1 @ eqcom powadd) @ syl lemul1a @
  sylib elBits2 anl);

theorem shlT: $ a e. Bits n -> shl a b e. Bits (n + b) $ =
'(sylib (eleq1 add0) @ mpi elBits01 @ exp shladdT);
theorem shlT2: $ a e. Bits n -> n + b <= c -> shl a b e. Bits c $ =
'(rsyl shlT @ com12 @ syl ssel Bitsss);
theorem shrT: $ a e. Bits (n + b) -> shr a b e. Bits n $ =
'(sylibr elBits @ sylbi elBits @ !! iald x @ syl5bi elshr @
  syl6ib (bitr4 elupto @ bitr elupto ltadd1) ssel);

theorem b1Bits: $ a e. Bits n <-> b1 a e. Bits (suc n) $ =
'(bitr4 elBits2 @ bitr elBits2 @ bitr (lteq2 @ eqtr powS b0mul21) b1ltb0);
theorem b0Bits: $ a e. Bits n <-> b0 a e. Bits (suc n) $ =
'(bitr4 elBits2 @ bitr elBits2 @ bitr4 (lteq2 @ eqtr powS b0mul21) b0lt);

theorem b0Bitsi (h1: $ a = b0 a2 $) (h2: $ a2 e. Bits n $): $ a e. Bits (suc n) $ =
'(mpbir (eleq1 h1) @ mpbi b0Bits h2);
theorem b1Bitsi (h1: $ a = b1 a2 $) (h2: $ a2 e. Bits n $): $ a e. Bits (suc n) $ =
'(mpbir (eleq1 h1) @ mpbi b1Bits h2);

theorem mod_el_Bits: $ a % 2 ^ k e. Bits k $ = '(mpbir elupto @ modlt pow2ne0);

theorem h2nT (h: hex): $ h e. Bits 4 $ =
'(mpbir elBits2 @ mpbir (lteq2 d2pow4) h2nlt);
theorem hexT: $ a e. Bits k -> a :x x e. Bits (k + 4) $ =
'(sylibr (eleq1 hexshl4) @ sylan shladdT id (a1i h2nT));
theorem hex2T: $ a e. Bits k -> a :x x :x y e. Bits (k + 8) $ =
'(sylib (elneq2 @ Bitseq @ eqtr addass @ addeq2 d4add4) @ syl hexT hexT);

theorem xelBits4S (h: $ n e. Bits (4 * k) $): $ n :x a e. Bits (4 * suc k) $ =
'(mpbir (elneq2 @ Bitseq mulS) (hexT h));
theorem xelBits41: $ h2n a e. Bits (4 * suc k) $ =
'(mpbi (eleq1 hex01_) @ xelBits4S elBits01);

--| `(to-elBits4 k n)` proves `n e. Bits (4 * k)`
do (def (to-elBits4 k n) @ match k
  [$suc ,k$ @ match n
    [$,n :x ,a$ '(xelBits4S ,a ,k ,n ,(to-elBits4 k n))]
    [$h2n ,a$ '(xelBits41 ,a ,k)]]);

theorem xelBits8S (h: $ n e. Bits (8 * k) $): $ n :x a1 :x a0 e. Bits (8 * suc k) $ =
'(mpbir (elneq2 @ Bitseq mulS) (hex2T h));
theorem xelBits82: $ h2n a1 :x a0 e. Bits (8 * suc k) $ =
'(mpbi (eleq1 @ hexeq1 hex01_) @ xelBits8S elBits01);
theorem xelBits81: $ h2n a0 e. Bits (8 * suc k) $ =
'(mpbi (eleq1 hex01) xelBits82);

--| `(to-elBits8 k n)` proves `n e. Bits (8 * k)`
do (def (to-elBits8 k n) @ match k
  [$suc ,k$ @ match n
    [$,n :x ,a1 :x ,a0$ '(xelBits8S ,a0 ,a1 ,k ,n ,(to-elBits8 k n))]
    [$h2n ,a1 :x ,a0$ '(xelBits82 ,a0 ,a1 ,k)]
    [$h2n ,a0$ '(xelBits81 ,a0 ,k)]]);

theorem xelBits7S (h: $ n e. Bits (8 * k + 7) $): $ n :x a1 :x a0 e. Bits (8 * suc k + 7) $ =
'(mpbir (elneq2 @ Bitseq @ eqtr (addeq1 mulS) addrass) (hex2T h));
theorem xelBits72S: $ h2n a1 :x a0 e. Bits (8 * suc k + 7) $ =
'(mpbi (elneq (hexeq1 hex01_) @ Bitseq @ eqtr4 addrass @ addeq1 mulS) (hex2T elBits01));
theorem xelBits720 (h: $ a1 < x8 $): $ h2n a1 :x a0 e. Bits (8 * 0 + 7) $ =
'(mpbi (elneq2 @ Bitseq {,norm_num : $ 3 + 4 = _ $})
  (hexT @ mpbir elBits2 @ mpbir (lteq2 @ eqtr d2pow3 dec8) h));
theorem xelBits71: $ h2n a0 e. Bits (8 * k + 7) $ =
'(Bitsle (letr {,norm_num : $ 4 <= 7 $} leaddid2) h2nT);

--| `(to-elBits7 k n)` proves `n e. Bits (8 * k + 7)`
do (def (to-elBits7 k n) @ match n
  [$,n :x ,a1 :x ,a0$ @ match k
    [$suc ,k$ '(xelBits7S ,a0 ,a1 ,k ,n ,(to-elBits7 k n))]]
  [$h2n ,a1 :x ,a0$ @ match k
    [$suc ,k$ '(xelBits72S ,a0 ,a1 ,k)]
    [$0$ '(xelBits720 ,a0 ,a1 ,(atom-app 'declt (hexstring (hex->number a1)) 8))]]
  [$h2n ,a0$ '(xelBits71 ,a0 ,k)]);

@_ def u8: nat = $ Bits 8 $;
@_ def u16: nat = $ Bits 16 $;
@_ def u32: nat = $ Bits 32 $;
@_ def u64: nat = $ Bits 64 $;

theorem d0elu8: $ 0 e. u8 $ = 'elBits01;
theorem d0elu16: $ 0 e. u16 $ = 'elBits01;
theorem d0elu32: $ 0 e. u32 $ = 'elBits01;
theorem d0elu64: $ 0 e. u64 $ = 'elBits01;

theorem u32ss64: $ u32 C_ u64 $ = '(Bitsss d32le64);
theorem u16ss64: $ u16 C_ u64 $ = '(Bitsss d16le64);
theorem u8ss32: $ u8 C_ u32 $ = '(Bitsss d8le32);
theorem u8ss64: $ u8 C_ u64 $ = '(Bitsss d8le64);
theorem u8ss16: $ u8 C_ u16 $ = '(Bitsss @ ltle d8lt16);

theorem u64le1: $ v <= w -> w e. u64 -> v e. u64 $ = 'Bitsle1;

theorem elu8: $ n e. u8 <-> n < 16 * 16 $ = '(bitr elBits2 @ lteq2 d2pow8);
theorem elu8_2: $ n e. u8 <-> n < 256 $ = '(bitr elu8 @ lteq2 d16mul16);
theorem elu8_3: $ n e. u8 <-> n < 256 ^ 1 $ = '(bitr4 elu8_2 @ lteq2 pow12);
theorem c2nT (c: char): $ c e. u8 $ = '(mpbir elu8 c2nlt);
theorem elu8_lem (h: $ n < ,256 $): $ n e. u8 $ =
'(mpbir elBits2 @ mpbir (lteq2 d2pow8x) h);
theorem d1elu8: $ 1 e. u8 $ = '(elu8_lem ,norm_num);
theorem d2elu8: $ 2 e. u8 $ = '(elu8_lem ,norm_num);
theorem d1elu32: $ 1 e. u32 $ = '(ssel u8ss32 d1elu8);

theorem mod_el_u8: $ a % 256 e. u8 $ = 'mod_el_Bits;

theorem elu16: $ n e. u16 <-> n < 256 ^ 2 $ =
'(bitr (elneq2 @ Bitseq {,norm_num : $ 16 = 8 * 2 $}) elBits8mul);
theorem elu32: $ n e. u32 <-> n < 256 ^ 4 $ =
'(bitr (elneq2 @ Bitseq {,norm_num : $ 32 = 8 * 4 $}) elBits8mul);
theorem elu64: $ n e. u64 <-> n < 256 ^ 8 $ =
'(bitr (elneq2 @ Bitseq {,norm_num : $ 64 = 8 * 8 $}) elBits8mul);

theorem xu8Byte_2 (a0 a1: hex): $ ch a1 a0 = a1 :x a0 $ = 'c2nhex;
theorem xu8Byte_1 (a0: hex): $ ch x0 a0 = a0 $ = 'c2nh2n;
theorem xelu8_1 (a0: hex): $ a0 e. u8 $ = '(mpbi (eleq1 xu8Byte_1) c2nT);
theorem xelu8_2 (a0 a1: hex): $ a1 :x a0 e. u8 $ = '(mpbi (eleq1 xu8Byte_2) c2nT);

theorem xeluNlem (e: $ 8 * k = n $) (h: $ a e. Bits (8 * k) $): $ a e. Bits n $ =
'(mpbi (elneq2 @ Bitseq e) h);
theorem xelu8i (h: $ a e. Bits (8 * suc 0) $): $ a e. u8 $ = '(xeluNlem mul12 h);
theorem xelu16i (h: $ a e. Bits (8 * ,(sucs 2)) $): $ a e. u16 $ = '(xeluNlem d8mul2 h);
theorem xelu32i (h: $ a e. Bits (8 * ,(sucs 4)) $): $ a e. u32 $ = '(xeluNlem d8mul4 h);
theorem xelu64i (h: $ a e. Bits (8 * ,(sucs 8)) $): $ a e. u64 $ = '(xeluNlem d8mul8 h);

--| `(to-elu N a)` returns a proof that `a` is a hex literal in uN: `a e. uN`
--| assuming `N = 8,16,32,64`
do (def (to-elu n a)
  '(,(atom-app 'xelu n 'i) ,a ,(to-elBits8 (sucs {n // 8}) a)));

theorem xelBits7b0 (h: $ a e. Bits (8 * k + 7) $): $ b0 a e. Bits (8 * suc k) $ =
'(mpbir (elneq2 @ Bitseq @ eqtr mulS addS2) @ mpbi b0Bits h);
theorem xelBits7b1 (h: $ a e. Bits (8 * k + 7) $): $ b1 a e. Bits (8 * suc k) $ =
'(mpbir (elneq2 @ Bitseq @ eqtr mulS addS2) @ mpbi b1Bits h);
theorem xelu8b0i (h: $ a e. Bits (8 * 0 + 7) $): $ b0 a e. u8 $ = '(xelu8i @ xelBits7b0 h);
theorem xelu8b1i (h: $ a e. Bits (8 * 0 + 7) $): $ b1 a e. u8 $ = '(xelu8i @ xelBits7b1 h);
theorem xelu16b0i (h: $ a e. Bits (8 * ,(sucs 1) + 7) $): $ b0 a e. u16 $ = '(xelu16i @ xelBits7b0 h);
theorem xelu16b1i (h: $ a e. Bits (8 * ,(sucs 1) + 7) $): $ b1 a e. u16 $ = '(xelu16i @ xelBits7b1 h);
theorem xelu32b0i (h: $ a e. Bits (8 * ,(sucs 3) + 7) $): $ b0 a e. u32 $ = '(xelu32i @ xelBits7b0 h);
theorem xelu32b1i (h: $ a e. Bits (8 * ,(sucs 3) + 7) $): $ b1 a e. u32 $ = '(xelu32i @ xelBits7b1 h);
theorem xelu64b0i (h: $ a e. Bits (8 * ,(sucs 7) + 7) $): $ b0 a e. u64 $ = '(xelu64i @ xelBits7b0 h);
theorem xelu64b1i (h: $ a e. Bits (8 * ,(sucs 7) + 7) $): $ b1 a e. u64 $ = '(xelu64i @ xelBits7b1 h);

--| `(to-eli N a)` returns a proof that `a` is a signed hex literal in uN: `a e. uN`
--| assuming `N = 8,16,32,64`
do (def (to-eli n a) @ match a
  [$0$ '(,(atom-app 'd0elu n))]
  [$b0 ,a$ '(,(atom-app 'xelu n 'b0i) ,a ,(to-elBits7 (sucs {{n // 8} - 1}) a))]
  [$b1 ,a$ '(,(atom-app 'xelu n 'b1i) ,a ,(to-elBits7 (sucs {{n // 8} - 1}) a))]);

--| Get the lower bits of a number
@(add-eval @ fn (k n) {(eval n) band {{1 shl (eval k)} - 1}})
@_ def chop (k n: nat): nat = $ n % 2 ^ k $;
pub theorem chopT (k n: nat): $ chop k n e. Bits k $ = '(mpbir elupto @ modlt pow2ne0);

theorem chop01: $ chop 0 n = 0 $ = '(mpbi elBits0 chopT);
theorem chop02: $ chop k 0 = 0 $ = 'mod01;
theorem el_chop: $ a e. chop k n <-> a < k /\ a e. n $ = 'elmodpow2;
theorem bit_chop: $ a < k -> bit (chop k n) a = bit n a $ =
'(nateqd @ syl5bb el_chop bian1);
theorem bit_chop_0: $ ~a < k -> bit (chop k n) a = 0 $ =
'(sylibr nateq0 @ con3 @ sylbi el_chop anl);
theorem chopT_min: $ a e. Bits m -> chop k a e. Bits (min m k) $ =
(named '(sylibr elBits @ iald @ syl5bi el_chop @ exp @ sylibr elupto @
  sylibr ltmin @ iand (sylib elupto @ sylc ssel (sylib elBits anl) anrr) anrl));

theorem bitAnd_upto: $ bitAnd (upto k) a = chop k a $ =
'(axext @ !! ax_gen x @ bitr4 elbitAnd @ bitr4 el_chop @ aneq1i elupto);

theorem chop_upto: $ m <= k <-> chop m (upto k) = upto m $ =
'(bitr3 uptoss @ bitr eq_bitAnd1 @ eqeq1 bitAnd_upto);

theorem shlshr_chop: $ shl (shr n k) k + chop k n = n $ = '(eqtr (addeq1 mulcom) divmod);

theorem chop_shl_0: $ m <= k -> chop m (shl a k) = 0 $ =
'(syl axext @ sylib ss02 @ !! iald x @ syl5bi el_chop @ impd @
  syl6 (syl5bi elshl @ sylbi ltnle @ syl5 anl absurd) @ com12 ltletr);

theorem shladd_uniq: $ a e. Bits k /\ shl m k + a = n <-> shr n k = m /\ chop k n = a $ =
'(ibii (eqdivmod (sylib elBits2 anl) @ syl5eq (addeq1 mulcom) anr) @
  mpbii (ian chopT shlshr_chop) ,(eqtac-with #f));

theorem chop_shladd: $ b e. Bits k -> chop k (shl a k + b) = b $ =
'(anrd @ sylib shladd_uniq @ iand id eqidd);
theorem chop4hex: $ chop 4 (a :x b) = b $ = '(eqtr (chopeq2 hexshl4) @ chop_shladd h2nT);
theorem chop_shladd2: $ chop k (shl a k + b) = chop k b $ = '(muladdmod1 pow2ne0);

theorem Bits_chop: $ a e. Bits k -> chop k a = a $ = 'Bits_mod;
theorem eqm_chop: $ mod(2 ^ k): chop k a = a $ = 'eqmmod;
theorem zeqm_chop: $ modZ(2 ^ k): b0 (chop k a) = b0 a $ = '(mpbir zeqmeqm eqm_chop);
theorem chop_eq_chop: $ chop k a = chop k b <-> mod(2 ^ k): a = b $ = 'biid;
theorem chop_eq_chop2: $ chop k a = chop k b <-> modZ(2 ^ k): b0 a = b0 b $ =
'(bitr4 chop_eq_chop zeqmeqm);

theorem chop_chop: $ m <= n -> chop m (chop n a) = chop m a $ = '(syl modmod powdvd);

theorem chop_shl: $ shl (chop n a) k = chop (n + k) (shl a k) $ =
'(eqtr4 mulmoddir @ modeq2 powadd);
theorem chop_shr: $ shr (chop (n + k) a) k = chop n (shr a k) $ =
'(eqtr4 (diveq1 @ modeq2 powadd) divmod2);
theorem chop_shr2: $ shr (chop (k + n) a) k = chop n (shr a k) $ =
'(eqtr (shreq1 @ chopeq1 addcom) chop_shr);

theorem chop_bitAnd1: $ chop m (bitAnd a b) = bitAnd (chop m a) b $ =
'(eqtr3 bitAnd_upto @ eqtr3 bitAnd_ass @ bitAndeq1 bitAnd_upto);
theorem chop_bitAnd2: $ chop m (bitAnd a b) = bitAnd a (chop m b) $ =
'(eqtr (chopeq2 bitAnd_sym) @ eqtr chop_bitAnd1 bitAnd_sym);
theorem chop_bitAnd: $ chop m (bitAnd a b) = bitAnd (chop m a) (chop m b) $ =
'(eqtr3 (chop_chop leid) @ eqtr (chopeq2 chop_bitAnd1) chop_bitAnd2);
theorem chop_bitOr: $ chop m (bitOr a b) = bitOr (chop m a) (chop m b) $ =
'(eqtr3 bitAnd_upto @ eqtr bitAnd_di @ bitOreq bitAnd_upto bitAnd_upto);
theorem chop_bitDif1: $ chop m (bitDif a b) = bitDif (chop m a) b $ =
'(eqtr3 bitAnd_upto @ eqtr3 bitDifAnd @ bitDifeq1 bitAnd_upto);
theorem chop_bitDif: $ chop m (bitDif a b) = bitDif (chop m a) (chop m b) $ =
'(eqtr4 chop_bitDif1 @ eqtr3 (bitDifeq2 bitAnd_upto) @ bitDifAndss @ mpbi elBits chopT);

theorem shl_bitAnd: $ shl (bitAnd a b) m = bitAnd (shl a m) (shl b m) $ =
'(axext @ !! ax_gen x @ bitr4 elshl @ bitr4 elbitAnd @
  bitr (aneq2i elbitAnd) @ bitr4 anandi @ aneq elshl elshl);
theorem shl_bitOr: $ shl (bitOr a b) m = bitOr (shl a m) (shl b m) $ =
'(axext @ !! ax_gen x @ bitr4 elshl @ bitr4 elbitOr @
  bitr (aneq2i elbitOr) @ bitr4 andi @ oreq elshl elshl);
theorem shl_bitDif: $ shl (bitDif a b) m = bitDif (shl a m) (shl b m) $ =
'(axext @ !! ax_gen x @ bitr4 elshl @ bitr4 elbitDif @
  bitr4 (aneq2i elbitDif) @ bitr (aneq elshl @ noteq elshl) @
  bitr anass @ aneq2a @ aneq2d @ noteqd bian1);
theorem shr_bitAnd: $ shr (bitAnd a b) m = bitAnd (shr a m) (shr b m) $ =
'(axext @ !! ax_gen x @ bitr4 elshr @ bitr4 elbitAnd @ bitr4 elbitAnd @ aneq elshr elshr);
theorem shr_bitOr: $ shr (bitOr a b) m = bitOr (shr a m) (shr b m) $ =
'(axext @ !! ax_gen x @ bitr4 elshr @ bitr4 elbitOr @ bitr4 elbitOr @ oreq elshr elshr);
theorem shr_bitDif: $ shr (bitDif a b) m = bitDif (shr a m) (shr b m) $ =
'(axext @ !! ax_gen x @ bitr4 elshr @ bitr4 elbitDif @ bitr4 elbitDif @ aneq elshr @ noteq elshr);

theorem eqm_chopd (h: $ G -> mod(2 ^ k): a = b $):
  $ G -> mod(2 ^ k): chop k a = b $ = '(syl (eqmtr eqm_chop) h);
theorem zeqm_chopd (h: $ G -> modZ(2 ^ k): b0 a = b $):
  $ G -> modZ(2 ^ k): b0 (chop k a) = b $ = '(syl (zeqmtr zeqm_chop) h);

theorem zeqm_chop1: $ b e. Bits n -> (modZ(2 ^ n): b0 a = b0 b <-> chop n a = b) $ =
'(syl5bbr (zeqmeqm2 zeqm_chop) @ rsyl (ian chopT) Bits_zeqm);
theorem zeqm_chop2: $ a e. Bits n -> (modZ(2 ^ n): b0 a = b0 b <-> a = chop n b) $ =
'(syl5bbr (zeqmeqm3 zeqm_chop) @ mpand (a1i chopT) Bits_zeqm);

@(add-eval @ fn (k n) {(evalZ n) band {{1 shl (eval k)} - 1}})
@_ local def chopZ (k n: nat): nat = $ n %Z 2 ^ k $;
theorem chopZT (k n: nat): $ chopZ k n e. Bits k $ = 'chopT;

theorem chopZ_b0: $ chopZ k (b0 a) = chop k a $ = 'zmodb0;
theorem zeqm_chopZ: $ modZ(2 ^ k): b0 (chopZ k a) = a $ = '(zeqmmod pow2ne0);
theorem zeqm_chopZd (h: $ G -> modZ(2 ^ k): a = b $):
  $ G -> modZ(2 ^ k): b0 (chopZ k a) = b $ = '(syl (zeqmtr zeqm_chopZ) h);

theorem chopZ_eq_chopZ: $ chopZ k a = chopZ k b <-> modZ(2 ^ k): a = b $ = '(zmodeqmod pow2ne0);

theorem chopZ_b1: $ a e. Bits k -> chopZ k (b1 a) = 2 ^ k - suc a $ = '(sylbi elBits2 zmodb1);
theorem chopZ_b1_2: $ a e. Bits k -> chopZ k (b1 a) + suc a = 2 ^ k $ =
'(eqtrd (addeq1d chopZ_b1) @ sylbi elBits2 npcan);

theorem hex_divmod256:
  $ a :x b :x c // 256 = a /\ a :x b :x c % 256 = b :x c $ =
'(trud @ eqdivmod (a1i @ mpbi elu8_2 @ mpbi (eleq1 c2nch) c2nT) @
  a1i @ eqtr3 addass @ addeq1 @
  eqtr4 (addeq1 @ eqtr4 mulcom @ eqtr mulass @ muleq2 d16mul16) addmul);
theorem xchopshr8: $ shr (a :x b :x c) 8 = a /\ chop 8 (a :x b :x c) = b :x c $ = 'hex_divmod256;

theorem s2nT (s: string): $ s e. List u8 $ =
'(mpbir elList @ mpbir (alleq1 @ !! eqab2i n elu8) s2nstr);

@(add-eval @ fn (k n) @ match (eval k) [0 #f] [k {{{(eval n) shr {k - 1}} band 1} = 1}])
@_ def bitsMSB (k n: nat): wff = $ 0 < k /\ k - 1 e. n $;

theorem bitsMSB_b0: $ bitsMSB k n <-> k e. b0 n $ = '(bicom elb0);

theorem bitsMSB_Bits: $ n e. Bits k -> (bitsMSB k n <-> ~n e. Bits (k - 1)) $ =
'(syl con2b @ casesda
  (bithd (mpbiri elBits01 @ eleq1d @ sylib elBits0 @ impcom @ bi1d @ elneq2d Bitseq)
    (anwr @ con2 @ sylib lt01 anl))
  (bitr4d (syl elBitsS_el @ impcom @ bi2d @ elneq2d @ Bitseqd sub1can)
    (noteqd @ syl bian1 @ sylibr lt01 anr)));

theorem bitsMSB_le: $ n e. Bits k -> (bitsMSB k n <-> 2 ^ (k - 1) <= n) $ =
'(syl6bbr lenlt @ syl6bb (noteq elBits2) bitsMSB_Bits);

theorem chopZ_MSB: $ a e. Bits k -> (bitsMSB k (chopZ k a) <-> odd a) $ =
(focus
  (have 'h '(Bitsle1 divleid))
  (def h2 '(mpbid (elneqd anr @ Bitseqd @ eqcomd @ syl sub1can anlr) anll))
  '(casesda _ @ ibid _ _)
  '(binthd (anwr @ con2 @ sylib lt01 anl) @ mpbiri odd0 @
    noteqd @ oddeqd @ sylib elBits0 @ impcom @ bi1d @ elneq2d Bitseq)
  '(syl5bi (bitsMSB_Bits chopZT) @ con1d @ syl5bi eqb0 @ exp @
    mpbird (eleq1d @ eqtrd (chopZeq2d anr) @ syl5eq chopZ_b0 @ syl Bits_chop @ anwll h) @
    sylibr b0Bits ,h2)
  '(syl5bi eqb1 @ exp @ sylibr (bitsMSB_le chopZT) @
    mpbird (leeq2d @ eqtrd (chopZeq2d anr) @ syl chopZ_b1 @ anwll h) @
    sylib (leeq1 pncan) @ syl lesub1i @
    mpbid (leeq2d @ syl5eqr mul21 @ syl5eqr powS @ poweq2d @ syl sub1can anlr) @
    sylib leadd2 @ sylib elBits2 @ sylibr b1Bits ,h2));

theorem Bits_zeqm2: $ a e. Bits n /\ b e. Bits n -> (modZ(2 ^ n): a = b <-> a = b) $ =
(focus
  (have 'h $ _ -> (odd a <-> odd b) $
    '(bitr3d (anwll chopZ_MSB) @ bitrd (bitsMSBeq2d anr) (rsyl anlr chopZ_MSB)))
  '(syl5bbr chopZ_eq_chopZ @ ibid (exp @ casesda _ _) @ a1i chopZeq2)
  (focus
    (have 'h1 '(sylib eqb1 anr))
    (have 'h2 '(sylib eqb1 @ imp @ bi1d h))
    '(eqtr4d h1 @ eqtr4d h2 @ b1eqd @ sylib peano2 @ sylib addcan2 @
      eqtr4d (syl chopZ_b1_2 @ rsyl an3l @ Bitsle1 divleid) @
      eqtrd (addeq1d @ eqtr3d (chopZeq2d h1) @ eqtrd anlr (chopZeq2d h2)) @
      syl chopZ_b1_2 @ rsyl anllr @ Bitsle1 divleid))
  (focus
    (have 'h3 '(sylib eqb0 anr))
    (have 'h4 '(sylib eqb0 @ imp @ con3d @ bi2d h))
    '(eqtr4d h3 @ eqtr4d h4 @ b0eqd @
      mpbid (sylan Bits_eqm (rsyl an3l @ Bitsle1 divleid) (rsyl anllr @ Bitsle1 divleid)) @
      eqtr3g chopZ_b0 chopZ_b0 @ eqtr3d (chopZeq2d h3) @ eqtrd anlr (chopZeq2d h4))));

--| Sign extend `(v: bitvec m)` to length `n`
@_ def sExt (m n v: nat): nat = $ if (bitsMSB m v) (2 ^ n - 2 ^ m + v) v $;
@_ def sExtq (n v: nat): nat = $ sExt n 64 v $;

pub theorem sExtT (m n v: nat): $ m <= n /\ v e. Bits m -> sExt m n v e. Bits n $ =
'(casesda
  (mpbird (eleq1d @ anwr ifpos) @
    sylibr elupto @ mpbid (lteq2d @ syl npcan @ anwll @ lepow2a d2ne0) @
    sylib ltadd2 @ sylib elupto anlr)
  (mpbird (eleq1d @ anwr ifneg) @ anwl @ imp Bitsle));

pub theorem sExtqT (n v: nat): $ n <= 64 /\ v e. Bits n -> sExtq n v e. u64 $ = 'sExtT;

theorem sExt_chopZ: $ m <= n /\ a e. Bits m -> sExt m n (chopZ m a) = chopZ n a $ =
(focus
  (have 'h0 '(anwr @ Bitsle1 b0leid))
  (have 'h1 '(anwr @ Bitsle1 b1leid))
  '(imp ,(split-sop 'a (fn (x) '(syl5ibrcom ,eqtac @ exp ,x)) '{
    ($b0 x$ => (eqtrd (syl ifneg @ mpbiri b0odd @ noteqd @ anwr chopZ_MSB) @
      eqtr4g chopZ_b0 chopZ_b0 @
      eqtr4d (syl Bits_chop h0) (syl Bits_chop @ sylc Bitsle anl h0))) +
    ($b1 x$ => (eqtrd (syl ifpos @ mpbiri b1odd @ anwr chopZ_MSB) @
      eqtr4d (addeq2d @ syl chopZ_b1 h1) @ eqtr4d (syl chopZ_b1 @ sylc Bitsle anl h1) @
      eqcomd @ syl eqsub1 @ syl5eq addass @
      eqtrd (addeq2d @ syl npcan @ sylib elBits2 h1) @
      anwl @ syl npcan @ lepow2a d2ne0))})));

--| Write `a e. Bits m` to bits `k` thru `k+m-1` of `n`
@_ def bitsUpdate (k m a n: nat): nat = $ bitDif n (shl (upto m) k) + shl a k $;
pub theorem bitsUpdateT (k m l a n: nat):
  $ k + m <= l /\ a e. Bits m /\ n e. Bits l -> bitsUpdate k m a n e. Bits l $ =
'(mpbid (eleq1d @ syl bitOr_eq_add @ sylibr ineq0 @
    sylibr (sseq1 bitDifEq) @ syl (sstr inss2) @
    sylib sscpl @ sylib shlss @ sylib elBits anlr) @
  sylib bitOrT @ iand (anwr bitDifT) (sylc shlT2 anlr @ sylib (leeq1 addcom) anll));

theorem bitsUpdate_or: $ a e. Bits m ->
  bitsUpdate k m a n = bitOr (bitDif n (shl (upto m) k)) (shl a k) $ =
'(eqcomd @ syl bitOr_eq_add @ sylibr ineq0 @ sylibr (sseq1 bitDifEq) @
  sylbi elBits @ sylbi shlss @ sylbi sscpl @ sstr inss2);

theorem shr_bitsUpdate:
  $ shr (bitsUpdate (k + i) m a n) i = bitsUpdate k m a (shr n i) $ =
'(eqtr (shreq1 @ eqtr4 addcom @ addeq1 shlshl) @ eqtr shrshladd @
  eqtr addcom @ addeq1 @ eqtr shr_bitDif @
  bitDifeq2 @ eqtr3 (shreq1 shlshl) shrshlid);

theorem chop_bitsUpdate_2: $ k + i = j -> a e. Bits m ->
  chop j (bitsUpdate k m a n) = bitsUpdate k m (chop i a) (chop j n) $ =
'(exp @ eqtr4d (chopeq2d @ anwr bitsUpdate_or) @
  eqtr4d (syl bitsUpdate_or @ anwr @ rsyl chopT_min @ ssel @ Bitsss minle1) @
  syl5eq chop_bitOr @ bitOreqd (a1i chop_bitDif1) @
  eqcomd @ syl5eq chop_shl @ chopeq1d @ syl5eq addcom anl);

theorem chop_bitsUpdate_id:
  $ chop k (bitsUpdate k m a n) = chop k n $ =
'(eqtr (chopeq2 addcom) @ eqtr chop_shladd2 @ eqtr chop_bitDif @
  eqtr (bitDifeq2 @ chop_shl_0 leid) bitDif02);

theorem chop_bitsUpdate_1: $ i <= k -> chop i (bitsUpdate k m a n) = chop i n $ =
'(eqtr3d chop_chop @ syl5eq (chopeq2 chop_bitsUpdate_id) chop_chop);

theorem bitsUpdate01: $ bitsUpdate 0 m a n = bitDif n (upto m) + a $ =
'(addeq (bitDifeq2 shl02) shl02);

theorem bitsUpdate01_: $ bitsUpdate 0 m a n = shl (shr n m) m + a $ =
'(eqtr bitsUpdate01 @ addeq1 bitDif_upto);

theorem el_bitsUpdate_1: $ i < k -> (i e. bitsUpdate k m a n <-> i e. n) $ =
'(bitr3d bian1 @ syl5bb (bitr3 el_chop @ bitr (elneq2 chop_bitsUpdate_id) el_chop) bian1);

theorem el_bitsUpdate_2: $ i < m -> (k + i e. bitsUpdate k m a n <-> i e. a) $ =
'(syl5bb (eleq1 addcom) @ syl5bbr elshr @
  syl5bb (elneq2 @ eqtr3 (shreq1 @ bitsUpdateeq1 add01) @ eqtr shr_bitsUpdate bitsUpdate01_) @
  bitr3d bian1 @ syl5bbr el_chop @ syl5bb (elneq2 chop_shladd2) @ syl5bb el_chop bian1);

theorem el_bitsUpdate_3: $ a e. Bits m /\ k + m <= i ->
  (i e. bitsUpdate k m a n <-> i e. n) $ =
(focus
  (def (f x) '(imp @ con2d @ syl5bi elshl @ exp @ sylib ltnle @
    mpbid (syl ltsubadd2 anrl) @ sylib elupto @ sylc ssel (sylib elBits ,x) anrr))
  '(bitrd (elneq2d @ anwl bitsUpdate_or) @ syl5bb elbitOr @
    bitrd (syl bior2 ,(f 'anl)) @ syl5bb elbitDif @ syl bian2 ,(f '(a1i uptoT))));

theorem el_bitsUpdate1_eq: $ k e. bitsUpdate k 1 (nat p) n <-> p $ =
'(bitr3 (eleq1 add0) @ bitr (el_bitsUpdate_2 d0lt1) @ bitr el01 oddnat);
theorem el_bitsUpdate1_ne: $ i != k -> (i e. bitsUpdate k 1 (nat p) n <-> i e. n) $ =
'(sylbi neltlt @ eor el_bitsUpdate_1 @ sylbir (leeq1 add12) @
  exp el_bitsUpdate_3 @ mpbir elBits1 boolnat);

@(add-eval @ fn (n v) @ match (eval k) [0 #f] [k {{{(eval n) shr {k - 1}} band 1} = 1}])
@_ def bitsNot (k n: nat): nat = $ bitDif (upto k) n $;
pub theorem bitsNot_mem (k n i: nat): $ i e. bitsNot k n <-> i < k /\ ~i e. n $ =
'(bitr elbitDif @ aneq1i elupto);

pub theorem bitsNotT (k n: nat): $ bitsNot k n e. Bits k $ = '(bitDifT uptoT);

theorem bitsNot_chop: $ bitsNot k (chop k n) = bitsNot k n $ =
'(eqtr3 (bitsNoteq2 bitAnd_upto) bitDifAndid);

theorem bitsNot_add: $ n e. Bits k -> bitsNot k n + n = upto k $ = '(sylbi elBits bitDifadd);
theorem bitsNot_sub: $ n e. Bits k -> bitsNot k n = upto k - n $ = '(sylbi elBits bitDifsub);
theorem bitsNot0: $ bitsNot k 0 = upto k $ = '(eqtr (bitsNot_sub elBits01) sub02);
theorem bitsNot01: $ bitsNot 0 n = 0 $ = '(eqtr (bitDifeq1 upto0) bitDif01);

theorem chop_bitsNot: $ m <= k -> chop m (bitsNot k n) = bitsNot m n $ =
'(syl5eq chop_bitDif1 @ sylbi chop_upto bitDifeq1);
theorem shl_bitsNot: $ shl (bitsNot k a) m + upto m = bitsNot (k + m) (shl a m) $ =
'(eqtr3 (addeq1 @ shleq1 bitsNot_chop) @ eqtr (mpbi addcan1 @
  eqtr4 addrass @ eqtr4 (eqtr4 (bitsNot_add chopT) shlupto) @ addeq1 @
  eqtr3 (addeq2 chop_shl) @ eqtr3 shladd @ shleq1 @ bitsNot_add chopT) bitsNot_chop);
theorem shr_bitsNot: $ shr (bitsNot k a) m = bitsNot (k - m) (shr a m) $ =
'(eqtr shr_bitDif @ bitDifeq1 shrupto);

theorem zeqm_bitsNot: $ modZ(2 ^ k): b0 (bitsNot k n) = -uZ b0 (suc n) $ =
'(zeqmtr
  (mpbi zeqmsub @ mpbir (zeqmeq2 @ eqtr zsubneg2 @ eqtr zaddb0 @
    b0eq @ eqtr addS @ eqtr (suceq @ eqtr3 (addeq1 bitsNot_chop) @ bitsNot_add chopT) @
    sucupto) zeqmid0)
  (mpbir zeqmneg @ mpbir zeqmeqm @ mpbir eqmsuc eqm_chop));

theorem zeqm_bitsNot2: $ modZ(2 ^ k): b0 (bitsNot k n) = b1 n $ =
'(zeqmtr zeqm_bitsNot @ eqzeqm znegb0S);

theorem chopZ_b1_bitsNot: $ chopZ k (b1 n) = bitsNot k n $ =
'(mpbi (Bits_zeqm @ ian chopZT bitsNotT) @ zeqmtr zeqm_chopZ @ zeqmcom zeqm_bitsNot2);

theorem zeqm_bitsNotd
  (h1: $ G -> modZ(2 ^ k): b0 a = x $):
  $ G -> modZ(2 ^ k): b0 (bitsNot k a) = -uZ (x +Z b0 1) $ =
'(syl (zeqmtr zeqm_bitsNot) @ sylibr zeqmneg @
  sylib (zeqmeq2 @ eqtr zaddb0 @ b0eq add12) @ zeqmadd1d h1);

theorem bitsNot4_h2n (a: hex): $ bitsNot 4 a + a = xf $ =
'(eqtr (bitsNot_add h2nT) @ upto4);
theorem bitsNot4_hex: $ bitsNot 4 (a :x b) + b = xf $ =
'(eqtr (addeq1 @ eqtr3 bitsNot_chop @ bitsNoteq2 chop4hex) bitsNot4_h2n);

theorem bitsNot_hex: $ b + c = xf -> bitsNot (k + 4) (a :x b) = bitsNot k a :x c $ =
'(syl5eqr shlshr_chop @ syl6eqr hexshl4 @
  addeqd (a1i @ shleq1 @ eqtr shr_bitsNot @ bitsNoteq pncan shrhex4)
   (syl5eq (chop_bitsNot leaddid2) @ sylib addcan1 @ syl6eq addcom @
    eqtr4d (a1i bitsNot4_hex) id));

theorem xbitNotS (h0: $ a + b = xf $) (h1: $ c = bitsNot k n $):
  $ c :x b = bitsNot (k + 4) (n :x a) $ = '(eqtr4 (hexeq1 h1) (bitsNot_hex h0));
theorem xbitNot1 (h0: $ a + h2n b = xf $): $ b = bitsNot 4 (n :x a) $ =
'(eqtr3 hex01_ @ eqtr (xbitNotS h0 @ eqcom bitsNot01) @ bitsNoteq1 add01);
theorem xbitNot_ch (h0: $ a0 + c0 = xf $) (h1: $ a1 + c1 = xf $):
  $ c2n (ch c1 c0) = bitsNot 8 (n :x a1 :x a0) $ =
'(eqtr c2nch @ eqtr (xbitNotS h0 @ xbitNot1 h1) @ bitsNoteq1 d4add4);

@(add-eval @ fn (k a b) {{(eval a) + (eval b)} band {{1 shl (eval k)} - 1}})
@_ def bitsAdd (k a b: nat): nat = $ chop k (a + b) $;
pub theorem bitsAddT (k a b: nat): $ bitsAdd k a b e. Bits k $ = 'chopT;

theorem bitsAdd_eqid: $ a + b e. Bits k -> bitsAdd k a b = a + b $ = 'Bits_chop;
theorem eqm_bitsAdd: $ mod(2 ^ k): bitsAdd k a b = a + b $ = 'eqm_chop;
theorem zeqm_bitsAdd: $ modZ(2 ^ k): b0 (bitsAdd k a b) = b0 a +Z b0 b $ =
'(mpbir (zeqmeq3 zaddb0) @ mpbir zeqmeqm eqm_bitsAdd);
theorem eqm_bitsAddd
  (h1: $ G -> mod(2 ^ k): a = x $) (h2: $ G -> mod(2 ^ k): b = y $):
  $ G -> mod(2 ^ k): bitsAdd k a b = x + y $ =
'(syl (eqmtr eqm_bitsAdd) @ eqmaddd h1 h2);
theorem zeqm_bitsAddd
  (h1: $ G -> modZ(2 ^ k): b0 a = x $) (h2: $ G -> modZ(2 ^ k): b0 b = y $):
  $ G -> modZ(2 ^ k): b0 (bitsAdd k a b) = x +Z y $ =
'(syl (zeqmtr zeqm_bitsAdd) @ zeqmaddd h1 h2);

theorem bitsAdd02: $ bitsAdd k 0 a = chop k a $ = '(chopeq2 add01);
theorem bitsAdd03: $ bitsAdd k a 0 = chop k a $ = '(chopeq2 add0);

@(add-eval @ fn (k n) {(- (eval n)) band {{1 shl (eval k)} - 1}})
@_ def bitsNeg (k n: nat): nat = $ bitsAdd k (bitsNot k n) 1 $;
pub theorem bitsNegT (k n: nat): $ bitsNeg k n e. Bits k $ = 'bitsAddT;

theorem zeqm_bitsNegd
  (h1: $ G -> modZ(2 ^ k): b0 a = x $):
  $ G -> modZ(2 ^ k): b0 (bitsNeg k a) = -uZ x $ =
'(sylib (zeqmeq3 @ eqtr (zaddeq1 znegadd) znpcan) @
  zeqm_bitsAddd (zeqm_bitsNotd h1) (a1i zeqmid));
theorem zeqm_bitsNeg: $ modZ(2 ^ k): b0 (bitsNeg k n) = -uZ b0 n $ =
'(trud @ zeqm_bitsNegd @ a1i zeqmid);

theorem bitsNeg0: $ bitsNeg k 0 = 0 $ =
'(mpbi (Bits_zeqm_02 bitsNegT) @
  mpbi (zeqmeq3 @ eqtr (znegeq b00) zneg0) zeqm_bitsNeg);

theorem bitsNeg1: $ bitsNeg k 1 = upto k $ =
'(mpbi (Bits_zeqm @ ian bitsNegT uptoT) @
  zeqmtr zeqm_bitsNeg @ zeqmcom @ mpbi zeqmsub @
  mpbir (zeqmeq2 @ eqtr zsubneg2 @ eqtr zaddb0 @ b0eq uptoadd1) zeqmid0);

@(add-eval @ fn (k a b) {{(eval a) - (eval b)} band {{1 shl (eval k)} - 1}})
@_ def bitsSub (k a b: nat): nat = $ bitsAdd k a (bitsNeg k b) $;
pub theorem bitsSubT (k a b: nat): $ bitsSub k a b e. Bits k $ = 'bitsAddT;

theorem zeqm_bitsSubd
  (h1: $ G -> modZ(2 ^ k): b0 a = x $) (h2: $ G -> modZ(2 ^ k): b0 b = y $):
  $ G -> modZ(2 ^ k): b0 (bitsSub k a b) = x -Z y $ =
'(zeqm_bitsAddd h1 @ zeqm_bitsNegd h2);
theorem zeqm_bitsSub2: $ modZ(2 ^ k): b0 (bitsSub k a b) = b0 a -Z b0 b $ =
'(trud @ zeqm_bitsSubd (a1i zeqmid) (a1i zeqmid));
theorem zeqm_bitsSub: $ modZ(2 ^ k): b0 (bitsSub k a b) = a -ZN b $ =
'(mpbi (zeqmeq3 zsubb0) zeqm_bitsSub2);

theorem bitsSub_eq_sub: $ b <= a -> a e. Bits k -> bitsSub k a b = a - b $ =
'(exp @ mpbid (sylan Bits_zeqm (a1i bitsSubT) @ anwr @ Bitsle1 subleid) @
  mpbii zeqm_bitsSub @ zeqmeq3d @ anwl znsubpos);

theorem bitsSub03: $ bitsSub k a 0 = chop k a $ = '(eqtr (bitsAddeq3 bitsNeg0) bitsAdd03);

theorem bits_npcan: $ bitsAdd k (bitsSub k a b) b = chop k a $ =
'(mpbi (zeqm_chop2 bitsAddT) @ mpbi (zeqmeq3 znpcan) @
  trud @ zeqm_bitsAddd (a1i zeqm_bitsSub2) (a1i zeqmid));
theorem bits_pncan: $ bitsSub k (bitsAdd k a b) b = chop k a $ =
'(mpbi (zeqm_chop2 bitsAddT) @ mpbi (zeqmeq3 zpncan) @
  trud @ zeqm_bitsSubd (a1i zeqm_bitsAdd) (a1i zeqmid));

@_ def bitsSar (k a b: nat): nat =
$ nat (bitsMSB k a) * (upto k - upto (k - b)) + shr a b $;
pub theorem bitsSarT (k a b: nat):
  $ a e. Bits k /\ b <= k -> bitsSar k a b e. Bits k $ =
'(sylibr elBits2 @
  sylibr (lteq2 @ eqtr3 uptoadd1 @
    eqtr3 (addeq1 @ npcan @ mpbi leupto subleid) @ eqtr addass @ addeq2 uptoadd1) @
  leltaddd (a1i @ mpbi (leeq2 mul11) (lemul1a natle1)) @
  sylib elBits2 @ syl shrT @ mpbird (elneq2d @ Bitseqd @ anwr npcan) anl);

@(add-eval @ fn (a b) {{(eval a) + (eval b)} band {{1 shl 64} - 1}})
@_ def add64 (a b: nat): nat = $ bitsAdd 64 a b $; infixl add64: $+_64$ prec 64;
pub theorem add64T (a b: nat): $ a +_64 b e. u64 $ = 'bitsAddT;

theorem add64_eqid: $ a + b e. u64 -> a +_64 b = a + b $ = 'bitsAdd_eqid;
theorem add64S_eqid: $ suc a e. u64 -> a +_64 1 = suc a $ =
'(sylbir (eleq1 add12) @ syl6eq add12 add64_eqid);

@(add-eval @ fn (a b) {{(eval a) - (eval b)} band {{1 shl 64} - 1}})
@_ def sub64 (a b: nat): nat = $ bitsSub 64 a b $; infixl sub64: $-_64$ prec 64;
pub theorem sub64T (a b: nat): $ a -_64 b e. u64 $ = 'bitsSubT;

theorem sub64_eqid: $ b <= a -> a e. u64 -> a -_64 b = a - b $ = 'bitsSub_eq_sub;

theorem sub02_64: $ a -_64 0 = chop 64 a $ = 'bitsSub03;
theorem npcan64: $ a -_64 b +_64 b = chop 64 a $ = 'bits_npcan;
theorem pncan64: $ a +_64 b -_64 b = chop 64 a $ = 'bits_pncan;

@_ local def toBytesAux (k n .a: nat): nat = $ rec 0 (\ a,
  \. i e. upto (suc n), (i % 256) : a @ (i // 256)) k $;

theorem toBytesAux0: $ toBytesAux 0 n = 0 $ = (named 'rec0);
theorem toBytesAux0_app: $ toBytesAux 0 n @ i = 0 $ =
'(eqtr (appneq1 toBytesAux0) app01);

theorem toBytesAuxS: $ toBytesAux (suc k) n =
  \. i e. upto (suc n), (i % 256) : toBytesAux k n @ (i // 256) $ =
'(eqtr {recS : $ _ = _ @ toBytesAux k n $} @
  !! applame a @ lowereqd @ reseq1d @ lameqd @ conseq2d @ appeq1d nseq);

theorem toBytesAuxS_app: $ a <= n ->
  toBytesAux (suc k) n @ a = (a % 256) : toBytesAux k n @ (a // 256) $ =
'(syl5eq (appneq1 toBytesAuxS) @
  sylbi leltsuc @ sylbir elupto @ !! apprlame x @ conseqd modeq1 @ appeq2d diveq1);

--| Little endian encoding
@_ abstract def toBytes (k n: nat): nat = $ toBytesAux k n @ n $;

pub theorem toBytes0 (n: nat): $ toBytes 0 n = 0 $ = 'toBytesAux0_app;

theorem toBytesAuxS_eq: $ a <= n -> toBytesAux k n @ a = toBytes k a $ =
(named @ focus
  '(!! eale x (imeqd leeq1 @ imeqd leeq1 @ eqeqd appeq2 appeq2)
    ,(induct '(ind) 'k
      '(ax_gen @ a1i @ a1i @ eqtr4 toBytesAux0_app toBytesAux0_app)
      '(sylbi (cbval ,eqtac) @
        ialda @ exp @ eqtr4d (anwr toBytesAuxS_app) @
        eqtr4d (syl toBytesAuxS_app anlr) @
        conseq2d @
        mpd (letrd (a1i divleid) anr) @ mpd (letrd (a1i divleid) anlr) @
        anwll @ eale ,eqtac))
    leid));

pub theorem toBytesS (k n: nat):
  $ toBytes (suc k) n = (n % 256) : toBytes k (n // 256) $ =
'(eqtr (toBytesAuxS_app leid) @ conseq2 @ toBytesAuxS_eq divleid);
theorem toBytesS2: $ toBytes (suc k) n = chop 8 n : toBytes k (shr n 8) $ = 'toBytesS;

theorem toBytes02: $ toBytes k 0 = repeat 0 k $ =
(named @ induct '(ind) 'k
  '(eqtr4 toBytes0 repeat0)
  '(syl5eq toBytesS @ syl5eq (conseq mod01 @ toByteseq2 div01) @
    syl6eqr repeatS conseq2));

pub theorem toBytesT (k n: nat): $ toBytes k n e. Array u8 k $ =
'(!! eale x (eleq1d toByteseq2) ,(induct '(!! ind y z) 'k
  '(ax_gen @ mpbir (eleq1 toBytes0) elArray0)
  '(sylbi (!! cbval _ y @ eleq1d toByteseq2) @ iald @
    sylibr (eleq1 toBytesS) @ syl (sylibr elArrayS @ ian mod_el_u8) @
    eale @ eleq1d toByteseq2)));

theorem toBytesT2: $ toBytes k n e. List u8 $ = '(elArrayList toBytesT);
theorem toBytes_len: $ len (toBytes k n) = k $ = '(elArraylen toBytesT);

theorem toBytes1: $ toBytes 1 n = chop 8 n : 0 $ =
'(eqtr toBytesS @ conseq2 toBytes0);

theorem toBytes_chop: $ toBytes k (chop (8 * k) n) = toBytes k n $ =
(named '(ax_mp (!! eale x ,(eqtac-gen 'n)) ,(induct '(ind) 'k
  '(ax_gen @ eqtr4 toBytes0 toBytes0)
  '(sylbi (cbval ,eqtac) @ iald @ eqtr4g toBytesS2 toBytesS2 @ conseqd
    (a1i @ chop_chop @ mpbi (leeq1 mul12) @ lemul2a le11S)
    (sylibr (eqeq1 @ toByteseq2 @ eqtr (shreq1 @ chopeq1 mulS) chop_shr) @
      eale ,eqtac)))));

theorem toBytes_inj2: $ toBytes k a = toBytes k b <-> chop (8 * k) a = chop (8 * k) b $ =
(named @ focus
  '(ibii _ @ eqtr3g toBytes_chop toBytes_chop toByteseq2)
  '(ax_mp (!! eale y ,(eqtac-gen 'b)) @ ax_mp (!! eale x ,(eqtac-gen 'a)) _)
  (induct '(ind) 'k
    '(ax_gen @ ax_gen @ eqtr4g (chopeq1 mul02) (chopeq1 mul02) @ a1i @ eqtr4 chop01 chop01)
    '(sylbi (cbval @ cbvald ,eqtac) @ iald @ iald @
      ealie @ ealde @ syl6 _ @ bi1d ,eqtac))
  '(syl5bi (eqeq toBytesS2 toBytesS2) @ syl5bi consinj @
    impd @ com12 @ imim2d @ exp @ eqtr4g (chopeq1 mulS) (chopeq1 mulS) @
    eqtr3g shlshr_chop shlshr_chop @ addeqd (shleq1d @ eqtr4g chop_shr chop_shr anr) @
    eqtr4g (chop_chop leaddid2) (chop_chop leaddid2) anl));

theorem toBytes_inj: $ toBytes k a = toBytes k b <-> mod(2 ^ (8 * k)): a = b $ =
'(bitr toBytes_inj2 chop_eq_chop);

theorem toBytesS_bitsNot: $ toBytes (suc k) (bitsNot (8 * suc k) n) =
  bitsNot 8 n : toBytes k (bitsNot (8 * k) (shr n 8)) $ =
'(eqtr toBytesS2 @ conseq
  (chop_bitsNot @ mpbi (leeq1 mul12) @ lemul2a le11S)
  (toByteseq2 @ eqtr shr_bitsNot @ bitsNoteq1 @ eqtr (subeq1 mulS2) pncan));

theorem s2n_toBytesS0 (h: $ c = a $) (h2: $ s = repeat 0 k $):
  $ c ': s = toBytes (suc k) a $ =
'(eqtr (s2n_S (eqcom @ modltid @ mpbi elu8_2 c2nT) @
    eqtr4 h2 @ eqtr (toByteseq2 @ divlteq0 @ mpbi elu8_2 c2nT) toBytes02) @
  eqtr3 toBytesS @ toByteseq2 h);

theorem xtoBytes0: $ s0 = toBytes 0 a $ = '(eqtr4 s2ns0 toBytes0);
theorem xtoBytesS (h: $ s = toBytes k n $): $ ch a1 a0 ': s = toBytes (suc k) (n :x a1 :x a0) $ =
'(eqtr4 (s2n_S (eqtr4 c2nhex @ anr hex_divmod256) @
    eqtr4 h @ toByteseq2 @ anl hex_divmod256) toBytesS);
theorem xtoBytesS2 (h: $ s = toBytes k x0 $): $ ch a1 a0 ': s = toBytes (suc k) (a1 :x a0) $ =
'(eqtr (xtoBytesS h) @ toByteseq2 @ hexeq1 hex01);
theorem xtoBytesS1 (h: $ s = toBytes k x0 $): $ ch x0 a0 ': s = toBytes (suc k) a0 $ =
'(eqtr (xtoBytesS2 h) @ toByteseq2 hex01);
theorem xtoBytes1S: $ s1 (ch a1 a0) = toBytes (suc 0) (n :x a1 :x a0) $ =
'(eqtr3 s2nscons0 @ xtoBytesS xtoBytes0);
theorem xtoBytes12: $ s1 (ch a1 a0) = toBytes (suc 0) (a1 :x a0) $ =
'(eqtr3 s2nscons0 @ xtoBytesS2 xtoBytes0);
theorem xtoBytes11: $ s1 (ch x0 a0) = toBytes (suc 0) a0 $ =
'(eqtr xtoBytes12 @ toByteseq2 hex01);

--| `(to-toBytes k n)` returns `(s p)` where `p: s2n s = toBytes k n`.
--| Note that `k` should be a unary numeral constructed by `(sucs)`
do (def (to-toBytes k n) @ match k
  [$suc ,k$ @ match k
    [$0$ @ match n
      [$,n :x ,a1 :x ,a0$ '($s1 (ch ,a1 ,a0)$ (xtoBytes1S ,a0 ,a1 ,n))]
      [$h2n ,a1 :x ,a0$ '($s1 (ch ,a1 ,a0)$ (xtoBytes12 ,a0 ,a1))]
      [$h2n ,a0$ '($s1 (ch ,'(x0) ,a0)$ (xtoBytes11 ,a0))]]
    [_ @ match n
      [$,n :x ,a1 :x ,a0$ @ match (to-toBytes k n) @ (s p)
        '($ch ,a1 ,a0 ': ,s$ (xtoBytesS ,a0 ,a1 ,k ,n ,s ,p))]
      [$h2n ,a1 :x ,a0$ @ match (to-toBytes k '(h2n @ x0)) @ (s p)
        '($ch ,a1 ,a0 ': ,s$ (xtoBytesS2 ,a0 ,a1 ,k ,s ,p))]
      [$h2n ,a0$ @ match (to-toBytes k '(h2n @ x0)) @ (s p)
        '($ch ,'(x0) ,a0 ': ,s$ (xtoBytesS1 ,a0 ,k ,s ,p))]]]
  [$0$ '($s0$ (xtoBytesS1 ,n))]);

@_ def u16Bytes (n: nat): nat = $ toBytes 2 n $;
@_ def u32Bytes (n: nat): nat = $ toBytes 4 n $;
@_ def u64Bytes (n: nat): nat = $ toBytes 8 n $;
theorem u16BytesT: $ u16Bytes n e. Array u8 2 $ = 'toBytesT;
theorem u32BytesT: $ u32Bytes n e. Array u8 4 $ = 'toBytesT;
theorem u64BytesT: $ u64Bytes n e. Array u8 8 $ = 'toBytesT;
theorem u16BytesList: $ u16Bytes n e. List u8 $ = '(elArrayList u16BytesT);
theorem u32BytesList: $ u32Bytes n e. List u8 $ = '(elArrayList u32BytesT);
theorem u64BytesList: $ u64Bytes n e. List u8 $ = '(elArrayList u64BytesT);
theorem u16Bytes_len: $ len (u16Bytes n) = 2 $ = 'toBytes_len;
theorem u32Bytes_len: $ len (u32Bytes n) = 4 $ = 'toBytes_len;
theorem u64Bytes_len: $ len (u64Bytes n) = 8 $ = 'toBytes_len;

theorem xu16Bytes (h: $ s2n s = toBytes ,(sucs 2) n $): $ s = u16Bytes n $ = 'h;
theorem xu32Bytes (h: $ s2n s = toBytes ,(sucs 4) n $): $ s = u32Bytes n $ = 'h;
theorem xu64Bytes (h: $ s2n s = toBytes ,(sucs 8) n $): $ s = u64Bytes n $ = 'h;

--| `(to-uNBytes N a)` returns a pair `(s p)` where `p: s2n s = uNBytes a`
--| assuming `N = 16,32,64`
do (def (to-uNBytes n a)
  (def k (sucs {n // 8}))
  @ match (to-toBytes k a) @ (s p)
  '(,s (,(atom-app 'xu n 'Bytes) ,a ,s ,p)));

@_ local def toIBytes (k n: nat): nat = $ toBytes k (chopZ (8 * k) n) $;
@_ local def i8Bytes (n: nat): nat = $ toIBytes 1 n $;
@_ local def i16Bytes (n: nat): nat = $ toIBytes 2 n $;
@_ local def i32Bytes (n: nat): nat = $ toIBytes 4 n $;
@_ local def i64Bytes (n: nat): nat = $ toIBytes 8 n $;

theorem i8Bytes_val2: $ i8Bytes n = toBytes 1 (chopZ 8 n) $ = '(toByteseq2 @ chopZeq1 mul12);
theorem i16Bytes_val: $ i16Bytes n = toBytes 2 (chopZ 16 n) $ = '(toByteseq2 @ chopZeq1 d8mul2);
theorem i32Bytes_val: $ i32Bytes n = toBytes 4 (chopZ 32 n) $ = '(toByteseq2 @ chopZeq1 d8mul4);
theorem i64Bytes_val: $ i64Bytes n = toBytes 8 (chopZ 64 n) $ = '(toByteseq2 @ chopZeq1 d8mul8);

theorem i8Bytes_val (n: nat): $ i8Bytes n = chopZ 8 n : 0 $ =
'(eqtr i8Bytes_val2 @ eqtr toBytes1 @ conseq1 @ Bits_chop chopZT);

theorem toIBytesT: $ toIBytes k n e. Array u8 k $ = 'toBytesT;
theorem i8BytesT: $ i8Bytes n e. Array u8 1 $ = 'toIBytesT;
theorem i16BytesT: $ i16Bytes n e. Array u8 2 $ = 'toIBytesT;
theorem i32BytesT: $ i32Bytes n e. Array u8 4 $ = 'toIBytesT;
theorem i64BytesT: $ i64Bytes n e. Array u8 8 $ = 'toIBytesT;

theorem toIBytes0: $ toIBytes 0 n = 0 $ = 'toBytes0;
theorem toIBytes_b0: $ toIBytes k (b0 n) = toBytes k n $ =
'(eqtr (toByteseq2 chopZ_b0) toBytes_chop);
theorem toIBytesS_b1: $ toIBytes (suc k) (b1 n) =
  bitsNot 8 n : toIBytes k (b1 (shr n 8)) $ =
'(eqtr (toByteseq2 chopZ_b1_bitsNot) @ eqtr4 toBytesS_bitsNot @
  conseq2 @ toByteseq2 chopZ_b1_bitsNot);

theorem xtoIBytes0: $ s0 = toIBytes 0 a $ = 'xtoBytes0;
theorem xtoIBytesSb0_ (h: $ s = toBytes k n $): $ s = toIBytes k (b0 n) $ = '(eqtr4 h toIBytes_b0);
theorem xtoIBytesSb0 (h: $ s = toIBytes k (b0 n) $):
  $ ch a1 a0 ': s = toIBytes (suc k) (b0 (n :x a1 :x a0)) $ =
'(xtoIBytesSb0_ @ xtoBytesS @ eqtr h toIBytes_b0);
theorem xtoIBytes02 (h: $ s = toBytes k x0 $): $ s2n s = toIBytes k 0 $ =
'(eqtr (xtoIBytesSb0_ h) @ toIByteseq2 @ eqtr (b0eq h2n0) b00);
theorem xtoIBytesSb1S (h0: $ a0 + c0 = xf $) (h1: $ a1 + c1 = xf $) (h: $ s = toIBytes k (b1 n) $):
  $ ch c1 c0 ': s = toIBytes (suc k) (b1 (n :x a1 :x a0)) $ =
'(eqtr s2nscons @ eqtr4 (conseq (xbitNot_ch h0 h1) @
  eqtr4 h @ toIByteseq2 @ b1eq @ anli xchopshr8) toIBytesS_b1);
theorem xtoIBytesSb12 (h0: $ a0 + c0 = xf $) (h1: $ a1 + c1 = xf $) (h: $ s = toIBytes k (b1 x0) $):
  $ ch c1 c0 ': s = toIBytes (suc k) (b1 (h2n a1 :x a0)) $ =
'(eqtr (xtoIBytesSb1S h0 h1 h) @ toIByteseq2 @ b1eq @ hexeq1 hex01);
theorem xtoIBytesSb11 (h0: $ a0 + c0 = xf $) (h: $ s = toIBytes k (b1 x0) $):
  $ ch xf c0 ': s = toIBytes (suc k) (b1 (h2n a0)) $ =
'(eqtr (xtoIBytesSb12 h0 addx01 h) @ toIByteseq2 @ b1eq hex01);
theorem xtoIBytesSb10 (h: $ s = toIBytes k (b1 x0) $):
  $ ch xf xf ': s = toIBytes (suc k) (b1 x0) $ = '(xtoIBytesSb11 addx01 h);

--| `(to-toIBytesb1 k n) = (s p)` where `p: s2n s = toIBytes k (b1 n)`
do (def (to-toIBytesb1 k n) @ match k
  [$0$ '(s0 (xtoIBytes0 (b1 ,n)))]
  [$suc ,k$ @ match n
    ['(h2n @ x0) @ match (to-toIBytesb1 k '(h2n @ x0)) @ (s p)
      '($ ch xf xf ': ,s$ (xtoIBytesSb10 ,k ,s ,p))]
    [$,n :x ,a1 :x ,a0$ @ match (to-toIBytesb1 k n) @ (s p)
      @ match (decnot a0) @ (c0 p0) @ match (decnot a1) @ (c1 p1)
      '($ch ,c1 ,c0 ': ,s$ (xtoIBytesSb1S ,a0 ,a1 ,c0 ,c1 ,k ,n ,s ,p0 ,p1 ,p))]
    [$h2n ,a1 :x ,a0$ @ match (to-toIBytesb1 k '(h2n @ x0)) @ (s p)
      @ match (decnot a0) @ (c0 p0) @ match (decnot a1) @ (c1 p1)
      '($ch ,c1 ,c0 ': ,s$ (xtoIBytesSb12 ,a0 ,a1 ,c0 ,c1 ,k ,n ,s ,p0 ,p1 ,p))]
    [$h2n ,a0$ @ match (to-toIBytesb1 k '(h2n @ x0)) @ (s p)
      @ match (decnot a0) @ (c0 p0)
      '($ch ,'(xf) ,c0 ': ,s$ (xtoIBytesSb11 ,a0 ,c0 ,k ,s ,p0 ,p))]]);

theorem xi8Bytes (h: $ s2n s = toIBytes ,(sucs 1) n $): $ s = i8Bytes n $ = 'h;
theorem xi16Bytes (h: $ s2n s = toIBytes ,(sucs 2) n $): $ s = i16Bytes n $ = 'h;
theorem xi32Bytes (h: $ s2n s = toIBytes ,(sucs 4) n $): $ s = i32Bytes n $ = 'h;
theorem xi64Bytes (h: $ s2n s = toIBytes ,(sucs 8) n $): $ s = i64Bytes n $ = 'h;

--| `(to-iNBytes N a)` returns a pair `(s p)` where `p: s2n s = iNBytes a`
--| assuming `N = 8,16,32,64`
do (def (to-iNBytes n a)
  (def k (sucs {n // 8}))
  @ match (match a
    [$0$ @ match (to-toBytes k '(h2n @ x0)) @ (s p) '(,s (xtoIBytes02 ,k ,s ,p))]
    [$b0 ,a$ @ match (to-toBytes k a) @ (s p) '(,s (xtoIBytesSb0_ ,k ,a (s2n ,s) ,p))]
    [$b1 ,a$ (to-toIBytesb1 k a)])
  [(s p) '(,s (,(atom-app 'xi n 'Bytes) ,a ,s ,p))]);

@_ def Bitvec {.n: nat}: set = $ {n | snd n < 2 ^ fst n} $;
theorem elBitvec: $ n, bs e. Bitvec <-> bs < 2 ^ n $ =
(named '(elabe @ lteqd (syl6eq sndpr sndeq) @ poweq2d @ syl6eq fstpr fsteq));
theorem elBitvec2: $ n, bs e. Bitvec <-> bs e. Bits n $ = '(bitr4 elBitvec elBits2);

@_ abstract def bvSize (bs: nat): nat = $ lrec 0 (\\ p, \\ z, \ ih, fst p + ih) bs $;
pub theorem bvSize0: $ bvSize 0 = 0 $ = (named 'lrec0);
pub theorem bvSizeS (k bs n: nat): $ bvSize ((k, bs) : n) = k + bvSize n $ =
(named '(eqtr {lrecS : $ _ = _ @ (_, _, bvSize n) $} @ appslame @
  appslamed @ applamed @ addeqd (syl6eq fstpr @ fsteqd anll) anr));

theorem bvSize1: $ bvSize ((k, bs) : 0) = k $ =
'(eqtr bvSizeS @ eqtr (addeq2 bvSize0) add0);

theorem bvSizeA: $ bvSize (bs1 ++ bs2) = bvSize bs1 + bvSize bs2 $ =
(induct '(!! listind x a b) 'bs1
  '(eqtr4 (bvSizeeq append0) @ eqtr (addeq1 bvSize0) add01)
  '(syl5eqr (bvSizeeq @ eqtr4 (conseq1 fstsnd) appendS) @
    syl6eq (addeq1 @ eqtr3 bvSizeS @ bvSizeeq @ conseq1 fstsnd) @
    syl5eq bvSizeS @ syl6eqr addass addeq2));

do (def (bvSizeSi refine t)
  @ refine t @ match t
  [$ bvSize 0 = ,_ $ 'bvSize0]
  [$ bvSize ((,_, ,_) : ,_) = ,_ $
    '(eqtr bvSizeS @ eqtr (addeq2 ,bvSizeSi) ,norm_num)]);

@_ def isBitvecs (bs k: nat): wff = $ bs e. List Bitvec /\ bvSize bs = k $;

@_ abstract def ofBits (n: nat): nat = $ lrec 0 (\\ p, \\ z, \ ih, snd p + shl ih (fst p)) n $;
pub theorem ofBits0: $ ofBits 0 = 0 $ = (named 'lrec0);
pub theorem ofBitsS (k n bs: nat): $ ofBits ((k, n) : bs) = n + shl (ofBits bs) k $ =
(named '(eqtr {lrecS : $ _ = _ @ (_, _, ofBits bs) $} @ appslame @
  appslamed @ applamed @ addeqd (syl6eq sndpr @ sndeqd anll) @
  shleqd anr (syl6eq fstpr @ fsteqd anll)));
theorem ofBitsS2: $ ofBits ((k, n) : bs) = shl (ofBits bs) k + n $ = '(eqtr ofBitsS addcom);
theorem ofBits1: $ ofBits ((k, n) : 0) = n $ =
'(eqtr ofBitsS @ eqtr (addeq2 @ eqtr (shleq1 ofBits0) shl01) add0);
pub theorem ofBits0T: $ ofBits 0 e. Bits 0 $ = '(mpbir elBits0 ofBits0);
pub theorem ofBitsST (k n bs m: nat):
  $ n e. Bits k /\ ofBits bs e. Bits m ->
    ofBits ((k, n) : bs) e. Bits (k + m) $ =
'(sylibr (eleq1 @ eqtr ofBitsS addcom) @ sylib (elneq2 @ Bitseq addcom) @
  rsyl ancom shladdT);
theorem ofBitsT (bs: nat):
  $ bs e. List Bitvec -> ofBits bs e. Bits (bvSize bs) $ =
(named '(sylbi elList ,(induct '(listind) 'bs
  '(a1i @ mpbir (eleq1 ofBits0) elBits01)
  '(syl5bi allS @ impd @ com12 @ imim2d @ exp @
    sylibr (elneq2 @ Bitseq @ eqtr3 (bvSizeeq @ conseq1 fstsnd) bvSizeS) @
    sylib (eleq1 @ ofBitseq @ conseq1 fstsnd) @
    sylbi (aneq1i @ bitr3 (eleq1 fstsnd) elBitvec2) ofBitsST))));

theorem ofBitsA: $ ofBits (bs1 ++ bs2) = shl (ofBits bs2) (bvSize bs1) + ofBits bs1 $ =
(induct '(!! listind x a b) 'bs1
  '(eqtr4 (ofBitseq append0) @ eqtr (addeq2 ofBits0) @
    eqtr add02 @ eqtr (shleq2 bvSize0) shl02)
  '(syl5eqr (ofBitseq @ eqtr4 (conseq1 fstsnd) appendS) @
    syl6eq (addeq (shleq2 @ eqtr3 bvSizeS @ bvSizeeq @ conseq1 fstsnd) @
      eqtr3 ofBitsS2 @ ofBitseq @ conseq1 fstsnd) @
    syl5eq ofBitsS2 @ syl6eq addass @ addeq1d @
    syl6eq (eqtr addmul @ addeq1 @ eqtr mulass @
      muleq2 @ eqtr4 mulcom powadd) shleq1));

theorem chop_ofBits: $ n e. Bits k -> chop k (ofBits ((k, n) : bs)) = n $ =
'(syl5eq (chopeq2 ofBitsS2) chop_shladd);
theorem shr_ofBits: $ n e. Bits k -> shr (ofBits ((k, n) : bs)) k = ofBits bs $ =
'(syl5eq (shreq1 ofBitsS2) @ sylbi elBits2 shrshladdid);

@_ def splitBits (bs n: nat): wff = $ bs e. List Bitvec /\ ofBits bs = n $;
pub theorem splitBitsT (bs n k: nat):
  $ isBitvecs bs k /\ splitBits bs n -> n e. Bits k $ =
'(mpbid (elneqd anrr @ Bitseqd anlr) (anwll ofBitsT));

theorem splitBitsTi (h: $ bvSize bs = k $): $ splitBits bs n -> n e. Bits k $ =
'(sylan splitBitsT (iand anl @ a1i h) id);

theorem splitBits0: $ splitBits 0 n <-> n = 0 $ =
'(bitr (bian1 elList0) @ bitr eqcomb @ eqeq2 ofBits0);

theorem splitBitsS2: $ splitBits ((k, a) : bs) n <->
  a e. Bits k /\ bs e. List Bitvec /\ shl (ofBits bs) k + a = n $ =
'(bitr (aneq1i elListS) @ bitr anass @ bitr4 (aneq1i elBitvec2) @
  bitr4 anass @ aneq2i @ aneq2i @ eqeq1 ofBitsS2);

theorem splitBitsS: $ splitBits ((k, a) : bs) n <->
  a e. Bits k /\ E. m (shl m k + a = n /\ splitBits bs m) $ =
'(bitr splitBitsS2 @ bitr anass @ aneq2i @
  bitr3 (exeqe @ syl5bb ancomb @ aneq2d @ eqeq1d @ addeq1d shleq1) @
  exeqi @ bitr anlass @ aneq2i @ bitr ancomb @ aneq2i eqcomb);
theorem splitBitsSi
  (h1: $ a e. Bits k $) (h2: $ shl m k + a = n $) (h3: $ splitBits bs m $):
  $ splitBits ((k, a) : bs) n $ =
'(mpbir splitBitsS @ iani h1 @ ax_mp (iexe ,eqtac) @ iani h2 h3);

theorem splitBits1: $ splitBits ((k, a) : 0) n <-> a e. Bits k /\ a = n $ =
(named '(bitr splitBitsS @ aneq2i @
  bitr3 (exeqi @ bitr3 (aneq1i splitBits0) ancomb) @
  exeqe @ eqeq1d @ syl6eq add01 @ addeq1d @ syl6eq shl01 shleq1));

theorem splitBits1i: $ a e. Bits k -> splitBits ((k, a) : 0) a $ =
'(sylibr splitBits1 @ mpi eqid ian);

theorem splitBitsS_uniq:
  $ splitBits ((k, a) : bs) n <-> chop k n = a /\ splitBits bs (shr n k) $ =
'(bitr splitBitsS @ bitr3 exan1 @
  bitr (exeqi @ bitr3 anass @
    bitr (aneq1i shladd_uniq) @ bitr anass @ aneq1i eqcomb) @
  !! exeqe m @ aneq2d splitBitseq2);

theorem splitBitsS4: $ splitBits ((4, a) : bs) n <->
  E. m (m :x a = n /\ splitBits bs m) $ =
'(bitr splitBitsS @ bitr (bian1 h2nT) @ exeqi @ aneq1i @ eqeq1 @ addeq1 @ muleq2 d2pow4);

theorem splitBitsA: $ bvSize bs1 = k ->
  (splitBits (bs1 ++ bs2) n <->
    E. a (splitBits bs1 a /\ splitBits ((k, a) : bs2) n)) $ =
'(syl6bb (exeqi @ bitr3 anass @ aneq1i @ bitr ancomb @ aneq2i eqcomb) @
  syl6bbr (exeqe @ aneq2d @ splitBitseq1d @ conseq1d preq2) @
  syl5bb (aneq1i appendT) @ syl5bb anass @ syl aneq2a @ exp @
  bitr3d (anwr @ syl5bb splitBitsS2 @
    syl5bbr (aneq2i @ eqeq1 ofBitsA) @ aneq1d @ syl bian1 ofBitsT) @
  splitBitseq1d @ conseq1d @ preq1d anl);

theorem splitBits_split: $ splitBits ((k + l, b) : bs) n <->
  E. a E. c (shl c k + a = b /\ splitBits ((k, a) : (l, c) : bs) n) $ =
(named '(bitr3 (exeqe biidd) @ exeqi @ bitr3 (exeqe biidd) @ exeqi @
  bitr3 anass @ bitr3 (aneq1i @ bitr shladd_uniq @ aneq eqcomb eqcomb) @
  bitr (aneq2a @ syl6bb (splitBitseq1 @ appendSi append1) @
    syl6bbr (splitBitsA @ eqtr bvSizeS @ addeq2 bvSize1) @
    syl5bbr (exeqe @ splitBitseq1d @ conseq1d preq2) @ exeqd @
    aneq1da @ syl6bbr splitBitsS_uniq @ syl6bbr (aneq2i splitBits1) @
    syl6bb anlass @ bitr2d (aneq2d @ syl5bbr (aneq2i eqcomb) @
      syl5bbr ancomb @ syl5bbr shladd_uniq @ bitrd (anwll bian1) @ eqeq1d anlr) @
    syl6bb eqcomb @ syl bian1a @ exp @
    mpbid (eleq1d @ anld @ sylib shladd_uniq anll) @
    syl shrT @ mpbird (elneqd anr @ Bitseqd @ a1i addcom) @
    sylib elBitvec2 @ elListHd @ anwl anrl) @
  aneq1a @ syl bian1 @ sylbi splitBitsS anl));

theorem splitBits_mid: $ splitBits (bs1 ++ (k + l, b) : bs2) n <->
  E. a E. c (shl c k + a = b /\ splitBits (bs1 ++ (k, a) : (l, c) : bs2) n) $ =
(named '(bitr4 (splitBitsA eqid) @
  bitr (biexexi @ biexexi @ biexan2i @ splitBitsA eqid) @ exeqi @
  bitr4 (bian1exi @ bian1exi anlass) @ aneq2i @
  bitr4 splitBitsS_uniq @ bitr4 (bian1exi @ bian1exi @ bian12i splitBitsS_uniq) @
  aneq2i splitBits_split));

theorem splitBitsx0i: $ splitBits 0 x0 $ = '(mpbir splitBits0 @ eqcom dec0);
theorem splitBits14i (a: hex): $ splitBits ((4, a) : 0) a $ = '(splitBits1i h2nT);
theorem splitBits14ie (x: hex) (h: $ a = x $): $ splitBits ((4, a) : 0) x $ =
'(mpbir (splitBitseq1 @ conseq1 @ preq2 h) splitBits14i);
theorem splitBitsS4i (h: $ splitBits bs n $): $ splitBits ((4, a) : bs) (n :x a) $ =
'(mpbir splitBitsS4 @ ax_mp (iexe ,eqtac) @ iani eqid h);

theorem splitBitsA4i
  (he: $ bs1 ++ bs2 = bs $) (hs: $ bvSize bs1 = 4 $)
  (h1: $ splitBits bs1 a $) (h2: $ splitBits bs2 n $):
  $ splitBits bs (n :x a) $ =
'(mpbi (splitBitseq1 he) @ mpbir (splitBitsA hs) @
  iexie @ mpbiri (ian h1 @ splitBitsS4i h2) ,eqtac);

theorem splitBitsA4ic
  (he: $ bs1 ++ bs2 = bs $) (hs: $ bvSize bs1 = 4 $)
  (h1: $ splitBits bs1 b $) (h2: $ splitBits bs2 a $):
  $ splitBits bs (ch a b) $ =
'(mpbir (splitBitseq2 c2nch) @ splitBitsA4i he hs h1 h2);

theorem splitBitsS1i (h0: $ bool x $)
  (hn: $ b0 n2 + x = n $) (h: $ splitBits bs n2 $):
  $ splitBits ((1, x) : bs) n $ =
'(splitBitsSi (mpbir elBits1 h0) (eqtr (addeq1 shl12) hn) h);

theorem splitBitsS1i0 (h1: $ n = b0 n2 $) (h2: $ splitBits bs n2 $):
  $ splitBits ((1, 0) : bs) n $ = '(splitBitsS1i bool0 (eqtr4 add0 h1) h2);
theorem splitBitsS1i1 (h1: $ n = b1 n2 $) (h2: $ splitBits bs n2 $):
  $ splitBits ((1, 1) : bs) n $ = '(splitBitsS1i bool1 (eqtr4 add12 h1) h2);

theorem splitBitsSSi (h0: $ bool x $)
  (ha: $ b0 a2 + x = a $) (hn: $ b0 n2 + x = n $)
  (h2: $ splitBits ((k, a2) : bs) n2 $):
  $ splitBits ((suc k, a) : bs) n $ =
(focus
  '(mpbi (splitBitseq1 @ conseq1 @ preq1 add11) @ mpbir splitBits_split @
    iexie @ iexde @ mpbiri _ ,eqtac)
  '(ian (eqtr (addeq1 shl12) ha) @ splitBitsS1i h0 hn h2));

theorem splitBitsSSi0 (ha: $ a = b0 a2 $) (hn: $ n = b0 n2 $)
  (h2: $ splitBits ((k, a2) : bs) n2 $): $ splitBits ((suc k, a) : bs) n $ =
'(splitBitsSSi bool0 (eqtr4 add0 ha) (eqtr4 add0 hn) h2);
theorem splitBitsSSi1 (ha: $ a = b1 a2 $) (hn: $ n = b1 n2 $)
  (h2: $ splitBits ((k, a2) : bs) n2 $): $ splitBits ((suc k, a) : bs) n $ =
'(splitBitsSSi bool1 (eqtr4 add12 ha) (eqtr4 add12 hn) h2);

theorem splitBits_332_
  (hy: $ bs1 ++ (1, bl) : 0 = by $)
  (hc: $ bs1 ++ (3, shl bh 1 + bl) : bs2 = bc $)
  (hsy: $ splitBits by y $)
  (hsx: $ splitBits ((2, bh) : bs2) x $)
  (hs: $ bvSize bs1 = 3 $):
  $ splitBits bc (ch x y) $ =
(focus
  '(mpbi (splitBitseq1 @ eqtr (appendeq2 @ conseq1 @ preq1 add11) hc) @
    mpbir splitBits_mid @ iexie @ iexde @ mpbiri (ian eqid _) ,eqtac)
  '(splitBitsA4ic (eqtr appendass @ appendeq2 append1)
    (eqtr bvSizeA @ eqtr (addeq hs bvSize1) add12)
    (mpbir (splitBitseq1 hy) hsy) hsx));

theorem splitBits_332
  (h1: $ splitBits ((3, a) : (1, bl) : 0) y $)
  (h2: $ splitBits ((2, bh) : (2, c) : 0) x $):
  $ splitBits ((3, a) : (3, shl bh 1 + bl) : (2, c) : 0) (ch x y) $ =
'(splitBits_332_ append1 append1 h1 h2 bvSize1);

do {
  (def (xsplitBits l i) (apply atom-app "xsplitBits_" (hexstring i) l))

  -- Adds theorems such as
  -- theorem xsplitBits_a121:
  --   $ splitBits ((1, 0) : (2, 1) : (1, 1) : 0) xa $;
  -- which decompose hex values into bits in different groupings.
  -- The naming system is 'xsplitBits_' + hex digit + partition,
  -- where partition is one of 13, 22, 31, 121, 1111 representing a partition of 4
  (scan '((1 3) (2 2) (3 1) (1 2 1) (1 1 1 1)) @ fn (l)
    @ for 0 16 @ fn (i)
      (def name (xsplitBits l i))
      @ letrec (
        [lhs @ match-fn*
          [(() _) $0$]
          [((k . xs) n)
            '(cons (pr (,(dn k)) (,(dn {n % {2 ^ k}})))
              ,(lhs xs {n shr k}))]]
        [f @ match-fn*
          [(() n) 'splitBitsx0i]
          [((k . xs) n)
            @ if {k = 1}
            '(,(atom-app 'splitBitsS1i {n % 2})
              ,(hexnhalf n) ,(f xs {n // 2}))
            '(,(atom-app 'splitBitsSSi {n % 2})
              ,(decnhalf {n % {2 ^ k}}) ,(hexnhalf n) ,(f (cons {k - 1} xs) {n // 2}))]])
      (add-tac-thm! name () ()
        '(splitBits ,(lhs l i) (,(hexdigit i))) () @ fn () (f l i)))

  --| `(mk-splitBits (x_1 ... x_k) i)` returns `(n_1 ... n_k p)` where
  --| `p: splitBits ((x_1, n_1) : ... : (x_k, n_k) : 0) i`.
  --|
  --| Here the `x_i` are numbers (a partition of 4),
  --| the `n_i` are decimal numerals, and `i` is a number
  (def (mk-splitBits l i)
    @ letrec ([(f n xs) @ match xs
      [() '((,(xsplitBits l i)))]
      [(k . xs) '((,(dn {n % {2 ^ k}})) . ,(f {n // {2 ^ k}} xs))]])
    (f i l))

  --| `(merge-bits (x_1 ... x_k) n_1 ... n_k)` returns `(i p)` where
  --| `p: splitBits ((x_1, n_1) : ... : (x_k, n_k) : 0) i`.
  --|
  --| Here the `x_i` are numbers (a partition of 4),
  --| the `n_i` are decimal numerals, and `i` is a number
  (def (merge-bits l . is)
    @ letrec ([f @ match-fn*
      [(() () i _) '(,i (,(xsplitBits l i)))]
      [((k . xs) ((a) . is) i m)
        @ f xs is {i + {(decdigit->number a) shl m}} {m + k}]])
    (f l is 0 0))
};

@_ local def splatBitsHelper (n a i j k p q) =
$ i + k = j /\ (chop k (shr n i) = a -> p -> q) $;
theorem splatBitsS_skip (h1: $ i + k = j $) (h2: $ splitBits bs (shr n j) -> p $):
  $ splitBits ((k, a) : bs) (shr n i) -> p $ =
'(sylbi splitBitsS_uniq @ anwr @ sylbi (splitBitseq2 @ eqtr shrshr @ shreq2 h1) h2);
theorem splatBitsS
  (h1: $ splatBitsHelper n a i j k p q $)
  (h2: $ splitBits bs (shr n j) -> p $):
  $ splitBits ((k, a) : bs) (shr n i) -> q $ =
'(mpd (splatBitsS_skip (anli h1) h2) @ syl (anri h1) @ sylbi splitBitsS_uniq anl);
theorem splatBits1 (h: $ splatBitsHelper n a i j k T. q $):
  $ splitBits ((k, a) : bs) (shr n i) -> q $ = '(splatBitsS h (a1i itru));
theorem splatBits0 (h: $ splitBits bs (shr n x0) -> p $):
  $ splitBits bs n -> p $ = '(sylbir (splitBitseq2 @ eqtr3 (shreq2 dec0) shr02) h);

theorem splatBitsHelper0: $ splatBitsHelper n a i i 0 p p $ = '(iani add0 idd);
theorem splatBitsHelperS (h1: $ suc i = i2 $) (h2: $ suc k2 = k $)
  (h3: $ a // 2 = a2 $) (h4: $ nat (0 e. a) = b $)
  (h: $ splatBitsHelper n a2 i2 j k2 p q $):
  $ splatBitsHelper n a i j k p (q /\ bit n i = b) $ =
(focus
  (have 'h5 '(eqtr3 (addeq1 h1) @ eqtr addSass (addeq2 h2)))
  '(iani (eqtr3 h5 (anli h)) @
    syld (syl (anri h) @ syl6eq h3 @ syl5eqr chop_shr2 @
      eqtr3g (eqtr shrshr (shreq2 @ eqtr add12 h1)) shr12 @ shreq1d @
      syl5eq (eqtr (shreq1 @ chopeq1 h5) chop_shr2) id) @
    syl (com12 ian) @ syl6eq h4 @ nateqd @
    syl5bb (bitr2 el_chop @ bitr (bian1 @ mpbi (lteq2 h2) lt01S) @
      bitr elshr @ eleq1 add01) elneq2));
theorem splatBitsHelperSb0 (h1: $ suc i = i2 $) (h2: $ suc k2 = k $) (h3: $ a = b0 a2 $)
  (h: $ splatBitsHelper n a2 i2 j k2 p q $):
  $ splatBitsHelper n a i j k p (q /\ bit n i = 0) $ =
'(splatBitsHelperS h1 h2 (eqtr (diveq1 h3) b0div2)
    (mpbir nateq0 @ mpbir (noteq @ bitr el01 @ oddeq h3) b0odd) h);
theorem splatBitsHelperSb1 (h1: $ suc i = i2 $) (h2: $ suc k2 = k $) (h3: $ a = b1 a2 $)
  (h: $ splatBitsHelper n a2 i2 j k2 p q $):
  $ splatBitsHelper n a i j k p (q /\ bit n i = 1) $ =
'(splatBitsHelperS h1 h2 (eqtr (diveq1 h3) b1div2)
    (mpbir nateq1 @ mpbir (bitr el01 @ oddeq h3) b1odd) h);

--| Given `bs` and `n`, returns `(p pr)` where `pr: splitBits bs n -> p`
--| and `p` is a conjunction of `bit n i = a` literals for each `i` for
--| which the split bits expression is not a variable.
--|
--| For example, `(mk-splatBits $((1, v) : (3, 0) : (4, vs) : 0)$ $b$)` proves:
--| ```
--| $ splitBits ((1, v) : (3, 0) : (4, vs) : 0) b ->
--|   T. /\ bit b x3 = 0 /\ bit b x2 = 0 /\ bit b x1 = 0 $
--| ```
do (def (mk-splatBits bs n)
  @ letrec (
    [(helper na a i nk k)
      @ if {nk = 0} (list i @ fn (p) '(,p (splatBitsHelper0 ,a ,i ,n ,p))) @ begin
      @ match (mksuc i) @ (i2 pr1)
      @ let ([nk2 {nk - 1}] [k2 '(,(dn nk2))] [pr2 '(,(dsucn nk2))])
      @ let ([na2 {na // 2}] [m {na % 2}] [a2 '(,(dn na2))] [pr3 '(,(decnhalf na))])
      @ match (helper na2 a2 i2 nk2 k2) @ (j helper2)
      @ list j @ fn (p) @ match (helper2 p) @ (q pr4)
      @ list $,q /\ bit ,n ,i = ,'(,(dn m)) $
      @ list (atom-app 'splatBitsHelperSb m) a a2 i i2 j k k2 n p q pr1 pr2 pr3 pr4]
    [(rec i bs) @ match bs
      [$0$]
      [$(,k, ,a) : ,bs$
        @ match (match a [(a) (decdigit->number a)] [_])
        [#undef
          @ match (mktohex $ ,i + ,k $) @ (j pr1)
          @ match (rec j bs)
          [#undef]
          [(p pr) '(,p (splatBitsS_skip ,a ,bs ,i ,j ,k ,n ,p ,pr1 ,pr))]]
        [na @ match (helper na a i (decdigit->number @ hd k) k) @ (j helper2)
          @ match (rec j bs)
          [#undef @ match (helper2 $T.$) @ (q pr)
            '(,q (splatBits1 ,a ,bs ,i ,j ,k ,n ,q ,pr))]
          [(p pr2) @ match (helper2 p) @ (q pr)
            '(,q (splatBitsS ,a ,bs ,i ,j ,k ,n ,p ,q ,pr ,pr2))]]]])
  @ match (rec '(h2n @ x0) bs) @ (p pr) '(,p (splatBits0 ,bs ,n ,p ,pr)));

--| Refine script that proves goals of the form `$ splitBits bs n -> ? $`,
--| filling in `?` with a conjunction of bits lemmas. (See also `mk-splatBits`.)
do (def (splatBits-tac refine t) @ refine t
  @ match t @ $ splitBits ,bs ,n -> ,_ $
  @ match (mk-splatBits bs n) @ (p pr) '{,(verb pr) : $ _ -> ,(verb p) $});

theorem splatBits_ch (h1: $ m = y $) (h2: $ n = x $)
  (h3: $ splitBits ((4, m) : (4, n) : 0) b -> p $): $ b = ch x y -> p $ =
'(syl h3 @ mpbiri (splitBitsA4ic append1 bvSize1
    (splitBits14ie h1) (splitBits14ie h2)) splitBitseq2);

--| Given `x`, `y`, `b`, returns `(p pr)` where `pr: b = ch x y -> p`
--| and `p` is a conjunction of `bit n i = a` literals for each `i` in 0 to 8.
--| See also `mk-splatBits`.
do (def (mk-splatBits-ch x y b)
  @ let ([nx (hexdigit->number @ hd x)] [ny (hexdigit->number @ hd y)]
         [m '(,(dn ny))] [p1 '(,(decn ny))] [n '(,(dn nx))] [p2 '(,(decn nx))])
  @ match (mk-splatBits $ (4, ,m) : (4, ,n) : 0 $ b) @ (p p3)
  '(,p (splatBits_ch ,b ,m ,n ,p ,x ,y ,p1 ,p2 ,p3)));

----------------------------------------
-- x86-64 machine code decoding
----------------------------------------

@_ def Regs: nat = $ Bits 4 $;
theorem Regs_lem (h: $ a < 16 $): $ a e. Regs $ = '(mpbir elBits2 @ mpbir (lteq2 d2pow4) h);
@(add-eval) def RAX: nat = $ 0 $;
pub theorem RAX_T: $ RAX e. Regs $ = '(! Regs_lem $0$ ,norm_num);
@(add-eval) def RCX: nat = $ 1 $;
pub theorem RCX_T: $ RCX e. Regs $ = '(! Regs_lem $1$ ,norm_num);
@(add-eval) def RDX: nat = $ 2 $;
pub theorem RDX_T: $ RDX e. Regs $ = '(! Regs_lem $2$ ,norm_num);
@(add-eval) def RBX: nat = $ 3 $;
pub theorem RBX_T: $ RBX e. Regs $ = '(! Regs_lem $3$ ,norm_num);
@(add-eval) def RSP: nat = $ 4 $;
pub theorem RSP_T: $ RSP e. Regs $ = '(! Regs_lem $4$ ,norm_num);
@(add-eval) def RBP: nat = $ 5 $;
pub theorem RBP_T: $ RBP e. Regs $ = '(! Regs_lem $5$ ,norm_num);
@(add-eval) def RSI: nat = $ 6 $;
pub theorem RSI_T: $ RSI e. Regs $ = '(! Regs_lem $6$ ,norm_num);
@(add-eval) def RDI: nat = $ 7 $;
pub theorem RDI_T: $ RDI e. Regs $ = '(! Regs_lem $7$ ,norm_num);
theorem R11_T: $ 11 e. Regs $ = '(Regs_lem ,norm_num);

@_ def REX: set = $ Option (Bits 4) $;
@_ def REX_val (r: nat): nat = $ r - 1 $;
@_ def REX_W (r: nat): nat = $ bit (REX_val r) 3 $;
@_ def REX_R (r: nat): nat = $ bit (REX_val r) 2 $;
@_ def REX_X (r: nat): nat = $ bit (REX_val r) 1 $;
@_ def REX_B (r: nat): nat = $ bit (REX_val r) 0 $;
theorem REX_val0: $ REX_val 0 = 0 $ = 'sub01;
pub theorem REX_valT (r: nat): $ r e. REX -> REX_val r e. Bits 4 $ =
'(sylbi elopt @ eor (mpbiri elBits01 @ eleq1d @ syl6eq REX_val0 REX_valeq) id);
pub theorem REX_W_T (r: nat): $ bool (REX_W r) $ = 'bitT;
pub theorem REX_R_T (r: nat): $ bool (REX_R r) $ = 'bitT;
pub theorem REX_X_T (r: nat): $ bool (REX_X r) $ = 'bitT;
pub theorem REX_B_T (r: nat): $ bool (REX_B r) $ = 'bitT;

theorem REX_bit_0: $ bit (REX_val 0) i = 0 $ = '(eqtr (biteq1 REX_val0) bit01);
theorem REX_W_0: $ REX_W 0 = 0 $ = 'REX_bit_0;
theorem REX_R_0: $ REX_R 0 = 0 $ = 'REX_bit_0;
theorem REX_X_0: $ REX_X 0 = 0 $ = 'REX_bit_0;
theorem REX_B_0: $ REX_B 0 = 0 $ = 'REX_bit_0;

theorem REX_W_Si (h: $ bit rex 3 = a $): $ REX_W (suc rex) = a $ = '(eqtr (biteq1 sucsub1) h);
theorem REX_R_Si (h: $ bit rex 2 = a $): $ REX_R (suc rex) = a $ = '(eqtr (biteq1 sucsub1) h);
theorem REX_X_Si (h: $ bit rex 1 = a $): $ REX_X (suc rex) = a $ = '(eqtr (biteq1 sucsub1) h);
theorem REX_B_Si (h: $ bit rex 0 = a $): $ REX_B (suc rex) = a $ = '(eqtr (biteq1 sucsub1) h);

@(add-eval @ fn (b r) {{(eval b) shl 3} + (eval r)})
@_ def rex_reg (b r: nat): nat = $ shl b 3 + r $;
pub theorem rex_regT (b r: nat): $ bool b /\ r e. Bits 3 -> rex_reg b r e. Regs $ =
'(sylibr (elneq2 @ Bitseq {,norm_num : $ 4 = 1 + 3 $}) @ sylbir (aneq1i elBits1) shladdT);

theorem rex_reg_i (h: $ splitBits ((3, r) : (1, b) : 0) n $): $ rex_reg b r = n $ =
'(eqtr3 (addeq1 @ shleq1 ofBits1) @ anri @ mpbi splitBitsS2 h);

theorem splitBits_121_rex_reg
  (h1: $ splitBits ((1, bl) : (2, bh) : (1, r) : 0) rn $)
  (h2: $ rex = r $): $ rn = rex_reg rex (shl bh 1 + bl) $ =
(focus '(eqcom @ rex_reg_i @
  mpbi (splitBitseq1 @ conseq (preq1 add11) @ conseq1 @ preq2 @ eqcom h2) @
  mpbir splitBits_split @ iexie @ iexde @ mpbiri (ian eqid h1) ,eqtac));

@_ def Base: set = $ Option (Option Regs) $;
@_ def base_RIP: nat = $ suc 0 $;
@_ def base_reg (r: nat): nat = $ suc (suc r) $;
pub theorem base0T: $ 0 e. Base $ = 'opt0;
pub theorem base_RIP_T: $ base_RIP e. Base $ = '(mpbir optS opt0);
pub theorem base_regT (r: nat): $ base_reg r e. Base <-> r e. Regs $ = '(bitr optS optS);

@_ def ScaleIndex: set = $ Xp (Bits 2) Regs $;

@_ def RM: set = $ Sum Regs (Xp (Option ScaleIndex) (Xp Base u64)) $;
@_ def RM_reg (r: nat): nat = $ b0 r $;
@_ def RM_mem (si base q: nat): nat = $ b1 (si, base, q) $;
pub theorem RM_regT (r: nat): $ RM_reg r e. RM <-> r e. Regs $ = 'Suml;
pub theorem RM_memT (si base q: nat):
  $ RM_mem si base q e. RM <->
    si e. Option ScaleIndex /\ base e. Base /\ q e. u64 $ =
'(bitr Sumr @ bitr4 prelxp @ bitr4 anass @ aneq2i prelxp);

@_ def RM_isMem (rm: nat): wff = $ odd rm $;

theorem readDisplacement_lem: $ x < 3 <-> x e. Bits 2 /\ x != 3 $ =
'(bitr4 ltlene @ aneq1i @ bitr elBits2 @ bitr4 (lteq2 d2pow2) leltsuc);

@_ def readDisplacement (mod q l .b .w: nat): wff =
$ mod = 0 /\ q = 0 /\ l = 0 \/
  E. b (b e. u8 /\ mod = 1 /\ q = sExtq 8 b /\ l = b : 0) \/
  E. w (w e. u32 /\ mod = 2 /\ q = sExtq 32 w /\ l = u32Bytes w) $;
pub theorem readDisplacementT (mod q l: nat):
  $ readDisplacement mod q l ->
    mod e. Bits 2 /\ mod != 3 /\ q e. u64 /\ l e. List u8 $ =
(named @ focus
  (def (p m f g) @ focus
    '(iand (iand (rsyl ,m @ mpbiri _ lteq1) @ mpbird (eleq1d anlr) ,f) ,g)
    norm_num)
  '(sylib (aneq1i @ aneq1i readDisplacement_lem) @ eor (eor _ @ eex _) @ eex _)
  (p 'anll '(a1i elBits01) '(mpbiri elList0 @ eleq1d anr))
  (p 'anllr '(sylan sExtqT (a1i ,norm_num) an3l)
    '(mpbird (eleq1d anr) @ sylibr elList1 an3l))
  (p 'anllr '(sylan sExtqT (a1i d32le64) an3l)
    '(mpbiri (elArrayList u32BytesT) (eleq1d anr))));

theorem readDisplacement_len_le: $ readDisplacement md q l -> len l <= 4 $ =
(named '(eor (eor (mpbiri le01 @ leeq1d @ syl6eq len0 @ leneqd anr) @
    eex @ mpbird (leeq1d @ syl6eq len1 @ leneqd anr) @ a1i ,norm_num) @
  eex @ syl eqle @ syl6eq u32Bytes_len @ leneqd anr));

theorem readDisplacement_0: $ readDisplacement 0 0 s0 $ =
(named '(orl @ orl @ ian (ian eqid eqid) s2ns0));
theorem readDisplacement_8
  (h1: $ a e. u8 $) (h2: $ l = i8Bytes a $):
  $ readDisplacement 1 (chopZ 64 a) l $ =
(named @ focus
  '(orl @ orr @ iexie @ mpbiri (ian _ @ eqtr h2 i8Bytes_val) ,eqtac)
  '(ian (ian chopZT eqid) @ eqcom @ sExt_chopZ @ iani d8le64 h1));
theorem readDisplacement_32
  (h1: $ a e. u32 $) (h2: $ l = i32Bytes a $):
  $ readDisplacement 2 (chopZ 64 a) l $ =
(named @ focus
  '(orr @ iexie @ mpbiri (ian _ @ eqtr h2 i32Bytes_val) ,eqtac)
  '(ian (ian chopZT eqid) @ eqcom @ sExt_chopZ @ iani d32le64 h1));

@_ def readSIBDisplacement (mod bbase q base l .w: nat): wff =
$ ifp (bbase = RBP /\ mod = 0)
    (E. w (w e. u32 /\ q = sExtq 32 w /\ base = 0 /\ l = u32Bytes w))
    (readDisplacement mod q l /\ base = base_reg bbase) $;
pub theorem readSIBDisplacementT (mod bbase q base l: nat):
  $ bbase e. Regs /\ readSIBDisplacement mod bbase q base l ->
    mod e. Bits 2 /\ mod != 3 /\ q e. u64 /\ base e. Base /\ l e. List u8 $ =
(named @ focus
  '(imp @ eord (impd @ expcom @ eexda _) @
    syl5 anr @ exp @ sylib anrass @ iand (rsyl anrl readDisplacementT) @
    mpbird (eleq1d anrr) @ sylibr base_regT anl)
  '(iand _ @ mpbiri (elArrayList u32BytesT) (eleq1d anrr))
  '(iand _ @ anwr @ mpbiri base0T @ eleq1d anlr)
  '(iand _ @ anwr @ mpbird (eleq1d anllr) (sylan sExtqT (a1i d32le64) an3l))
  '(sylib readDisplacement_lem @ mpbiri _ (lteq1d anllr))
  norm_num);

theorem readSIBDisplacement_len_le: $ readSIBDisplacement md bbase q base l -> len l <= 4 $ =
(named '(eor (anwr @ eex @ mpbird (leeq1d @ syl6eq u32Bytes_len @ leneqd anr) @ a1i ,norm_num) @
  rsyl anrl readDisplacement_len_le));

theorem readSIBDisplacement_0
  (h1: $ a e. u32 $) (h2: $ l = i32Bytes a $):
  $ readSIBDisplacement 0 x5 (chopZ 64 a) 0 l $ =
(focus
  '(mpbir (ifppos @ ian h2n5 eqid) _)
  '(iexie @ mpbiri (iani (iani _ eqid) (eqtr h2 i32Bytes_val)) ,eqtac)
  '(iani chopZT @ eqcom @ sExt_chopZ @ iani d32le64 h1));

@_ def readSIB (rex mod rm l .b .l2 .bs .ix .sc .disp .bbase .index: nat): wff =
$ E. b E. l2 E. bs E. ix E. sc E. disp E. bbase E. index (
    splitBits ((3, bs) : (3, ix) : (2, sc) : 0) b /\
    index = rex_reg (REX_X rex) ix /\
    readSIBDisplacement mod (rex_reg (REX_B rex) bs) disp bbase l2 /\
    rm = RM_mem (if (index = RSP) 0 (suc (sc, index))) bbase disp /\
    l = b : l2) $;
pub theorem readSIB_T (rex mod rm l: nat):
  $ readSIB rex mod rm l ->
    mod e. Bits 2 /\ mod != 3 /\ rm e. RM /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ eex @ eex @ eex @ eex @ eex @ eex _)
  (have 'sb $ _ -> 3, bs e. Bitvec /\ _ $ '(sylib elListS @ anld an4l))
  (have 'sb2 $ _ -> 3, ix e. Bitvec /\ _ $ '(sylib elListS @ anrd sb))
  (have 'sb3 $ _ -> 2, sc e. Bitvec /\ _ $ '(sylib elListS @ anrd sb2))
  (have 'H $ _ -> mod e. Bits 2 /\ mod != 3 /\ disp e. u64 /\ bbase e. Base /\ l2 e. List u8 $
    '(sylan (! readSIBDisplacementT mod $rex_reg (REX_B rex) bs$ disp bbase l2)
      (sylan rex_regT (a1i REX_B_T) @ sylib elBitvec2 @ anld sb) anllr))
  '(iand (iand (rsyl H an3l) _) @
    mpbird (eleq1d anr) @ sylibr elListS @
    iand (anw4l @ splitBitsTi ,bvSizeSi) @ anrd H)
  '(mpbird (eleq1d anlr) @ sylibr RM_memT @ iand (iand _ _) _)
  '(sylan ifT (a1i opt0) @ optSd @
    xpTd (sylib elBitvec2 @ anld sb3) @
    mpbird (eleq1d an3lr) @ sylan rex_regT (a1i REX_X_T) @
    sylib elBitvec2 @ anld sb2)
  '(rsyl H anlr)
  '(rsyl H anllr));

theorem readSIB_len_le: $ readSIB rex md rm l -> len l <= 5 $ =
(named '(eex @ eex @ eex @ eex @ eex @ eex @ eex @ eex @
  mpbird (leeq1d @ syl6eq lenS @ leneqd anr) @
  rsyl anllr @ sylib lesuc readSIBDisplacement_len_le));

theorem readSIBDisplacement_reg
  (h1: $ bbase != x5 \/ 0 < md $)
  (h2: $ readDisplacement md q l $):
  $ readSIBDisplacement md bbase q (base_reg bbase) l $ =
(named '(mpbir (ifpneg @ mpbir notan @ mpbi (oreq (neeq2 h2n5) lt01) h1) @ ian h2 eqid));

@_ local def readModRM2 (rex rm rm2 mod l: nat): wff =
$ ifp (mod = 3) (rm = RM_reg (rex_reg (REX_B rex) rm2) /\ l = 0)
  (ifp (rm2 = 5 /\ mod = 0)
    (E. i (i e. u32 /\
      rm = RM_mem 0 base_RIP (sExtq 32 i) /\
      l = u32Bytes i))
  (ifp (rm2 = 4) (readSIB rex mod rm l)
    (E. disp (readDisplacement mod disp l /\
      rm = RM_mem 0 (base_reg (rex_reg (REX_B rex) rm2)) disp)))) $;
theorem readModRM2_T (rex rm rm2 mod l: nat):
  $ rm2 e. Bits 3 /\ readModRM2 rex rm rm2 mod l -> rm e. RM /\ l e. List u8 $ =
(named @ focus '(imp @ eord _ _)
  (focus '(exp @ iand _ _)
    (focus '(mpbird (eleq1d @ anld anrr) @ sylibr RM_regT @
      sylan rex_regT (a1i REX_B_T) anl))
    (focus '(mpbiri elList0 @ eleq1d @ anrd anrr)))
  (focus '(syl5 anr @ eord _ @ syl5 anr @ eord _ _)
    (focus '(syl5 anr @ eexda @ iand _ _)
      (focus '(anwr @ mpbird (eleq1d anlr) @ sylibr RM_memT @
        iand (a1i @ ian opt0 base_RIP_T) @ syl sExtqT @ iand (a1i d32le64) anll))
      (focus '(mpbiri (elArrayList u32BytesT) (eleq1d anrr))))
    (focus '(a1i @ anwr @ rsyl readSIB_T @ anim1 anr))
    (focus
      (have 'h2 '(rsyl anrl readDisplacementT))
      '(syl5 anr @ eexd @ exp @ iand _ @ anrd h2)
      '(mpbird (eleq1d anrr) @ sylibr RM_memT @ iand (iand (a1i opt0) _) _)
      (focus '(sylibr base_regT @ sylan rex_regT (a1i REX_B_T) anl))
      (focus '(syl anlr h2)))));

theorem readModRM2_reg (h1: $ REX_B rex = b $) (h2: $ rex_reg b rm2 = r $):
  $ readModRM2 rex (RM_reg r) rm2 3 s0 $ =
(named '(mpbir (ifppos eqid) @ ian (RM_regeq @ eqtr2 (rex_regeq1 h1) h2) s2ns0));
theorem readModRM2_rip
  (h1: $ a e. u32 $) (h2: $ l = i32Bytes a $):
  $ readModRM2 rex (RM_mem 0 base_RIP (chopZ 64 a)) 5 0 l $ =
(named '(mpbir (ifpneg @ ltne d0lt3) @ mpbir (ifppos @ ian eqid eqid) @
  iexie @ mpbiri (ian (ian chopZT @ RM_memeq3 @
    eqcom @ sExt_chopZ @ iani d32le64 h1) @ eqtr h2 i32Bytes_val) ,eqtac));
theorem readModRM2_sib (h: $ readSIB rex md rm l $):
  $ readModRM2 rex rm 4 md l $ =
(named '(mpbir (ifpneg @ anllr @ readSIB_T h) @
  mpbir (ifpneg @ mt anl {,norm_num : $ 4 != 5 $}) @ mpbir (ifppos eqid) h));
theorem readModRM2_mem
  (h1: $ REX_B rex = b $) (h2: $ rex_reg b rm2 = r $)
  (h3: $ rm2 != x4 $)
  (h4: $ rm2 != x5 \/ 0 < md $)
  (h5: $ readDisplacement md disp l $):
  $ readModRM2 rex (RM_mem 0 (base_reg r) disp) rm2 md l $ =
(named '(mpbir (ifpneg @ anllr @ readDisplacementT h5) @
  mpbir (ifpneg @ mpbir notan @ mpbi (oreq (neeq2 h2n5) lt01) h4) @
  mpbir (ifpneg @ mpbi (neeq2 h2n4) h3) @
  iexie @ mpbiri (ian h5 @ RM_memeq2 @ base_regeq @ eqtr2 (rex_regeq1 h1) h2) ,eqtac));

theorem readSIB_I
  (h1: $ splitBits ((3, bs) : (1, ixl) : 0) y $)
  (h2: $ splitBits ((2, ixh) : (2, sc) : 0) x $)
  (h3: $ REX_X rex = rx $)
  (h4: $ splitBits ((1, ixl) : (2, ixh) : (1, rx) : 0) index $)
  (h5: $ REX_B rex = rb $)
  (h6: $ splitBits ((3, bs) : (1, rb) : 0) bbase $)
  (h7: $ readSIBDisplacement md bbase disp base l $)
  (h8: $ if (index = RSP) 0 (suc (sc, index)) = osi $):
  $ readModRM2 rex (RM_mem osi base disp) 4 md (ch x y ': l) $ =
(focus
  '(readModRM2_sib @ iexie ,(iterate 7 (fn (x) '(iexde ,x)) '(mpbiri _ ,eqtac)))
  '(iani (iani (iani _ _) _) s2nscons)
  '(iani (splitBits_332 h1 h2) (splitBits_121_rex_reg h4 h3))
  '(mpbir (readSIBDisplacementeq2 @ eqtr (rex_regeq1 h5) @ rex_reg_i h6) h7)
  '(RM_memeq1 @ eqcom h8));

theorem readSIB_0
  (h1: $ splitBits ((3, bs) : (1, 0) : 0) y $)
  (h2: $ splitBits ((2, 2) : (2, sc) : 0) x $)
  (h3: $ REX_X rex = 0 $)
  (h5: $ REX_B rex = rb $)
  (h6: $ splitBits ((3, bs) : (1, rb) : 0) bbase $)
  (h7: $ readSIBDisplacement md bbase disp base l $):
  $ readModRM2 rex (RM_mem 0 base disp) 4 md (ch x y ': l) $ =
'(readSIB_I h1 h2 h3 xsplitBits_4121 h5 h6 h7 @ ifpos h2n4);

theorem readSIB_S
  (h1: $ splitBits ((3, bs) : (1, ixl) : 0) y $)
  (h2: $ splitBits ((2, ixh) : (2, sc) : 0) x $)
  (h3: $ REX_X rex = rx $)
  (h4: $ splitBits ((1, ixl) : (2, ixh) : (1, rx) : 0) index $)
  (h5: $ REX_B rex = rb $)
  (h6: $ splitBits ((3, bs) : (1, rb) : 0) bbase $)
  (h7: $ readSIBDisplacement md bbase disp base l $)
  (h8: $ index != x4 $):
  $ readModRM2 rex (RM_mem (suc (sc, index)) base disp) 4 md (ch x y ': l) $ =
'(readSIB_I h1 h2 h3 h4 h5 h6 h7 @ ifneg @ mpbi (neeq2 h2n4) h8);

@_ def readModRM (rex rn rm l .b .rm2 .opc .mod .i .l2 .disp: nat): wff =
$ E. b E. rm2 E. opc E. mod (
    splitBits ((3, rm2) : (3, opc) : (2, mod) : 0) b /\
    rn = rex_reg (REX_R rex) opc /\
    ifp (mod = 3)
      (rm = RM_reg (rex_reg (REX_B rex) rm2) /\
        l = b : 0)
      (ifp (rm2 = 5 /\ mod = 0)
        (E. i (i e. u32 /\
          rm = RM_mem 0 base_RIP (sExtq 32 i) /\
          l = b : u32Bytes i))
        (E. l2 (l = b : l2 /\
          ifp (rm2 = 4) (readSIB rex mod rm l2)
            (E. disp (readDisplacement mod disp l2 /\
              rm = RM_mem 0 (base_reg (rex_reg (REX_B rex) rm2)) disp)))))) $;
theorem readModRM_val (rex rn rm l: nat): $ readModRM rex rn rm l <->
  E. b E. rm2 E. opc E. m (
    splitBits ((3, rm2) : (3, opc) : (2, m) : 0) b /\
    rn = rex_reg (REX_R rex) opc /\
    E. l2 (l = b : l2 /\ readModRM2 rex rm rm2 m l2)) $ =
(named '(exeqi @ exeqi @ exeqi @ rexeqi @
  bitr2 (exeqi ifpan2) @ bitr exifp @
  ifpeq biid (bitr (exeqi @ bitr3 anass ancomb) @
    exeqe @ syl5bb ancomb @ aneq2d @ eqeq2d conseq2) @
  bitr (exeqi ifpan2) @ bitr exifp @ ifpeq2 @
  bitr rexcomb @ rexeqi @ bitr (exeqi ancomb) @ exeqe ,eqtac));
theorem readModRM_val2 (rex rn rm l: nat): $ readModRM rex rn rm l <->
  E. b E. l2 (l = b : l2 /\ E. rm2 E. opc E. m (
    splitBits ((3, rm2) : (3, opc) : (2, m) : 0) b /\
    rn = rex_reg (REX_R rex) opc /\
    readModRM2 rex rm rm2 m l2)) $ =
'(bitr readModRM_val @ exeqi @ birexexi @ birexexi @ birexexi @ birexan2i biid);

pub theorem readModRM_T (rex rn rm l: nat):
  $ readModRM rex rn rm l -> rn e. Regs /\ rm e. RM /\ l e. List u8 $ =
(focus
  '(sylbi readModRM_val @ !! eex b @ !! eex rm2 @ !! eex opc @ !! eex mod _)
  (def S $ splitBits ((3, rm2) : (3, opc) : (2, mod) : 0) b $)
  (have 'sb1 $ ,S /\ _ /\ _ -> 3, rm2 e. Bitvec /\ _ $ '(sylib elListS @ anld anll))
  (have 'sb2 $ _ -> 3, opc e. Bitvec /\ _ $ '(sylib elListS @ anrd sb1))
  '(imp @ !! eexda l2 @ sylibr anass @ iand
    (mpbird (eleq1d anlr) @ sylan rex_regT (a1i REX_R_T) @
      sylib elBitvec2 @ anld sb2)
    (mpbird (aneq2d @ syl6bb elListS @ eleq1d anrl) @
      sylib anlass @ iand (anwll @ splitBitsTi ,bvSizeSi) @
      sylan readModRM2_T (sylib elBitvec2 @ anld sb1) anrr)));

theorem readModRM_len_le: $ readModRM rex rn rm l -> len l <= 6 $ =
(named '(eex @ eex @ eex @ eex @ anwr @ eor
  (mpbird (leeq1d @ syl6eq len1 @ leneqd anrr) @ a1i lt01S) @
  anwr @ eor
    (anwr @ eex @ mpbird (leeq1d @ syl6eq (suceq u32Bytes_len) @ syl6eq lenS @ leneqd anr) @
      a1i lesucid) @
  anwr @ eex @ mpbird (leeq1d @ syl6eq lenS @ leneqd anl) @ anwr @ eor
    (anwr @ sylib lesuc readSIB_len_le) @
  anwr @ eex @ anwl @ sylib lesuc @ rsyl readDisplacement_len_le @ mpi lesucid letr));

theorem readModRM_I
  (h1: $ splitBits ((3, rm2) : (1, o) : 0) y $)
  (h2: $ splitBits ((2, pc) : (2, md) : 0) x $)
  (h3: $ REX_R rex = r $)
  (h4: $ splitBits ((1, o) : (2, pc) : (1, r) : 0) rn $)
  (h5: $ readModRM2 rex rm rm2 md l $):
  $ readModRM rex rn rm (ch x y ': l) $ =
(focus
  '(mpbir readModRM_val @ iexie @ iexde @ iexde @ iexde @
    mpbiri (ian (ian (splitBits_332 h1 h2) (splitBits_121_rex_reg h4 h3)) _) ,eqtac)
  '(iexie @ mpbiri (ian s2nscons h5) ,eqtac));

@_ def readOpcodeModRM (rex v rm l .rn: nat): wff =
$ E. rn (readModRM rex rn rm l /\ v = chop 3 rn) $;
pub theorem readOpcodeModRM_T (rex v rm l: nat):
  $ readOpcodeModRM rex v rm l -> v e. Bits 3 /\ rm e. RM /\ l e. List u8 $ =
(named @ focus
  (have 'h '(anwl readModRM_T))
  '(eex @ iand (iand (mpbiri chopT @ eleq1d anr) (syl anlr h)) (anrd h)));

theorem readOpcodeModRM_len_le: $ readOpcodeModRM rex ast b l -> len l <= 6 $ =
(named '(eex @ anwl readModRM_len_le));

theorem readOpcodeModRM_I
  (h1: $ splitBits ((3, rm2) : (1, o) : 0) y $)
  (h2: $ splitBits ((2, pc) : (2, md) : 0) x $)
  (h3: $ splitBits ((1, o) : (2, pc) : (1, 0) : 0) opc $)
  (h4: $ readModRM2 rex r rm2 md l $):
  $ readOpcodeModRM rex opc r (ch x y ': l) $ =
(focus
  (suffices 'h '{_ :
    $ splitBits ((1, o) : (2, pc) : (1, REX_R rex) : 0) (shl (REX_R rex) 3 + opc) /\
      opc = chop 3 (shl (REX_R rex) 3 + opc) $})
  '(iexie @ mpbiri (iani (readModRM_I h1 h2 eqid (anl h) h4) (anr h)) ,eqtac)
  (have 'sp $ E. a (
      splitBits ((1, o) : (2, pc) : 0) a /\
      splitBits ((3, a) : (1, 0) : 0) opc) $
   '(mpbi (splitBitsA @ eqtr4 ,bvSizeSi dec3) @
    mpbir (splitBitseq1 @ appendSi append1) h3))
  '(eex (imp @ syl5bi splitBitsS @ impd @ exp @ !! eexd z @ syl5 _ _) sp)
  '(impcom @ bi2d @ eqeq1d @ syl5eqr add01 @ addeq1d @
    syl5eqr shl01 @ shleq1d @ sylbi splitBits1 anr)
  '(syl5ibrcom (rsyl eqcom ,eqtac) @
    mpand (sylibr splitBitsS @ iand anr @ iexde @
      mpbird ,eqtac @ a1i @ ian eqid @ splitBits1i @ mpbir elBits1 REX_R_T) @
    iand _ @ eqcomd @ anld @ sylib splitBitsS_uniq anr)
  '(sylib (splitBitseq1 @ appendSi append1) @
    sylibr (splitBitsA @ eqtr4 ,bvSizeSi dec3) @
    iexde @ mpbird ,eqtac @ iand an3l anlr));

@_ def readPrefixes (rex l .b .rex2: nat): wff =
$ rex = 0 /\ l = 0 \/ E. b E. rex2 (
    splitBits ((4, rex2) : (4, 4) : 0) b /\
    rex = suc rex2 /\ l = b : 0) $;
pub theorem readPrefixesT (rex l: nat):
  $ readPrefixes rex l -> rex e. REX /\ l e. List u8 $ =
(named '(eor
  (anim (mpbiri opt0 eleq1) (mpbiri elList0 eleq1))
  (eex @ eex @ iand
    (mpbird (eleq1d anlr) @ sylibr optS @ anwll @
      sylib elBitvec2 @ elListHd anl)
    (mpbird (eleq1d anr) @ sylibr elList1 @ anwll @ splitBitsTi ,bvSizeSi))));

theorem readPrefixes_len_le: $ readPrefixes rex l -> len l <= 1 $ =
(named '(eor (anwr @ mpbiri le01 @ leeq1d @ syl6eq len0 leneq) @
  eex @ eex @ anwr @ syl eqle @ syl6eq len1 leneq));

@_ def readImmN (k q l .w: nat): wff =
$ 8 || k /\ E. w (w e. Bits k /\ q = sExtq k w /\ l = toBytes (k // 8) w) $;
pub theorem readImmN_T (k q l: nat):
  $ k <= 64 /\ readImmN k q l -> q e. u64 /\ l e. List u8 $ =
(named '(impcom @ anwr @ eex @ exp @ iand
  (mpbird (eleq1d anllr) @ syl sExtqT @ iand anr an3l)
  (mpbiri (elArrayList toBytesT) (eleq1d anlr))));

theorem readImmN_len: $ readImmN k q l -> len l = k // 8 $ =
(named '(anwr @ eex @ syl6eq toBytes_len @ leneqd anr));
theorem readImmN_len2 (h: $ 8 * n = k $): $ readImmN k q l -> len l = n $ =
'(syl6eq (eqtr3 (diveq1 h) @ muldiv2 d8ne0) readImmN_len);

theorem readImmN_val: $ readImmN k q l <->
  E. w (w e. Bits k /\ (8 || k /\ (q = sExtq k w /\ l = toBytes (k // 8) w))) $ =
'(birexan2i @ exeqi anass);

theorem readImm8T: $ readImmN 8 q l -> q e. u64 /\ l e. List u8 $ =
'(syl readImmN_T @ ian d8le64);
theorem readImm16T: $ readImmN 16 q l -> q e. u64 /\ l e. List u8 $ =
'(syl readImmN_T @ ian d16le64);
theorem readImm32T: $ readImmN 32 q l -> q e. u64 /\ l e. List u8 $ =
'(syl readImmN_T @ ian d32le64);
theorem readImm64T: $ readImmN 64 q l -> q e. u64 /\ l e. List u8 $ =
'(syl readImmN_T @ ian leid);
theorem readImm8_32T: $ readImmN (if p 8 32) q l -> q e. u64 /\ l e. List u8 $ =
'(trud @ ifbothd
  (imeq1d readImmNeq1) (imeq1d readImmNeq1)
  (a1i readImm8T) (a1i readImm32T));

theorem readImm8_len: $ readImmN 8 q l -> len l = 1 $ = '(readImmN_len2 mul12);
theorem readImm16_len: $ readImmN 16 q l -> len l = 2 $ = '(readImmN_len2 d8mul2);
theorem readImm32_len: $ readImmN 32 q l -> len l = 4 $ = '(readImmN_len2 d8mul4);
theorem readImm64_len: $ readImmN 64 q l -> len l = 8 $ = '(readImmN_len2 d8mul8);
theorem readImm8_32_len_le: $ readImmN (if p 8 32) q l -> len l <= 4 $ =
'(trud @ ifbothd
  (imeq1d readImmNeq1) (imeq1d readImmNeq1)
  (a1i @ mpbiri d0lt4 @ leeq1d readImm8_len)
  (a1i @ syl eqle readImm32_len));

theorem readImmN_I (h1: $ 8 * i = k $) (h2: $ k <= 64 $)
  (h3: $ a e. Bits k $) (h4: $ s2n l = toIBytes i a $):
  $ readImmN k (chopZ 64 a) l $ =
(focus
  '(iani (mpbi (dvdeq2 h1) dvdmul2) @ iexie @ mpbiri (ian _ _) ,eqtac)
  '(ian chopZT @ eqcom @ sExt_chopZ @ iani h2 h3)
  '(eqtr h4 @ toByteseq (eqtr3 (muldiv2 peano1) (diveq1 h1)) (chopZeq1 h1)));

@_ def WSize (.n: nat): set = $ Xp (8 ; 16 ; 32 ; sn 64) Bool i^i {n | fst n = 8 \/ snd n = 0} $;
@_ def wsizeBits (sz: nat): nat = $ fst sz $;
@_ def wsizeBytes (sz: nat): nat = $ wsizeBits sz // 8 $;
@_ def wSz8 (have_rex: wff): nat = $ 8, nat have_rex $;
@_ def wSz16: nat = $ 16, 0 $;
@_ def wSz32: nat = $ 32, 0 $;
@_ def wSz64: nat = $ 64, 0 $;

theorem WSize_fin: $ finite WSize $ = (named '(infin1 @ xpfin finns finns));

theorem elWSize: $ sz e. WSize <->
  wsizeBits sz e. 8 ; 16 ; 32 ; sn 64 /\ bool (snd sz) /\ (wsizeBits sz = 8 \/ snd sz = 0) $ =
'(bitr elin @ aneq (bitr elxp @ aneq2i elBool) @
  !! elabe x @ oreqd (eqeq1d fsteq) (eqeq1d sndeq));

theorem wSizeBytes_lem (h: $ wsizeBits sz = k $) (h2: $ n * 8 = k $):
  $ wsizeBytes sz = n $ = '(eqtr (diveq1 @ eqtr4 h h2) @ muldiv1 d8ne0);

theorem wSz8Bits: $ wsizeBits (wSz8 r) = 8 $ = 'fstpr;
theorem wSz8Bytes: $ wsizeBytes (wSz8 r) = 1 $ = '(wSizeBytes_lem wSz8Bits ,norm_num);
theorem wSz8T: $ wSz8 r e. WSize $ =
'(mpbir elWSize @ ian (ian
  (mpbir elins @ orl wSz8Bits)
  (mpbir (booleq sndpr) boolnat)) @ orl wSz8Bits);

theorem wSz16Bits: $ wsizeBits wSz16 = 16 $ = 'fstpr;
theorem wSz16Bytes: $ wsizeBytes wSz16 = 2 $ = '(wSizeBytes_lem wSz16Bits ,norm_num);
theorem wSz16T: $ wSz16 e. WSize $ =
'(mpbir elWSize @ ian (ian
  (mpbir elins @ orr @ mpbir elins @ orl wSz16Bits)
  (mpbir (booleq sndpr) bool0)) @ orr sndpr);
theorem wSz32Bits: $ wsizeBits wSz32 = 32 $ = 'fstpr;
theorem wSz32Bytes: $ wsizeBytes wSz32 = 4 $ = '(wSizeBytes_lem wSz32Bits ,norm_num);
theorem wSz32T: $ wSz32 e. WSize $ =
'(mpbir elWSize @ ian (ian
  (mpbir elins @ orr @ mpbir elins @ orr @ mpbir elins @ orl wSz32Bits)
  (mpbir (booleq sndpr) bool0)) @ orr sndpr);
theorem wSz64Bits: $ wsizeBits wSz64 = 64 $ = 'fstpr;
theorem wSz64Bytes: $ wsizeBytes wSz64 = 8 $ = '(wSizeBytes_lem wSz64Bits ,norm_num);
theorem wSz64T: $ wSz64 e. WSize $ =
'(mpbir elWSize @ ian (ian
  (mpbir elins @ orr @ mpbir elins @ orr @ mpbir elins @ orr @ mpbir elsn wSz64Bits)
  (mpbir (booleq sndpr) bool0)) @ orr sndpr);

theorem wsizeBits_le64: $ sz e. WSize -> wsizeBits sz <= 64 $ =
(focus
  (def g '(mpbird leeq1 @ a1i ,norm_num))
  (def (f x) '(sylbi elins @ eor ,g ,x))
  '(sylbi elWSize @ anwll ,(f @ f @ f '(sylbi elsn ,g))));

theorem wsizeBits_bytes: $ sz e. WSize -> 8 * wsizeBytes sz = wsizeBits sz $ =
(focus
  (def g '(eqtr4d (syl6eq _ (muleq2d diveq1)) id))
  (def (f x) '(sylbi elins @ eor ,g ,x))
  '(sylbi elWSize @ anwll ,(f @ f @ f '(sylbi elsn ,g)))
  norm_num norm_num norm_num norm_num);

@_ def readFullImm (sz q l: nat): wff = $ readImmN (wsizeBits sz) q l $;
pub theorem readFullImmT (sz q l: nat):
  $ sz e. WSize /\ readFullImm sz q l -> q e. u64 /\ l e. List u8 $ =
'(syl readImmN_T @ anim1 wsizeBits_le64);

theorem readFullImm_len_le: $ sz e. WSize /\ readFullImm sz q l -> len l <= 8 $ =
'(mpbird (leeq1d @ anwr readImmN_len) @ syl (divlemul1r d8ne0) @ anwl @
  sylibr (leeq2 d8mul8) wsizeBits_le64);

theorem readFullImmI (h1: $ 8 * i = k $)
  (hs: $ sz e. WSize $) (h2: $ wsizeBits sz = k $)
  (h3: $ a e. Bits k $) (h4: $ s2n l = toIBytes i a $):
  $ readFullImm sz (chopZ 64 a) l $ =
'(mpbir (readImmNeq1 h2) @ readImmN_I h1
  (mpbi (leeq1 h2) @ wsizeBits_le64 hs) h3 h4);

theorem readFullImm32I (h1: $ a e. u32 $) (h2: $ s2n l = i32Bytes a $):
  $ readFullImm wSz32 (chopZ 64 a) l $ =
'(readFullImmI d8mul4 wSz32T wSz32Bits h1 h2);

theorem readFullImm64I (h1: $ a e. u64 $) (h2: $ s2n l = i64Bytes a $):
  $ readFullImm wSz64 (chopZ 64 a) l $ =
'(readFullImmI d8mul8 wSz64T wSz64Bits h1 h2);

@_ def readImm (sz q l: nat): wff =
$ readImmN (min (wsizeBits sz) 32) q l $;
pub theorem readImmT (sz q l: nat):
  $ sz e. WSize /\ readImm sz q l -> q e. u64 /\ l e. List u8 $ =
'(syl readImmN_T @ anim1 @ a1i @ letr minle2 d32le64);

theorem readImm_len_le: $ readImm sz q l -> len l <= 4 $ =
'(mpbiri (divlemul1r d8ne0 @ mpbir (leeq2 d8mul4) minle2) @ leeq1d readImmN_len);

@_ def opSize (have_rex: wff) (w v: nat): nat =
$ if (true v) (if (true w) wSz64 wSz32) (wSz8 have_rex) $;
theorem opSizeT2 (have_rex: wff) (w v: nat): $ opSize have_rex w v e. WSize $ =
'(ifT @ ian (ifT @ ian wSz64T wSz32T) wSz8T);
pub theorem opSizeT (have_rex: wff) (w v: nat): $ opSize have_rex w v e. WSize $ = 'opSizeT2;

theorem opSize_64: $ opSize r 1 1 = wSz64 $ = '(eqtr (ifpos true1) (ifpos true1));
theorem opSize_32: $ opSize r 0 1 = wSz32 $ = '(eqtr (ifpos true1) (ifneg true0));
theorem opSize_8: $ opSize r w 0 = wSz8 r $ = '(ifneg true0);

@_ def opSizeW (rex v: nat): nat = $ opSize (rex != 0) (REX_W rex) v $;
pub theorem opSizeW_T (rex v: nat): $ opSizeW rex v e. WSize $ = 'opSizeT;

theorem opSizeW_0 (h: $ opSize F. 0 v = a $): $ opSizeW 0 v = a $ =
'(eqtr (opSizeeq (mpbir neqfal eqid) REX_W_0 eqid) h);
theorem opSizeW_S (h1: $ bit rex 3 = w $)
  (h2: $ opSize T. w v = a $): $ opSizeW (suc rex) v = a $ =
'(eqtr (opSizeeq (mpbir eqtru peano1) (eqtr (biteq1 sucsub1) h1) eqid) h2);

@_ def DestSrc: set = $ Sum (Xp RM (Sum u64 Regs)) (Xp Regs RM) $;
@_ def Rm_i (rm i: nat): nat = $ b0 (rm, b0 i) $;
@_ def Rm_r (rm r: nat): nat = $ b0 (rm, b1 r) $;
@_ def R_rm (r rm: nat): nat = $ b1 (r, rm) $;
pub theorem Rm_iT (rm i: nat): $ Rm_i rm i e. DestSrc <-> rm e. RM /\ i e. u64 $ =
'(bitr Suml @ bitr prelxp @ aneq2i Suml);
pub theorem Rm_rT (rm r: nat): $ Rm_r rm r e. DestSrc <-> rm e. RM /\ r e. Regs $ =
'(bitr Suml @ bitr prelxp @ aneq2i Sumr);
pub theorem R_rmT (r rm: nat): $ R_rm r rm e. DestSrc <-> r e. Regs /\ rm e. RM $ =
'(bitr Sumr prelxp);

@_ def ImmRM: set = $ Sum RM u64 $;
@_ def immRM_rm (rm: nat): nat = $ b0 rm $;
@_ def immRM_imm (i: nat): nat = $ b1 i $;
pub theorem immRM_rmT (rm: nat): $ immRM_rm rm e. ImmRM <-> rm e. RM $ = 'Suml;
pub theorem immRM_immT (i: nat): $ immRM_imm i e. ImmRM <-> i e. u64 $ = 'Sumr;

@_ def Unop: nat = $ upto 4 $;
@(add-eval) def unopInc: nat = $ 0 $;
@(add-eval) def unopDec: nat = $ 1 $;
@(add-eval) def unopNot: nat = $ 2 $;
@(add-eval) def unopNeg: nat = $ 3 $;
theorem unopIncT: $ unopInc e. Unop $ = '(mpbir elupto d0lt4);
theorem unopDecT: $ unopDec e. Unop $ = '(mpbir elupto d1lt4);
theorem unopNotT: $ unopNot e. Unop $ = '(mpbir elupto d2lt4);
theorem unopNegT: $ unopNeg e. Unop $ = '(mpbir elupto d3lt4);

@_ def Binop: nat = $ Bits 4 $;
@(add-eval) def binopAdd: nat = $ 0 $;
@(add-eval) def binopOr:  nat = $ 1 $;
@(add-eval) def binopAdc: nat = $ 2 $;
@(add-eval) def binopSbb: nat = $ 3 $;
@(add-eval) def binopAnd: nat = $ 4 $;
@(add-eval) def binopSub: nat = $ 5 $;
@(add-eval) def binopXor: nat = $ 6 $;
@(add-eval) def binopCmp: nat = $ 7 $;
@(add-eval) def binopRol: nat = $ 8 $;
@(add-eval) def binopRor: nat = $ 9 $;
@(add-eval) def binopRcl: nat = $ 10 $;
@(add-eval) def binopRcr: nat = $ 11 $;
@(add-eval) def binopShl: nat = $ 12 $;
@(add-eval) def binopShr: nat = $ 13 $;
@(add-eval) def binopTst: nat = $ 14 $;
@(add-eval) def binopSar: nat = $ 15 $;
theorem Binop_lem (h: $ a < 16 $): $ a e. Binop $ = '(Regs_lem h);
theorem Binop_low: $ a e. Bits 3 -> a e. Binop $ = '(ssel @ Bitsss ,norm_num);
theorem binopAddT: $ binopAdd e. Binop $ = 'elBits01;
theorem binopOrT: $ binopOr e. Binop $ = '(! Binop_lem $1$ ,norm_num);
theorem binopAdcT: $ binopAdc e. Binop $ = '(! Binop_lem $2$ ,norm_num);
theorem binopSbbT: $ binopSbb e. Binop $ = '(! Binop_lem $3$ ,norm_num);
theorem binopAndT: $ binopAnd e. Binop $ = '(! Binop_lem $4$ ,norm_num);
theorem binopSubT: $ binopSub e. Binop $ = '(! Binop_lem $5$ ,norm_num);
theorem binopXorT: $ binopXor e. Binop $ = '(! Binop_lem $6$ ,norm_num);
theorem binopCmpT: $ binopCmp e. Binop $ = '(! Binop_lem $7$ ,norm_num);
theorem binopRolT: $ binopRol e. Binop $ = '(! Binop_lem $8$ ,norm_num);
theorem binopRorT: $ binopRor e. Binop $ = '(! Binop_lem $9$ ,norm_num);
theorem binopRclT: $ binopRcl e. Binop $ = '(! Binop_lem $10$ ,norm_num);
theorem binopRcrT: $ binopRcr e. Binop $ = '(! Binop_lem $11$ ,norm_num);
theorem binopShlT: $ binopShl e. Binop $ = '(! Binop_lem $12$ ,norm_num);
theorem binopShrT: $ binopShr e. Binop $ = '(! Binop_lem $13$ ,norm_num);
theorem binopTstT: $ binopTst e. Binop $ = '(! Binop_lem $14$ ,norm_num);
theorem binopSarT: $ binopSar e. Binop $ = '(! Binop_lem $15$ ,norm_num);

@_ def BCond: nat = $ Bits 3 $;
@(add-eval) def bcondO:  nat = $ 0 $;
@(add-eval) def bcondB:  nat = $ 1 $;
@(add-eval) def bcondE:  nat = $ 2 $;
@(add-eval) def bcondNA: nat = $ 3 $;
@(add-eval) def bcondS:  nat = $ 4 $;
@(add-eval) def bcondL:  nat = $ 6 $;
@(add-eval) def bcondNG: nat = $ 7 $;

@_ def Cond: set = $ Option (Bits 4) $;
@(add-eval) def condAlways: nat = $ 0 $;
@_ def condPos (c: nat): nat = $ suc (b0 c) $;
@_ def condNeg (c: nat): nat = $ suc (b1 c) $;
pub theorem condAlwaysT: $ condAlways e. Cond $ = 'opt0;
pub theorem condPosT (c: nat): $ c e. BCond <-> condPos c e. Cond $ = '(bitr4 b0Bits optS);
pub theorem condNegT (c: nat): $ c e. BCond <-> condNeg c e. Cond $ = '(bitr4 b1Bits optS);

@_ def XASTArith: set =
$ Sum (Sum (Xp Unop (Xp WSize RM)) (Xp Binop (Xp WSize DestSrc)))
    (Sum (Xp Bool (Xp WSize RM)) (Xp WSize (Option DestSrc))) $;
@_ def xastUnop (unop sz rm: nat): nat = $ b0 (b0 (b0 (b0 (unop, sz, rm)))) $;
@_ def xastBinop (binop sz ds: nat): nat = $ b0 (b0 (b0 (b1 (binop, sz, ds)))) $;
@_ def xastMul (sz rm: nat): nat = $ b0 (b0 (b1 (b0 (0, sz, rm)))) $;
@_ def xastDiv (sz rm: nat): nat = $ b0 (b0 (b1 (b0 (1, sz, rm)))) $;
@_ def xastCDX (sz: nat): nat = $ b0 (b0 (b1 (b1 (sz, 0)))) $;
@_ def xastLea (sz ds: nat): nat = $ b0 (b0 (b1 (b1 (sz, suc ds)))) $;

@_ def XASTData: set =
$ Sum (Xp WSize (Sum (Xp Bool (Xp DestSrc WSize)) (Xp (upto 3) (Xp RM Regs))))
      (Xp Cond (Sum (Xp WSize DestSrc) (Xp Bool RM))) $;
@_ def xastMovX (b sz ds sz2: nat): nat = $ b0 (b1 (b0 (sz, b0 (b, ds, sz2)))) $;
@_ def xastXchg (sz rm rn: nat): nat = $ b0 (b1 (b0 (sz, b1 (0, rm, rn)))) $;
@_ def xastCmpXchg (sz rm rn: nat): nat = $ b0 (b1 (b0 (sz, b1 (1, rm, rn)))) $;
@_ def xastXadd (sz rm rn: nat): nat = $ b0 (b1 (b0 (sz, b1 (2, rm, rn)))) $;
@_ def xastCMov (c sz ds: nat): nat = $ b0 (b1 (b1 (c, b0 (sz, ds)))) $;
@_ def xastSetCC (c b ds: nat): nat = $ b0 (b1 (b1 (c, b1 (b, ds)))) $;

@_ def xastMov (sz ds: nat): nat = $ xastCMov condAlways sz ds $;
@_ def xastMovZX (sz ds sz2: nat): nat = $ xastMovX 0 sz ds sz2 $;
@_ def xastMovSX (sz ds sz2: nat): nat = $ xastMovX 1 sz ds sz2 $;

@_ def XASTFlow: set =
$ Sum (Sum (Sum RM (Xp Cond u64)) (Sum ImmRM u64)) (Option (Sum ImmRM RM)) $;
@_ def xastJump (rm: nat): nat = $ b1 (b0 (b0 (b0 (b0 rm)))) $;
@_ def xastJCC (c q: nat): nat = $ b1 (b0 (b0 (b0 (b1 (c, q))))) $;
@_ def xastCall (irm: nat): nat = $ b1 (b0 (b0 (b1 (b0 irm)))) $;
@_ def xastRet (q: nat): nat = $ b1 (b0 (b0 (b1 (b1 q)))) $;
@_ def xastLeave: nat = $ b1 (b0 (b1 0)) $;
@_ def xastPush (irm: nat): nat = $ b1 (b0 (b1 (suc (b0 irm)))) $;
@_ def xastPop (rm: nat): nat = $ b1 (b0 (b1 (suc (b1 rm)))) $;

@_ def XASTMisc: set = $ upto 5 $;
@_ def xastCMC: nat = $ b1 (b1 0) $;
@_ def xastCLC: nat = $ b1 (b1 1) $;
@_ def xastSTC: nat = $ b1 (b1 2) $;
@_ def xastUD2: nat = $ b1 (b1 3) $;
@_ def xastSysCall: nat = $ b1 (b1 4) $;

@_ def XAST: set = $ Sum (Sum XASTArith XASTData) (Sum XASTFlow XASTMisc) $;

-- some typechecking sanity checks
pub theorem xastUnopT (unop sz rm: nat):
  $ xastUnop unop sz rm e. XAST <-> unop e. Unop /\ sz e. WSize /\ rm e. RM $ =
'(bitr Suml @ bitr Suml @ bitr Suml @ bitr Suml @ bitr4 prelxp @ bitr4 anass @ aneq2i prelxp);
pub theorem xastBinopT (bop sz ds: nat):
  $ xastBinop bop sz ds e. XAST <-> bop e. Binop /\ sz e. WSize /\ ds e. DestSrc $ =
'(bitr Suml @ bitr Suml @ bitr Suml @ bitr Sumr @ bitr4 prelxp @ bitr4 anass @ aneq2i prelxp);
pub theorem xastMulT (sz rm: nat):
  $ xastMul sz rm e. XAST <-> sz e. WSize /\ rm e. RM $ =
'(bitr Suml @ bitr Suml @ bitr Sumr @ bitr Suml @ bitr prelxp @ bitr (bian1 Bool0) prelxp);
pub theorem xastDivT (sz rm: nat):
  $ xastDiv sz rm e. XAST <-> sz e. WSize /\ rm e. RM $ =
'(bitr Suml @ bitr Suml @ bitr Sumr @ bitr Suml @ bitr prelxp @ bitr (bian1 Bool1) prelxp);
pub theorem xastCDX_T (sz: nat): $ xastCDX sz e. XAST <-> sz e. WSize $ =
'(bitr Suml @ bitr Suml @ bitr Sumr @ bitr Sumr @ bitr prelxp @ bian2 opt0);
pub theorem xastLeaT (sz ds: nat):
  $ xastLea sz ds e. XAST <-> sz e. WSize /\ ds e. DestSrc $ =
'(bitr Suml @ bitr Suml @ bitr Sumr @ bitr Sumr @ bitr prelxp @ aneq2i optS);

pub theorem xastMovX_T (b sz ds sz2: nat):
  $ xastMovX b sz ds sz2 e. XAST <->
    bool b /\ sz e. WSize /\ ds e. DestSrc /\ sz2 e. WSize $ =
'(bitr Suml @ bitr Sumr @ bitr Suml @ bitr4 prelxp @
  bitr anass @ bitr anass @ bitr4 anlass @ aneq2i @ bitr Suml @
  bitr prelxp @ aneq elBool prelxp);
pub theorem xastXchgT (sz rm rn: nat):
  $ xastXchg sz rm rn e. XAST <-> sz e. WSize /\ rm e. RM /\ rn e. Regs $ =
'(bitr Suml @ bitr Sumr @ bitr Suml @ bitr4 prelxp @
  bitr4 anass @ aneq2i @ bitr Sumr @
  bitr prelxp @ bitr (bian1 @ mpbir elupto d0lt3) prelxp);
pub theorem xastCmpXchgT (sz rm rn: nat):
  $ xastCmpXchg sz rm rn e. XAST <-> sz e. WSize /\ rm e. RM /\ rn e. Regs $ =
'(bitr Suml @ bitr Sumr @ bitr Suml @ bitr4 prelxp @
  bitr4 anass @ aneq2i @ bitr Sumr @
  bitr prelxp @ bitr (bian1 @ mpbir elupto d1lt3) prelxp);
pub theorem xastXaddT (sz rm rn: nat):
  $ xastXadd sz rm rn e. XAST <-> sz e. WSize /\ rm e. RM /\ rn e. Regs $ =
'(bitr Suml @ bitr Sumr @ bitr Suml @ bitr4 prelxp @
  bitr4 anass @ aneq2i @ bitr Sumr @
  bitr prelxp @ bitr (bian1 @ mpbir elupto d2lt3) prelxp);
pub theorem xastCMovT (c sz ds: nat):
  $ xastCMov c sz ds e. XAST <-> c e. Cond /\ sz e. WSize /\ ds e. DestSrc $ =
'(bitr Suml @ bitr Sumr @ bitr Sumr @ bitr4 prelxp @
  bitr4 anass @ aneq2i @ bitr Suml prelxp);
pub theorem xastSetCC_T (c b rm: nat):
  $ xastSetCC c b rm e. XAST <-> c e. Cond /\ bool b /\ rm e. RM $ =
'(bitr Suml @ bitr Sumr @ bitr Sumr @ bitr4 prelxp @
  bitr4 anass @ aneq2i @ bitr Sumr @ bitr prelxp @ aneq1i elBool);
pub theorem xastMovZX_T (sz ds sz2: nat):
  $ xastMovZX sz ds sz2 e. XAST <-> sz e. WSize /\ ds e. DestSrc /\ sz2 e. WSize $ =
'(bitr Suml @ bitr Sumr @ bitr Suml @ bitr4 prelxp @
  bitr4 anass @ aneq2i @ bitr Suml @ bitr prelxp @ bitr (bian1 Bool0) prelxp);
pub theorem xastMovSX_T (sz ds sz2: nat):
  $ xastMovSX sz ds sz2 e. XAST <-> sz e. WSize /\ ds e. DestSrc /\ sz2 e. WSize $ =
'(bitr Suml @ bitr Sumr @ bitr Suml @ bitr4 prelxp @
  bitr4 anass @ aneq2i @ bitr Suml @ bitr prelxp @ bitr (bian1 Bool1) prelxp);
pub theorem xastMovT (sz ds: nat):
  $ xastMov sz ds e. XAST <-> sz e. WSize /\ ds e. DestSrc $ =
'(bitr Suml @ bitr Sumr @ bitr Sumr @ bitr prelxp @
  bitr (bian1 condAlwaysT) @ bitr Suml prelxp);

pub theorem xastJumpT (rm: nat): $ xastJump rm e. XAST <-> rm e. RM $ =
'(bitr Sumr @ bitr Suml @ bitr Suml @ bitr Suml Suml);
pub theorem xastJCC_T (c q: nat): $ xastJCC c q e. XAST <-> c e. Cond /\ q e. u64 $ =
'(bitr Sumr @ bitr Suml @ bitr Suml @ bitr Suml @ bitr Sumr prelxp);
pub theorem xastCallT (irm: nat): $ xastCall irm e. XAST <-> irm e. ImmRM $ =
'(bitr Sumr @ bitr Suml @ bitr Suml @ bitr Sumr Suml);
pub theorem xastRetT (q: nat): $ xastRet q e. XAST <-> q e. u64 $ =
'(bitr Sumr @ bitr Suml @ bitr Suml @ bitr Sumr Sumr);
pub theorem xastLeaveT: $ xastLeave e. XAST $ =
'(trud @ Sumrd @ Sumld @ Sumrd opt0d);
pub theorem xastPushT (irm: nat): $ xastPush irm e. XAST <-> irm e. ImmRM $ =
'(bitr Sumr @ bitr Suml @ bitr Sumr @ bitr optS Suml);
pub theorem xastPopT (rm: nat): $ xastPop rm e. XAST <-> rm e. RM $ =
'(bitr Sumr @ bitr Suml @ bitr Sumr @ bitr optS Sumr);

pub theorem xastCMC_T: $ xastCMC e. XAST $ =
'(trud @ Sumrd @ Sumrd @ a1i @ mpbir elupto ,norm_num);
pub theorem xastCLC_T: $ xastCLC e. XAST $ =
'(trud @ Sumrd @ Sumrd @ a1i @ mpbir elupto ,norm_num);
pub theorem xastSTC_T: $ xastSTC e. XAST $ =
'(trud @ Sumrd @ Sumrd @ a1i @ mpbir elupto ,norm_num);
pub theorem xastUD2T: $ xastUD2 e. XAST $ =
'(trud @ Sumrd @ Sumrd @ a1i @ mpbir elupto ,norm_num);
pub theorem xastSysCallT: $ xastSysCall e. XAST $ =
'(trud @ Sumrd @ Sumrd @ a1i @ mpbir elupto ,norm_num);

@_ def decodeTwoCMov (rex ast b l .c .reg .r: nat): wff =
$ E. c E. reg E. r (splitBits ((4, c) : (4, 4) : 0) b /\
    readModRM rex reg r l /\
    ast = xastCMov (suc c) (opSize T. (REX_W rex) 1) (R_rm reg r)) $;
pub theorem decodeTwoCMovT (rex ast b l: nat):
  $ decodeTwoCMov rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ eex @ iand (iand _ @ anwll @ splitBitsTi ,bvSizeSi) @
    rsyl anlr @ anrd readModRM_T)
  '(mpbird (eleq1d anr) @
    sylibr xastCMovT @ iand (iand _ @ a1i opSizeT) @
    rsyl anlr @ sylibr R_rmT @ anld readModRM_T)
  '(sylibr optS @ sylib elBitvec2 @ elListHd an3l));

theorem decodeTwoCMov_len_le: $ decodeTwoCMov rex ast b l -> len l <= 6 $ =
(named '(eex @ eex @ eex @ rsyl anlr readModRM_len_le));

@_ def decodeTwoJCC (_rex ast b l .c .imm: nat): wff =
$ E. c E. imm (splitBits ((4, c) : (4, 8) : 0) b /\
    readImmN 32 imm l /\
    ast = xastJCC (suc c) imm) $;
pub theorem decodeTwoJCC_T (rex ast b l: nat):
  $ decodeTwoJCC rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ iand (iand _ @ anwll @ splitBitsTi ,bvSizeSi) @
    anrd @ sylan readImmN_T (a1i d32le64) anlr)
  '(mpbird (eleq1d anr) @
    sylibr xastJCC_T @ iand _ @ rsyl anlr @ anld readImm32T)
  '(sylibr optS @ sylib elBitvec2 @ elListHd an3l));

theorem decodeTwoJCC_len_le: $ decodeTwoJCC rex ast b l -> len l <= 6 $ =
(named '(eex @ eex @ rsyl anlr @ mpbird (leeq1d readImm32_len) @ a1i ,norm_num));

@_ def decodeTwoSetCC (rex ast b l .c .reg .r: nat): wff =
$ E. c E. reg E. r (splitBits ((4, c) : (4, 9) : 0) b /\
    readModRM rex reg r l /\
    ast = xastSetCC (suc c) (nat (rex != 0)) r) $;
pub theorem decodeTwoSetCC_T (rex ast b l: nat):
  $ decodeTwoSetCC rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ eex @ iand (iand _ @ anwll @ splitBitsTi ,bvSizeSi) @
    rsyl anlr @ anrd readModRM_T)
  '(mpbird (eleq1d anr) @ sylibr xastSetCC_T @
    iand (iand _ @ a1i boolnat) @ rsyl anlr @ syl anlr readModRM_T)
  '(sylibr optS @ sylib elBitvec2 @ elListHd an3l));

theorem decodeTwoSetCC_len_le: $ decodeTwoSetCC rex ast b l -> len l <= 6 $ =
(named '(eex @ eex @ eex @ rsyl anlr readModRM_len_le));

@_ def decodeTwoCmpXchg (rex ast b l .v .reg .r: nat): wff =
$ E. v E. reg E. r (splitBits ((1, v) : (3, 0) : (4, 11) : 0) b /\
    readModRM rex reg r l /\
    ast = xastCmpXchg (opSizeW rex v) r reg) $;
pub theorem decodeTwoCmpXchgT (rex ast b l: nat):
  $ decodeTwoCmpXchg rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastCmpXchgT @
    rsyl anlr @ rsyl readModRM_T @ iand (iand (a1i opSizeW_T) anlr) anll)
  (anwll @ splitBitsTi ,bvSizeSi))
  (rsyl anlr @ anrd readModRM_T)));

theorem decodeTwoCmpXchg_len_le: $ decodeTwoCmpXchg rex ast b l -> len l <= 6 $ =
(named '(eex @ eex @ eex @ rsyl anlr readModRM_len_le));

@_ def decodeTwoMovX (rex ast b l .v .s .reg .r: nat): wff =
$ E. v E. s E. reg E. r (
    splitBits ((1, v) : (2, 3) : (1, s) : (4, 11) : 0) b /\
    readModRM rex reg r l /\
    ast = xastMovX s (if (bool v) wSz16 (wSz8 (rex != 0)))
      (R_rm reg r) (opSizeW rex 1)) $;
pub theorem decodeTwoMovX_T (rex ast b l: nat):
  $ decodeTwoMovX rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ eex @ eex @ iand (iand _ @ anwll @ splitBitsTi ,bvSizeSi) @
    rsyl anlr @ anrd readModRM_T)
  '(mpbird (eleq1d anr) @ sylibr xastMovX_T @
    iand (iand (iand _ @ a1i @ ifT @ ian wSz16T wSz8T) _) @ a1i opSizeW_T)
  '(sylib elBits1 @ sylib elBitvec2 @ elListHd @ elListTl @ elListTl an3l)
  '(rsyl anlr @ sylibr R_rmT @ anld readModRM_T));

theorem decodeTwoMovX_len_le: $ decodeTwoMovX rex ast b l -> len l <= 6 $ =
(named '(eex @ eex @ eex @ eex @ rsyl anlr readModRM_len_le));

@_ def decodeTwoXadd (rex ast b l .v .reg .r: nat): wff =
$ E. v E. reg E. r (
    splitBits ((1, v) : (3, 0) : (4, 12) : 0) b /\
    readModRM rex reg r l /\
    ast = xastXadd (opSizeW rex v) r reg) $;
pub theorem decodeTwoXaddT (rex ast b l: nat):
  $ decodeTwoXadd rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastXaddT @
    rsyl anlr @ rsyl readModRM_T @ iand (rsyl anlr @ ian opSizeW_T) anll)
  (anwll @ splitBitsTi ,bvSizeSi))
  (rsyl anlr @ anrd readModRM_T)));

theorem decodeTwoXadd_len_le: $ decodeTwoXadd rex ast b l -> len l <= 6 $ =
(named '(eex @ eex @ eex @ rsyl anlr readModRM_len_le));

theorem decodeCMC_T_lem (c: char) (h: $ a e. XAST $):
  $ b = c /\ l = 0 /\ ast = a -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
'(iand (iand (anwr @ mpbiri h eleq1) @ mpbiri c2nT @ eleq1d anll) @ mpbiri elList0 @ eleq1d anlr);

@_ def decodeTwoUD2 (_rex ast b l: nat): wff =
$ b = ch x0 xb /\ l = 0 /\ ast = xastUD2 $;
pub theorem decodeTwoUD2T (rex ast b l: nat):
  $ decodeTwoUD2 rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
'(decodeCMC_T_lem xastUD2T);

theorem decodeTwoUD2_len_le: $ decodeTwoUD2 rex ast b l -> len l <= 6 $ =
'(mpbiri le01 @ leeq1d @ syl6eq len0 @ leneqd anlr);

@_ def decodeTwoSysCall (_rex ast b l: nat): wff =
$ b = ch x0 x5 /\ l = 0 /\ ast = xastSysCall $;
pub theorem decodeTwoSysCallT (rex ast b l: nat):
  $ decodeTwoSysCall rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
'(decodeCMC_T_lem xastSysCallT);

theorem decodeTwoSysCall_len_le: $ decodeTwoSysCall rex ast b l -> len l <= 6 $ =
'(mpbiri le01 @ leeq1d @ syl6eq len0 @ leneqd anlr);

@_ def decodeTwoAux (rex ast b l: nat): wff =
$ decodeTwoCMov rex ast b l \/ decodeTwoJCC rex ast b l \/
  decodeTwoSetCC rex ast b l \/ decodeTwoCmpXchg rex ast b l \/
  decodeTwoMovX rex ast b l \/ decodeTwoXadd rex ast b l \/
  decodeTwoUD2 rex ast b l \/ decodeTwoSysCall rex ast b l $;
pub theorem decodeTwoAuxT (rex ast b l: nat):
  $ decodeTwoAux rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(focus
  (def (f x) (atom-app 'decodeTwo x 'T))
  (foldl '(JCC_ SetCC_ CmpXchg MovX_ Xadd UD2 SysCall) (f 'CMov)
    @ fn (x y) '(eor ,x ,(f y))));

theorem decodeTwoAux_len_le: $ decodeTwoAux rex ast b l -> len l <= 6 $ =
(focus
  (def (f x) (atom-app 'decodeTwo x '_len_le))
  (foldl '(JCC SetCC CmpXchg MovX Xadd UD2 SysCall) (f 'CMov)
    @ fn (x y) '(eor ,x ,(f y))));

@_ def decodeTwo (rex ast b l .b2 .l2: nat): wff =
$ b = ch x0 xf /\ E. b2 E. l2 (l = b2 : l2 /\ decodeTwoAux rex ast b2 l2) $;
pub theorem decodeTwoT (rex ast b l: nat):
  $ decodeTwo rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(imp @ eexd @ eexda @ mpand (rsyl anrr decodeTwoAuxT) @
  iand (iand (anwr anll) @ mpbiri c2nT @ eleq1d anll) @
  mpbird (eleq1d @ anld anlr) @ anwr @ sylibr elListS @ anim1 anr));

theorem decodeTwo_len_le: $ decodeTwo rex ast b l -> len l <= 10 $ =
(named '(anwr @ eex @ eex @
  mpbird (leeq1d @ syl6eq lenS @ leneqd anl) @
  sylib lesuc @ anwr @ letrd decodeTwoAux_len_le @ a1i ,norm_num));

@_ def decodeBinopReg (rex ast b l .v .d .opc .reg .r: nat): wff =
$ E. v E. d E. opc E. reg E. r (
    splitBits ((1, v) : (1, d) : (1, 0) : (3, opc) : (2, 0) : 0) b /\
    readModRM rex reg r l /\
    ast = xastBinop opc (opSizeW rex v)
      (if (true d) (R_rm reg r) (Rm_r r reg))) $;
pub theorem decodeBinopRegT (rex ast b l: nat):
  $ decodeBinopReg rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ eex @ eex @ eex @ iand (iand
    (mpbird (eleq1d anr) @ sylibr xastBinopT @
      iand (iand _ @ a1i opSizeW_T) @ rsyl anlr @ rsyl readModRM_T @
      sylan ifT (sylibr R_rmT anl) (sylibr Rm_rT @ anwl ancom))
    (anwll @ splitBitsTi ,bvSizeSi))
    (rsyl anlr @ anrd readModRM_T))
  '(syl Binop_low @ sylib elBitvec2 @
    elListHd @ elListTl @ elListTl @ elListTl an3l));

theorem decodeBinopReg_len_le: $ decodeBinopReg rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ eex @ eex @ rsyl anlr @ letrd readModRM_len_le @ a1i ,norm_num));

@_ def decodeBinopRAX (rex ast b l .v .opc .imm: nat): wff =
$ E. v E. opc E. imm (
    splitBits ((1, v) : (2, 2) : (3, opc) : (2, 0) : 0) b /\
    readImm (opSizeW rex v) imm l /\
    ast = xastBinop opc (opSizeW rex v) (Rm_i (RM_reg RAX) imm)) $;
pub theorem decodeBinopRAX_T (rex ast b l: nat):
  $ decodeBinopRAX rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ eex @ iand (iand _ @ anwll @ splitBitsTi ,bvSizeSi) @
    anrd @ sylan readImmT (a1i opSizeW_T) anlr)
  '(mpbird (eleq1d anr) @ sylibr xastBinopT @
    iand (iand _ @ a1i opSizeW_T) @
    sylibr Rm_iT @ syl (ian @ mpbir RM_regT RAX_T) @
    anld @ rsyl anlr @ exp readImmT opSizeW_T)
  '(syl Binop_low @ sylib elBitvec2 @ elListHd @ elListTl @ elListTl an3l));

theorem decodeBinopRAX_len_le: $ decodeBinopRAX rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ rsyl anlr @ letrd readImm_len_le @ a1i ,norm_num));

@_ def decodeBinopImm (rex ast b l .v .opc .r .l1 .imm .l2: nat): wff =
$ E. v E. opc E. r E. l1 E. imm E. l2 (l = l1 ++ l2 /\
    splitBits ((1, v) : (3, 0) : (4, 8) : 0) b /\
    readOpcodeModRM rex opc r l1 /\
    readImm (opSizeW rex v) imm l2 /\
    ast = xastBinop opc (opSizeW rex v) (Rm_i r imm)) $;
pub theorem decodeBinopImmT (rex ast b l: nat):
  $ decodeBinopImm rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastBinopT @
    rsyl (iand (rsyl anllr readOpcodeModRM_T) (rsyl anlr @ exp readImmT opSizeW_T)) @
    iand (iand (rsyl an3l Binop_low) @ a1i opSizeW_T) @
    sylibr Rm_iT @ iand anllr anrl)
  (rsyl an3lr @ splitBitsTi ,bvSizeSi))
  (mpbird (eleq1d an4l) @ sylibr appendT @ iand
    (rsyl anllr @ anrd readOpcodeModRM_T)
    (anrd @ sylan readImmT (a1i opSizeW_T) anlr))));

theorem decodeBinopImm_len_le: $ decodeBinopImm rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ eex @ eex @ eex @
  mpbird (leeq1d @ syl6eq appendlen @ leneqd an4l) @
  letrd (leaddd (rsyl anllr readOpcodeModRM_len_le) @ rsyl anlr readImm_len_le) @
  a1i ,norm_num));

@_ def decodeBinopImm8 (rex ast b l .opc .r .l1 .imm .l2: nat): wff =
$ E. opc E. r E. imm E. l1 E. l2 (l = l1 ++ l2 /\ b = ch x8 x3 /\
    readOpcodeModRM rex opc r l1 /\
    readImmN 8 imm l2 /\
    ast = xastBinop opc (opSizeW rex 1) (Rm_i r imm)) $;
pub theorem decodeBinopImm8T (rex ast b l: nat):
  $ decodeBinopImm8 rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastBinopT @
    rsyl (iand (rsyl anllr readOpcodeModRM_T) (rsyl anlr readImm8T)) @
    iand (iand (rsyl an3l Binop_low) @ a1i opSizeW_T) @
    sylibr Rm_iT @ iand anllr anrl)
  (mpbiri c2nT @ eleq1d an3lr))
  (mpbird (eleq1d an4l) @ sylibr appendT @ iand
    (rsyl anllr @ anrd readOpcodeModRM_T)
    (anrd @ sylan readImmN_T (a1i d8le64) anlr))));

theorem decodeBinopImm8_len_le: $ decodeBinopImm8 rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ eex @ eex @
  mpbird (leeq1d @ syl6eq appendlen @ leneqd an4l) @
  letrd (leaddd (rsyl anllr readOpcodeModRM_len_le) @ rsyl anlr @ syl eqle readImm8_len) @
  a1i ,norm_num));

@_ def decodeBinopHi (rex ast b l .v .opc .r .imm .l1 .l2: nat): wff =
$ E. v E. opc E. r E. imm E. l1 E. l2 (l = l1 ++ l2 /\
    splitBits ((1, v) : (3, 0) : (4, 12) : 0) b /\
    readOpcodeModRM rex opc r l1 /\ opc != 6 /\
    readImmN 8 imm l2 /\
    ast = xastBinop (rex_reg 1 opc) (opSizeW rex v) (Rm_i r imm)) $;
pub theorem decodeBinopHiT (rex ast b l: nat):
  $ decodeBinopHi rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastBinopT @
    rsyl (iand (rsyl an3lr readOpcodeModRM_T) (rsyl anlr readImm8T)) @
    iand (iand (rsyl an3l @ exp rex_regT bool1) @ a1i opSizeW_T) @
    sylibr Rm_iT @ iand anllr anrl)
  (rsyl an4lr @ splitBitsTi ,bvSizeSi))
  (mpbird (eleq1d an5l) @ sylibr appendT @ iand
    (rsyl an3lr @ anrd readOpcodeModRM_T)
    (anrd @ sylan readImmN_T (a1i d8le64) anlr))));

theorem decodeBinopHi_len_le: $ decodeBinopHi rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ eex @ eex @ eex @
  mpbird (leeq1d @ syl6eq appendlen @ leneqd an5l) @
  letrd (leaddd (rsyl an3lr readOpcodeModRM_len_le) @ rsyl anlr @ syl eqle readImm8_len) @
  a1i ,norm_num));

@_ def decodeBinopHiReg (rex ast b l .v .x .opc .r: nat): wff =
$ E. v E. x E. opc E. r (
    splitBits ((1, v) : (1, x) : (2, 0) : (4, 13) : 0) b /\
    readOpcodeModRM rex opc r l /\ opc != 6 /\
    ast = xastBinop (rex_reg 1 opc) (opSizeW rex v)
      (if (true x) (Rm_r r RCX) (Rm_i r 1))) $;
pub theorem decodeBinopHiRegT (rex ast b l: nat):
  $ decodeBinopHiReg rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @
    rsyl anllr @ rsyl readOpcodeModRM_T @ sylibr xastBinopT @
    iand (iand (anwll @ exp rex_regT bool1) @ a1i opSizeW_T) @
    rsyl anlr @ sylan ifT
      (sylibr Rm_rT @ mpi RCX_T ian)
      (sylibr Rm_iT @ mpi (mpbir elBits11 d64ne0) ian))
  (anw3l @ splitBitsTi ,bvSizeSi))
  (rsyl anllr @ anrd readOpcodeModRM_T)));

theorem decodeBinopHiReg_len_le: $ decodeBinopHiReg rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ eex @ rsyl anllr @ letrd readOpcodeModRM_len_le @ a1i ,norm_num));

@_ def decodeBinop (rex ast b l: nat): wff =
$ decodeBinopReg rex ast b l \/ decodeBinopRAX rex ast b l \/
  decodeBinopImm rex ast b l \/ decodeBinopImm8 rex ast b l \/
  decodeBinopHi rex ast b l \/ decodeBinopHiReg rex ast b l $;
pub theorem decodeBinopT (rex ast b l: nat):
  $ decodeBinop rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(focus
  (def (f x) (atom-app 'decodeBinop x 'T))
  (foldl '(RAX_ Imm Imm8 Hi HiReg) (f 'Reg)
    @ fn (x y) '(eor ,x ,(f y))));

theorem decodeBinop_len_le: $ decodeBinop rex ast b l -> len l <= 10 $ =
(focus
  (def (f x) (atom-app 'decodeBinop x '_len_le))
  (foldl '(RAX Imm Imm8 Hi HiReg) (f 'Reg)
    @ fn (x y) '(eor ,x ,(f y))));

@_ def decodeMovSX (rex ast b l .reg .r: nat): wff =
$ E. reg E. r (b = ch x6 x3 /\
    readModRM rex reg r l /\ ast = xastMovSX wSz32 (R_rm reg r) (opSizeW rex 1)) $;
pub theorem decodeMovSX_T (rex ast b l: nat):
  $ decodeMovSX rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastMovSX_T @
    iand (iand (a1i wSz32T) @ sylibr R_rmT @ rsyl anlr @ anld readModRM_T) (a1i opSizeW_T))
  (mpbiri c2nT @ eleq1d anll))
  (anrd @ rsyl anlr readModRM_T)));

theorem decodeMovSX_len_le: $ decodeMovSX rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ rsyl anlr @ letrd readModRM_len_le @ a1i ,norm_num));

@_ def decodeMovReg (rex ast b l .v .d .reg .r: nat): wff =
$ E. v E. d E. reg E. r (
    splitBits ((1, v) : (1, d) : (2, 2) : (4, 8) : 0) b /\
    readModRM rex reg r l /\
    ast = xastMov (opSizeW rex v) (if (true d) (R_rm reg r) (Rm_r r reg))) $;
pub theorem decodeMovRegT (rex ast b l: nat):
  $ decodeMovReg rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @
    sylibr xastMovT @ syl (ian opSizeW_T) @ rsyl anlr @ rsyl readModRM_T @
    sylan ifT (sylibr R_rmT anl) (sylibr Rm_rT @ anwl ancom))
  (anwll @ splitBitsTi ,bvSizeSi))
  (anrd @ rsyl anlr readModRM_T)));

theorem decodeMovReg_len_le: $ decodeMovReg rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ eex @ rsyl anlr @ letrd readModRM_len_le @ a1i ,norm_num));

@_ def decodeMov64 (rex ast b l .r .v .imm: nat): wff =
$ E. r E. v E. imm (
    splitBits ((3, r) : (1, v) : (4, 11) : 0) b /\
    readFullImm (opSizeW rex v) imm l /\
    ast = xastMov (opSizeW rex v) (Rm_i (RM_reg (rex_reg (REX_B rex) r)) imm)) $;
pub theorem decodeMov64T (rex ast b l: nat):
  $ decodeMov64 rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @
    sylibr xastMovT @ syl (ian opSizeW_T) @ sylibr Rm_iT @
    iand (sylibr RM_regT @ sylan rex_regT (a1i REX_B_T) @
      sylib elBitvec2 @ elListHd @ anld anll) @
    anld @ rsyl anlr @ exp readFullImmT opSizeW_T)
  (anwll @ splitBitsTi ,bvSizeSi))
  (anrd @ sylan readFullImmT (a1i opSizeW_T) anlr)));

theorem decodeMov64_len_le: $ decodeMov64 rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ letrd (sylan readFullImm_len_le (a1i opSizeW_T) anlr) @
  a1i ,norm_num));

@_ def decodeMovImm (rex ast b l .v .opc .r .imm .l1 .l2: nat): wff =
$ E. v E. r E. imm E. l1 E. l2 (l = l1 ++ l2 /\
    splitBits ((1, v) : (3, 3) : (4, 12) : 0) b /\
    readOpcodeModRM rex 0 r l1 /\
    readImm (opSizeW rex v) imm l2 /\
    ast = xastMov (opSizeW rex v) (Rm_i r imm)) $;
pub theorem decodeMovImmT (rex ast b l: nat):
  $ decodeMovImm rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastMovT @ syl (ian opSizeW_T) @
    sylibr Rm_iT @ iand (rsyl anllr @ syl anlr readOpcodeModRM_T) @
    anld @ rsyl anlr @ exp readImmT opSizeW_T)
  (rsyl an3lr @ splitBitsTi ,bvSizeSi))
  (mpbird (eleq1d an4l) @ sylibr appendT @ iand
    (anrd @ rsyl anllr readOpcodeModRM_T)
    (anrd @ sylan readImmT (a1i opSizeW_T) anlr))));

theorem decodeMovImm_len_le: $ decodeMovImm rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ eex @ eex @
  mpbird (leeq1d @ syl6eq appendlen @ leneqd an4l) @
  letrd (leaddd (rsyl anllr readOpcodeModRM_len_le) @ rsyl anlr readImm_len_le) @
  a1i ,norm_num));

@_ def decodeMov (rex ast b l: nat): wff =
$ decodeMovSX rex ast b l \/ decodeMovReg rex ast b l \/
  decodeMov64 rex ast b l \/ decodeMovImm rex ast b l $;
pub theorem decodeMovT (rex ast b l: nat):
  $ decodeMov rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(focus
  (def (f x) (atom-app 'decodeMov x 'T))
  (foldl '(Reg 64 Imm) (f 'SX_)
    @ fn (x y) '(eor ,x ,(f y))));

theorem decodeMov_len_le: $ decodeMov rex ast b l -> len l <= 10 $ =
(focus
  (def (f x) (atom-app 'decodeMov x '_len_le))
  (foldl '(Reg 64 Imm) (f 'SX)
    @ fn (x y) '(eor ,x ,(f y))));

@_ def decodePushImm (_rex ast b l .x .imm .r: nat): wff =
$ E. x E. imm (
    splitBits ((1, 0) : (1, x) : (2, 2) : (4, 6) : 0) b /\
    readImmN (if (true x) 8 32) imm l /\
    ast = xastPush (immRM_imm imm)) $;
pub theorem decodePushImmT (rex ast b l: nat):
  $ decodePushImm rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastPushT @
    sylibr immRM_immT @ rsyl anlr @ anld readImm8_32T)
  (anwll @ splitBitsTi ,bvSizeSi))
  (anrd @ sylan readImmN_T (ifbothd leeq1 leeq1 (a1i d8le64) (a1i d32le64)) anlr)));

theorem decodePushImm_len_le: $ decodePushImm rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ letrd (rsyl anlr readImm8_32_len_le) @ a1i ,norm_num));

@_ def decodePushReg (rex ast b l .x .imm .r: nat): wff =
$ l = 0 /\ E. r (
    splitBits ((3, r) : (1, 0) : (4, 5) : 0) b /\
    ast = xastPush (immRM_rm (RM_reg (rex_reg (REX_B rex) r)))) $;
pub theorem decodePushRegT (rex ast b l: nat):
  $ decodePushReg rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(imp @ eexda @ iand (iand
  (anwr @ mpbird (eleq1d anr) @ sylibr xastPushT @
    sylibr immRM_rmT @ sylibr RM_regT @ sylan rex_regT (a1i REX_B_T) @
    sylib elBitvec2 @ elListHd anll)
  (rsyl anrl @ splitBitsTi ,bvSizeSi))
  (mpbiri elList0 @ eleq1d anl)));

theorem decodePushReg_len_le: $ decodePushReg rex ast b l -> len l <= 10 $ =
(named '(anwl @ mpbiri le01 @ leeq1d @ syl6eq len0 leneq));

@_ def decodePopReg (rex ast b l .r: nat): wff =
$ l = 0 /\ E. r (
    splitBits ((3, r) : (1, 1) : (4, 5) : 0) b /\
    ast = xastPop (RM_reg (rex_reg (REX_B rex) r))) $;
pub theorem decodePopRegT (rex ast b l: nat):
  $ decodePopReg rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(imp @ eexda @ iand (iand
  (anwr @ mpbird (eleq1d anr) @
    sylibr xastPopT @ sylibr RM_regT @ syl (exp rex_regT REX_B_T) @
    sylib elBitvec2 @ elListHd anll)
  (rsyl anrl @ splitBitsTi ,bvSizeSi))
  (mpbiri elList0 @ eleq1d anl)));

theorem decodePopReg_len_le: $ decodePopReg rex ast b l -> len l <= 10 $ =
(named '(anwl @ mpbiri le01 @ leeq1d @ syl6eq len0 leneq));

@_ def decodePop0 (rex ast b l .r: nat): wff =
$ E. r (b = ch x8 xf /\ readOpcodeModRM rex 0 r l /\ ast = xastPop r) $;
pub theorem decodePop0T (rex ast b l: nat):
  $ decodePop0 rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastPopT @ rsyl anlr @ syl anlr readOpcodeModRM_T)
  (mpbiri c2nT @ eleq1d anll))
  (rsyl anlr @ anrd readOpcodeModRM_T)));

theorem decodePop0_len_le: $ decodePop0 rex ast b l -> len l <= 10 $ =
(named '(eex @ letrd (rsyl anlr readOpcodeModRM_len_le) @ a1i ,norm_num));

@_ def decodeStack (rex ast b l .r: nat): wff =
$ decodePushImm rex ast b l \/ decodePushReg rex ast b l \/
  decodePopReg rex ast b l \/ decodePop0 rex ast b l $;
pub theorem decodeStackT (rex ast b l: nat):
  $ decodeStack rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(focus
  (def (f x) (atom-app 'decode x 'T))
  (foldl '(PushReg PopReg Pop0) (f 'PushImm)
    @ fn (x y) '(eor ,x ,(f y))));

theorem decodeStack_len_le: $ decodeStack rex ast b l -> len l <= 10 $ =
(focus
  (def (f x) (atom-app 'decode x '_len_le))
  (foldl '(PushReg PopReg Pop0) (f 'PushImm)
    @ fn (x y) '(eor ,x ,(f y))));

@_ def decodeJump (_rex ast b l .x .imm: nat): wff =
$ E. x E. imm (
    splitBits ((1, 1) : (1, x) : (2, 2) : (4, 14) : 0) b /\
    readImmN (if (true x) 8 32) imm l /\
    ast = xastJCC condAlways imm) $;
pub theorem decodeJumpT (rex ast b l: nat):
  $ decodeJump rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ sylibr xastJCC_T @
    syl (ian condAlwaysT) @ rsyl anlr @ anld readImm8_32T)
  (anwll @ splitBitsTi ,bvSizeSi))
  (anrd @ sylan readImmN_T (ifbothd leeq1 leeq1 (a1i d8le64) (a1i d32le64)) anlr)));

theorem decodeJump_len_le: $ decodeJump rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ letrd (rsyl anlr readImm8_32_len_le) @ a1i ,norm_num));

@_ def decodeJCC8 (_rex ast b l .c .imm: nat): wff =
$ E. c E. imm (splitBits ((4, c) : (4, 7) : 0) b /\
    readImmN 8 imm l /\ ast = xastJCC (suc c) imm) $;
pub theorem decodeJCC8T (rex ast b l: nat):
  $ decodeJCC8 rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ iand (iand (mpbird (eleq1d anr) @ sylibr xastJCC_T @ iand _ _) _) _)
  '(sylibr optS @ sylib elBitvec2 @ elListHd an3l)
  '(rsyl anlr @ anld readImm8T)
  '(anwll @ splitBitsTi ,bvSizeSi)
  '(anrd @ sylan readImmN_T (a1i d8le64) anlr));

theorem decodeJCC8_len: $ decodeJCC8 rex ast b l -> len l = 1 $ =
(named '(eex @ eex @ rsyl anlr readImm8_len));
theorem decodeJCC8_len_le: $ decodeJCC8 rex ast b l -> len l <= 10 $ =
'(mpbird (leeq1d decodeJCC8_len) @ a1i ,norm_num);

@_ def decodeCall (_rex ast b l .imm: nat): wff =
$ E. imm (b = ch xe x8 /\
    readImmN 32 imm l /\ ast = xastCall (immRM_imm imm)) $;
pub theorem decodeCallT (rex ast b l: nat):
  $ decodeCall rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ iand (iand
  (mpbird (eleq1d anr) @ rsyl anlr @
    sylibr xastCallT @ sylibr immRM_immT @ anld readImm32T)
  (mpbiri c2nT @ eleq1d anll))
  (anrd @ sylan readImmN_T (a1i d32le64) anlr)));

theorem decodeCall_len: $ decodeCall rex ast b l -> len l = 4 $ =
(named '(eex @ rsyl anlr readImm32_len));
theorem decodeCall_len_le: $ decodeCall rex ast b l -> len l <= 10 $ =
'(mpbird (leeq1d decodeCall_len) @ a1i ,norm_num);

@_ def decodeRet (_rex ast b l .v .imm: nat): wff =
$ E. v E. imm (
    splitBits ((1, v) : (3, 1) : (4, 12) : 0) b /\
    ifp (true v) (imm = 0 /\ l = 0) (readImmN 16 imm l) /\
    ast = xastRet imm) $;
pub theorem decodeRetT (rex ast b l: nat):
  $ decodeRet rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ rsyl anlr @ sylibr xastRetT @
    eor (mpbiri elBits01 @ eleq1d anrl) (anwr @ anld readImm16T))
  (anwll @ splitBitsTi ,bvSizeSi))
  (rsyl anlr @ eor (mpbiri elList0 @ eleq1d anrr) @
    anrd @ sylan readImmN_T (a1i d16le64) anr)));

theorem decodeRet_len_le: $ decodeRet rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ rsyl anlr @ eor
  (rsyl anrr @ mpbiri le01 @ leeq1d @ syl6eq len0 leneq)
  (anwr @ mpbird (leeq1d readImm16_len) @ a1i ,norm_num)));

@_ def decodeLeave (_rex ast b l: nat): wff =
$ b = ch xc x9 /\ l = 0 /\ ast = xastLeave $;
pub theorem decodeLeaveT (rex ast b l: nat):
  $ decodeLeave rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
'(decodeCMC_T_lem xastLeaveT);
theorem decodeLeave_l0: $ decodeLeave rex ast b l -> l = 0 $ = 'anlr;

theorem decodeLeave_len_le: $ decodeLeave rex ast b l -> len l <= 10 $ =
'(mpbiri le01 @ leeq1d @ syl6eq len0 @ leneqd decodeLeave_l0);

@_ def decodeFlow (rex ast b l: nat): wff =
$ decodeJump rex ast b l \/ decodeJCC8 rex ast b l \/
  decodeCall rex ast b l \/ decodeRet rex ast b l \/ decodeLeave rex ast b l $;
pub theorem decodeFlowT (rex ast b l: nat):
  $ decodeFlow rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(focus
  (def (f x) (atom-app 'decode x 'T))
  (foldl '(JCC8 Call Ret Leave) (f 'Jump)
    @ fn (x y) '(eor ,x ,(f y))));

theorem decodeFlow_len_le: $ decodeFlow rex ast b l -> len l <= 10 $ =
(focus
  (def (f x) (atom-app 'decode x '_len_le))
  (foldl '(JCC8 Call Ret Leave) (f 'Jump)
    @ fn (x y) '(eor ,x ,(f y))));

@_ def decodeXchg (rex ast b l .v .reg .r: nat): wff =
$ E. v E. reg E. r (
    splitBits ((1, v) : (3, 3) : (4, 8) : 0) b /\
    readModRM rex reg r l /\
    ast = xastXchg (opSizeW rex v) r reg) $;
pub theorem decodeXchgT (rex ast b l: nat):
  $ decodeXchg rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @ rsyl anlr @
    rsyl readModRM_T @ sylibr xastXchgT @ iand (iand (a1i opSizeW_T) anlr) anll)
  (anwll @ splitBitsTi ,bvSizeSi))
  (rsyl anlr @ anrd readModRM_T)));

theorem decodeXchg_len_le: $ decodeXchg rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ letrd (rsyl anlr readModRM_len_le) @ a1i ,norm_num));

@_ def decodeXchgRAX (rex ast b l .v .reg .r: nat): wff =
$ l = 0 /\ E. r (
    splitBits ((3, r) : (1, 0) : (4, 9) : 0) b /\
    ast = xastXchg (opSizeW rex 1) (RM_reg RAX) (rex_reg (REX_B rex) r)) $;
pub theorem decodeXchgRAX_T (rex ast b l: nat):
  $ decodeXchgRAX rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(imp @ eexda @ iand (iand
  (anwr @ mpbird (eleq1d anr) @ sylibr xastXchgT @
    iand (a1i @ ian opSizeW_T @ mpbir RM_regT RAX_T) @
    sylan rex_regT (a1i REX_B_T) @ sylib elBitvec2 @
    elListHd anll)
  (rsyl anrl @ splitBitsTi ,bvSizeSi))
  (mpbiri elList0 @ eleq1d anl)));

theorem decodeXchgRAX_len_le: $ decodeXchgRAX rex ast b l -> len l <= 10 $ =
(named '(anwl @ mpbiri le01 @ leeq1d @ syl6eq len0 leneq));

@_ def decodeCDX (rex ast b l .reg .r: nat): wff =
$ E. reg E. r (b = ch x9 x9 /\ l = 0 /\ ast = xastCDX (opSize T. (REX_W rex) 1)) $;
pub theorem decodeCDX_T (rex ast b l: nat):
  $ decodeCDX rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ iand (iand
  (mpbiri (mpbir xastCDX_T opSizeT) (eleq1d anr))
  (mpbiri c2nT @ eleq1d anll))
  (mpbiri elList0 @ eleq1d anlr)));

theorem decodeCDX_len_le: $ decodeCDX rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ rsyl anlr @ mpbiri le01 @ leeq1d @ syl6eq len0 leneq));

@_ def decodeLea (rex ast b l .reg .r: nat): wff =
$ E. reg E. r (b = ch x8 xd /\
    readModRM rex reg r l /\ RM_isMem r /\
    ast = xastLea (opSize T. (REX_W rex) 1) (R_rm reg r)) $;
pub theorem decodeLeaT (rex ast b l: nat):
  $ decodeLea rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @
    sylibr xastLeaT @ iand (a1i opSizeT) @
    rsyl anllr @ sylibr R_rmT @ anld readModRM_T)
  (mpbiri c2nT @ eleq1d an3l))
  (rsyl anllr @ anrd readModRM_T)));

theorem decodeLea_len_le: $ decodeLea rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ letrd (rsyl anllr readModRM_len_le) @ a1i ,norm_num));

@_ def decodeTest (rex ast b l .v .reg .r: nat): wff =
$ E. v E. reg E. r (
    splitBits ((1, v) : (3, 2) : (4, 8) : 0) b /\
    readModRM rex reg r l /\
    ast = xastBinop binopTst (opSizeW rex v) (Rm_r r reg)) $;
pub theorem decodeTestT (rex ast b l: nat):
  $ decodeTest rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named '(eex @ eex @ eex @ iand (iand
  (mpbird (eleq1d anr) @
    sylibr xastBinopT @ iand (a1i @ ian binopTstT opSizeW_T) @
    rsyl anlr @ rsyl readModRM_T @ sylibr Rm_rT @ iand anlr anll)
  (anwll @ splitBitsTi ,bvSizeSi))
  (rsyl anlr @ anrd readModRM_T)));

theorem decodeTest_len_le: $ decodeTest rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ letrd (rsyl anlr readModRM_len_le) @ a1i ,norm_num));

@_ def decodeTestRAX (rex ast b l .v .imm .sz: nat): wff =
$ E. v E. imm E. sz (
    splitBits ((1, v) : (3, 4) : (4, 10) : 0) b /\
    sz = opSize T. (REX_W rex) v /\
    readImm sz imm l /\
    ast = xastBinop binopTst sz (Rm_i (RM_reg RAX) imm)) $;
pub theorem decodeTestRAX_T (rex ast b l: nat):
  $ decodeTestRAX rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  (have 'h '(mpbiri opSizeT @ eleq1d anllr))
  '(eex @ eex @ eex @ iand (iand
    (mpbird (eleq1d anr) @ sylibr xastBinopT @ mpand h @ iand (iand (a1i binopTstT) anr) _)
    (anw3l @ splitBitsTi ,bvSizeSi))
    (anrd @ sylan readImmT h anlr))
  '(sylibr Rm_iT @ iand (a1i @ mpbir RM_regT RAX_T) @
    anld @ sylan readImmT anr anllr));

theorem decodeTestRAX_len_le: $ decodeTestRAX rex ast b l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ letrd (rsyl anlr readImm_len_le) @ a1i ,norm_num));

@_ def decodeCMC (_rex ast b l: nat): wff = $ b = ch xf x5 /\ l = 0 /\ ast = xastCMC $;
pub theorem decodeCMC_T (rex ast b l: nat):
  $ decodeCMC rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ = '(decodeCMC_T_lem xastCMC_T);
theorem decodeCMC_l0: $ decodeCMC rex ast b l -> l = 0 $ = 'anlr;
@_ def decodeCLC (_rex ast b l: nat): wff = $ b = ch xf x8 /\ l = 0 /\ ast = xastCLC $;
pub theorem decodeCLC_T (rex ast b l: nat):
  $ decodeCLC rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ = '(decodeCMC_T_lem xastCLC_T);
theorem decodeCLC_l0: $ decodeCLC rex ast b l -> l = 0 $ = 'anlr;
@_ def decodeSTC (_rex ast b l: nat): wff = $ b = ch xf x9 /\ l = 0 /\ ast = xastSTC $;
pub theorem decodeSTC_T (rex ast b l: nat):
  $ decodeSTC rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ = '(decodeCMC_T_lem xastSTC_T);
theorem decodeSTC_l0: $ decodeSTC rex ast b l -> l = 0 $ = 'anlr;

@_ def decodeFlag (rex ast b l: nat): wff =
$ decodeCMC rex ast b l \/ decodeCLC rex ast b l \/ decodeSTC rex ast b l $;
pub theorem decodeFlagT (rex ast b l: nat):
  $ decodeFlag rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ = '(eor (eor decodeCMC_T decodeCLC_T) decodeSTC_T);
theorem decodeFlag_l0: $ decodeFlag rex ast b l -> l = 0 $ =
'(eor (eor decodeCMC_l0 decodeCLC_l0) decodeSTC_l0);

theorem decodeFlag_len_le: $ decodeFlag rex ast b l -> len l <= 10 $ =
'(mpbiri le01 @ leeq1d @ syl6eq len0 @ leneqd decodeFlag_l0);

@_ def decodeMisc (rex ast b l: nat): wff =
$ decodeXchg rex ast b l \/ decodeXchgRAX rex ast b l \/
  decodeTest rex ast b l \/ decodeTestRAX rex ast b l \/
  decodeCDX rex ast b l \/ decodeLea rex ast b l \/ decodeFlag rex ast b l $;
pub theorem decodeMiscT (rex ast b l: nat):
  $ decodeMisc rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(focus
  (def (f x) (atom-app 'decode x 'T))
  (foldl '(XchgRAX_ Test TestRAX_ CDX_ Lea Flag) (f 'Xchg)
    @ fn (x y) '(eor ,x ,(f y))));

theorem decodeMisc_len_le: $ decodeMisc rex ast b l -> len l <= 10 $ =
(focus
  (def (f x) (atom-app 'decode x '_len_le))
  (foldl '(XchgRAX Test TestRAX CDX Lea Flag) (f 'Xchg)
    @ fn (x y) '(eor ,x ,(f y))));

@_ def decodeHiAux (v sz r hi n ast l .imm: nat): wff =
$ ifp (true hi)
    (l = 0 /\ (
      n = 0 /\ ast = xastUnop unopInc sz r \/
      n = 1 /\ ast = xastUnop unopDec sz r \/
      true v /\ (
        n = 2 /\ ast = xastCall (immRM_rm r) \/
        n = 4 /\ ast = xastJump r \/
        n = 6 /\ ast = xastPush (immRM_rm r))))
    (n = 0 /\ E. imm (readImm sz imm l /\
        ast = xastBinop binopTst sz (Rm_i r imm)) \/
      l = 0 /\ (
        n = 2 /\ ast = xastUnop unopNot sz r \/
        n = 3 /\ ast = xastUnop unopNeg sz r \/
        n = 4 /\ ast = xastMul sz r \/
        n = 6 /\ ast = xastDiv sz r)) $;
pub theorem decodeHiAuxT (v sz r hi n ast l: nat):
  $ sz e. WSize /\ r e. RM /\
    decodeHiAux v sz r hi n ast l -> ast e. XAST /\ l e. List u8 $ =
(named @ focus
  (def (f x) '(syl6 ancom @ animd (a1i @ mpbiri elList0 eleq1) ,x))
  (def h '(syl5 anr @ syl5ibrcom eleq1 _))
  '(imp @ eord
    (syl5 anr ,(f '(eord (eord ,h ,h) @ syl5 anr @ eord (eord ,h ,h) ,h)))
    (syl5 anr @ eord (syl5 anr @ eexd _) ,(f '(eord (eord (eord ,h ,h) ,h) ,h))))
  '(sylibr xastUnopT @ iand (iand (a1i unopIncT) anl) anr)
  '(sylibr xastUnopT @ iand (iand (a1i unopDecT) anl) anr)
  '(sylibr xastCallT @ sylibr immRM_rmT anr)
  '(sylibr xastJumpT anr)
  '(sylibr xastPushT @ sylibr immRM_rmT anr)
  '(exp @ iand (mpbird (eleq1d anrr) @ sylibr xastBinopT @
      iand (iand (a1i binopTstT) anll) @ sylibr Rm_iT @
      iand anlr @ sylan (anld readImmT) anll anrl) @
    anrd @ sylan readImmT anll anrl)
  '(sylibr xastUnopT @ iand (iand (a1i unopNotT) anl) anr)
  '(sylibr xastUnopT @ iand (iand (a1i unopNegT) anl) anr)
  '(sylibr xastMulT @ iand anl anr)
  '(sylibr xastDivT @ iand anl anr));

theorem decodeHiAux_len_le: $ decodeHiAux v sz r hi n ast l -> len l <= 4 $ =
(named '(eor (rsyl anrl @ mpbiri le01 @ leeq1d @ syl6eq len0 leneq) @
  anwr @ eor (anwr @ eex @ anwl @ readImm_len_le) @
  anwl @ mpbiri le01 @ leeq1d @ syl6eq len0 leneq));

@_ def decodeHi (rex ast b l .v .x .opc .r .l1 .l2: nat): wff =
$ E. v E. x E. opc E. r E. l1 E. l2 (l = l1 ++ l2 /\
    splitBits ((1, v) : (2, 3) : (1, x) : (4, 15) : 0) b /\
    readOpcodeModRM rex opc r l1 /\
    decodeHiAux v (opSizeW rex v) r x opc ast l2) $;
pub theorem decodeHiT (rex ast b l: nat):
  $ decodeHi rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(named @ focus
  '(eex @ eex @ eex @ eex @ eex @ eex @ mpand (sylan decodeHiAuxT _ anr) @
    iand (iand anrl @ rsyl an3lr @ splitBitsTi ,bvSizeSi) @
    mpbird (eleq1d an4l) @ sylibr appendT @ iand (rsyl anllr @ anrd readOpcodeModRM_T) anrr)
  '(rsyl anlr @ rsyl readOpcodeModRM_T @ iand (a1i opSizeW_T) anlr));

theorem decodeHi_len_le: $ decodeHi rex v rm l -> len l <= 10 $ =
(named '(eex @ eex @ eex @ eex @ eex @ eex @
  mpbird (leeq1d @ syl6eq appendlen @ leneqd an3l) @
  letrd (leaddd (rsyl anlr readOpcodeModRM_len_le) @ anwr decodeHiAux_len_le) @
  a1i ,norm_num));

@_ def decodeAux (rex ast b l: nat): wff =
$ decodeBinop rex ast b l \/ decodeMov rex ast b l \/
  decodeStack rex ast b l \/ decodeFlow rex ast b l \/
  decodeMisc rex ast b l \/ decodeHi rex ast b l \/ decodeTwo rex ast b l $;
pub theorem decodeAuxT (rex ast b l: nat):
  $ decodeAux rex ast b l -> ast e. XAST /\ b e. u8 /\ l e. List u8 $ =
(focus
  (def (f x) (atom-app 'decode x 'T))
  (foldl '(Mov Stack Flow Misc Hi Two) (f 'Binop)
    @ fn (x y) '(eor ,x ,(f y))));

theorem decodeAux_s1 (h: $ decodeAux rex ast opc (c ': s0) $):
  $ decodeAux rex ast opc (s1 c) $ = '(mpbi (decodeAuxeq4 s2nscons0) h);

theorem decodeAux_len_le: $ decodeAux rex ast b l -> len l <= 10 $ =
(focus
  (def (f x) (atom-app 'decode x '_len_le))
  (foldl '(Mov Stack Flow Misc Hi Two) (f 'Binop)
    @ fn (x y) '(eor ,x ,(f y))));

theorem decodeBinopI (h: $ decodeBinop rex ast b l $): $ decodeAux rex ast b l $ = '(orl @ orl @ orl @ orl @ orl @ orl h);
theorem decodeMovI   (h: $ decodeMov rex ast b l $):   $ decodeAux rex ast b l $ = '(orl @ orl @ orl @ orl @ orl @ orr h);
theorem decodeStackI (h: $ decodeStack rex ast b l $): $ decodeAux rex ast b l $ = '(orl @ orl @ orl @ orl @ orr h);
theorem decodeFlowI  (h: $ decodeFlow rex ast b l $):  $ decodeAux rex ast b l $ = '(orl @ orl @ orl @ orr h);
theorem decodeMiscI  (h: $ decodeMisc rex ast b l $):  $ decodeAux rex ast b l $ = '(orl @ orl @ orr h);
theorem decodeHiI    (h: $ decodeHi rex ast b l $):    $ decodeAux rex ast b l $ = '(orl @ orr h);

theorem decodeBinop_lem
  (hy: $ bs1 ++ (1, o) : 0 = by $)
  (hc: $ bs1 ++ (3, opc) : (2, 0) : 0 = bc $)
  (h1: $ splitBits by y $)
  (h2: $ splitBits ((2, pc) : (2, 0) : 0) x $)
  (h3: $ splitBits ((1, o) : (2, pc) : (1, 0) : 0) opc $)
  (hs: $ bvSize bs1 = 3 $):
  $ splitBits bc (ch x y) $ =
(focus
  '(splitBits_332_ hy
    (eqtr (appendeq2 @ conseq1 @ preq2 _) hc) h1 h2 hs)
  '(eqtr3 (addeq1 @ shleq1 _) @ anri @ mpbi splitBitsS2 h3)
  '(eqtr ofBitsS @ eqtr (addeq2 @ eqtr (shleq1 ofBits1) shl01) add0));

theorem decodeBinopRegI
  (h1: $ splitBits ((1, v) : (1, d) : (1, 0) : (1, o) : 0) y $)
  (h2: $ splitBits ((2, pc) : (2, 0) : 0) x $)
  (h3: $ splitBits ((1, o) : (2, pc) : (1, 0) : 0) opc $)
  (h4: $ readModRM rex reg r l $)
  (h5: $ opSizeW rex v = sz $)
  (h6: $ if (true d) (R_rm reg r) (Rm_r r reg) = ds $):
  $ decodeAux rex (xastBinop opc sz ds) (ch x y) l $ =
'(decodeBinopI @ orl @ orl @ orl @ orl @ orl @ iexie @ iexde @ iexde @ iexde @ iexde @
  mpbiri (iani (iani (decodeBinop_lem
    (appendSi @ appendSi append1) (appendSi @ appendSi append1) h1 h2 h3 ,bvSizeSi) h4) @
    eqcom @ xastBinopeq eqid h5 h6) ,eqtac);

theorem decodeBinopRAX_I
  (h1: $ splitBits ((1, v) : (2, 2) : (1, o) : 0) y $)
  (h2: $ splitBits ((2, pc) : (2, 0) : 0) x $)
  (h3: $ splitBits ((1, o) : (2, pc) : (1, 0) : 0) opc $)
  (h4: $ opSizeW rex v = sz $)
  (h5: $ readImm sz imm l $):
  $ decodeAux rex (xastBinop opc sz (Rm_i (RM_reg x0) imm)) (ch x y) l $ =
'(decodeBinopI @ orl @ orl @ orl @ orl @ orr @ iexie @ iexde @ iexde @
  mpbiri (iani (iani (decodeBinop_lem (appendSi append1) (appendSi append1)
      h1 h2 h3 ,bvSizeSi) @ mpbir (readImmeq1 h4) h5) @
    eqcom @ xastBinopeq eqid h4 @ Rm_ieq1 @ RM_regeq dec0) ,eqtac);

theorem decodeBinopImmI
  (h1: $ splitBits ((1, v) : (3, 0) : 0) y $)
  (h2: $ readOpcodeModRM rex opc r l1 $)
  (h3: $ opSizeW rex v = sz $)
  (h4: $ readImm sz imm l2 $):
  $ decodeAux rex (xastBinop opc sz (Rm_i r imm)) (ch x8 y) (l1 '+ l2) $ =
(focus
  '(decodeBinopI @ orl @ orl @ orl @ orr @ iexie @ iexde @ iexde @ iexde @ iexde @ iexde @
    mpbiri (iani (iani (iani (iani s2nsadd _) h2) @ mpbir (readImmeq1 h3) h4) @
      eqcom @ xastBinopeq2 h3) ,eqtac)
  '(splitBitsA4ic (appendSi append1) ,bvSizeSi h1 @ splitBits14ie dec8));

theorem decodeBinopImm8I
  (h1: $ readOpcodeModRM rex opc r l1 $)
  (h2: $ opSizeW rex 1 = sz $)
  (h3: $ readImmN 8 imm l2 $):
  $ decodeAux rex (xastBinop opc sz (Rm_i r imm)) (ch x8 x3) (l1 '+ l2) $ =
(focus
  '(decodeBinopI @ orl @ orl @ orr @ iexie @ iexde @ iexde @ iexde @ iexde @
    mpbiri (iani (iani (iani (iani s2nsadd eqid) h1) h3) @
      eqcom @ xastBinopeq2 h2) ,eqtac));

theorem decodeMovRegI
  (h1: $ splitBits ((1, v) : (1, d) : (2, 2) : 0) a $)
  (h2: $ opSizeW rex v = sz $)
  (h3: $ readModRM rex reg r (s2n l) $)
  (h4: $ if (true d) (R_rm reg r) (Rm_r r reg) = ds $):
  $ decodeAux rex (xastMov sz ds) (ch x8 a) l $ =
(focus
  '(decodeMovI @ orl @ orl @ orr @ iexie @ iexde @ iexde @ iexde @
    mpbiri (iani (iani _ h3) @ eqcom @ xastMoveq h2 h4) ,eqtac)
  '(splitBitsA4ic (appendSi @ appendSi append1) ,bvSizeSi h1 @ splitBits14ie dec8));

theorem decodeMovRMI
  (h1: $ splitBits ((1, v) : (1, 1) : (2, 2) : 0) a $)
  (h2: $ opSizeW rex v = sz $)
  (h3: $ readModRM rex reg r (s2n l) $):
  $ decodeAux rex (xastMov sz (R_rm reg r)) (ch x8 a) l $ =
'(decodeMovRegI h1 h2 h3 @ ifpos true1);

theorem decodeMovMRI
  (h1: $ splitBits ((1, v) : (1, 0) : (2, 2) : 0) a $)
  (h2: $ opSizeW rex v = sz $)
  (h3: $ readModRM rex reg r (s2n l) $):
  $ decodeAux rex (xastMov sz (Rm_r r reg)) (ch x8 a) l $ =
'(decodeMovRegI h1 h2 h3 @ ifneg true0);

theorem decodeMov64I
  (h1: $ splitBits ((3, r) : (1, v) : 0) a $)
  (h2: $ opSizeW rex v = sz $)
  (h3: $ readFullImm sz (chopZ 64 imm) (s2n l) $)
  (h4: $ REX_B rex = rb $)
  (h5: $ splitBits ((3, r) : (1, rb) : 0) (h2n r2) $):
  $ decodeAux rex (xastMov sz (Rm_i (RM_reg r2) (chopZ 64 imm))) (ch xb a) l $ =
(focus
  '(decodeMovI @ orl @ orr @ iexie @ iexde @ iexde @
    mpbiri (iani (iani _ _) _) ,eqtac)
  '(splitBitsA4ic (appendSi append1) ,bvSizeSi h1 @ splitBits14ie decb)
  '(mpbir (readFullImmeq1 h2) h3)
  '(eqcom @ xastMoveq h2 @ Rm_ieq1 @ RM_regeq @
    eqtr (rex_regeq1 h4) @ rex_reg_i h5));

theorem decodeMovImmI
  (h1: $ splitBits ((1, v) : (3, 3) : 0) a $)
  (h2: $ opSizeW rex v = sz $)
  (h3: $ readOpcodeModRM rex 0 r l1 $)
  (h4: $ readImm sz imm l2 $):
  $ decodeAux rex (xastMov sz (Rm_i r imm)) (ch xc a) (l1 '+ l2) $ =
(focus
  '(decodeMovI @ orr @ iexie ,(iterate 4 (fn (x) '(iexde ,x))
    '(mpbiri (iani (iani (iani (iani s2nsadd _) h3) _) _) ,eqtac)))
  '(splitBitsA4ic (appendSi append1) ,bvSizeSi h1 @ splitBits14ie decc)
  '(mpbir (readImmeq1 h2) h4)
  '(eqcom @ xastMoveq1 h2));

theorem decodeTwoI (h: $ ,(foldr '(2 2 2 2 6) (get-decl 'decodeTwo) nth) $):
  $ decodeAux rex ast (ch x0 xf) (b2 ': l2) $ =
'(orr @ iani eqid @ iexie @ iexde @ mpbiri (iani s2nscons h) ,eqtac);

@_ def decode (ast l .rex .l1 .opc .l2: nat): wff =
$ E. rex E. l1 E. opc E. l2 (l = l1 ++ opc : l2 /\
    readPrefixes rex l1 /\ decodeAux rex ast opc l2) /\
  len l <= 15 $;
pub theorem decodeT (ast l: nat): $ decode ast l -> ast e. XAST /\ l e. List u8 $ =
(named '(anwl @ eex @ eex @ eex @ eex @ mpand (anwr decodeAuxT) @
  iand (anwr anll) @ mpbird (eleq1d an3l) @
  sylibr appendT @ iand (rsyl anllr @ anrd readPrefixesT) @
  anwr @ sylibr elListS @ anim1 anr));

theorem decode_len_le_lem:
  $ l = l1 ++ opc : l2 /\ readPrefixes rex l1 /\ decodeAux rex ast opc l2 -> len l <= 12 $ =
'(mpbird (leeqd (syl6eq appendlen @ leneqd anll) @ a1i @ eqcom add11) @
    leaddd (rsyl anlr readPrefixes_len_le) @ sylibr (leeq1 lenS) @
    sylib lesuc @ anwr decodeAux_len_le);

theorem decode_len_le: $ decode ast l -> len l <= 12 $ =
(named '(anwl @ eex @ eex @ eex @ eex decode_len_le_lem));

theorem decodeI (h1: $ readPrefixes rex l1 $) (h2: $ decodeAux rex ast opc l2 $)
  (he: $ l1 ++ opc : l2 = l $): $ decode ast l $ =
'(iani (iexie @ iexde @ iexde @ iexde @
    mpbiri (iani (iani (eqcom he) h1) h2) ,eqtac) @
  letr (decode_len_le_lem @ iani (iani (eqcom he) h1) h2) ,norm_num);

theorem decode0I (h: $ decodeAux 0 ast opc s $): $ decode ast (opc ': s) $ =
(named '(decodeI (orl @ ian eqid eqid) h @ eqtr4 append0 s2nscons));

theorem decode1I (h: $ decodeAux (suc rex) ast opc s $):
  $ decode ast (ch x4 rex ': opc ': s) $ =
'(decodeI (orr @ iexie @ iexde @
  mpbiri (ian (ian (splitBitsS4i @ splitBits14ie dec4) eqid) eqid) ,eqtac) h @
  eqtr4 append1 @ eqtr s2nscons @ conseq c2nhex s2nscons);

theorem decode_s1 (h: $ decode ast (c ': s0) $):
  $ decode ast (s1 c) $ = '(mpbi (decodeeq2 s2nscons0) h);

theorem decodeRetI
  (h1: $ splitBits ((1, v) : (3, 1) : 0) a $)
  (h2: $ ifp (true v) (imm = 0 /\ l = 0) (readImmN 16 imm l) $):
  $ decode (xastRet imm) (ch xc a ': l) $ =
(focus
  '(decode0I @ decodeFlowI @ orl @ orr @ iexie @ iexde @
    mpbiri (iani (iani _ h2) eqid) ,eqtac)
  '(splitBitsA4ic (appendSi append1) ,bvSizeSi h1 @ splitBits14ie decc));

theorem decodeRet0I: $ decode (xastRet 0) (s1 (ch xc x3)) $ =
'(decode_s1 @ decodeRetI xsplitBits_313 @ mpbir (ifppos true1) @ iani eqid s2ns0);

theorem decodeRetSI
  (h: $ readImmN 16 imm l $):
  $ decode (xastRet imm) (ch xc x2 ': l) $ =
'(decodeRetI xsplitBits_213 @ mpbir (ifpneg true0) h);

theorem decodeSysCallI: $ decode xastSysCall (ch x0 xf ': s1 (ch x0 x5)) $ =
'(decode0I @ decodeAux_s1 @ decodeTwoI @ orr @ iani (iani eqid s2ns0) eqid);

----------------------------------------
-- Dynamic semantics
----------------------------------------

@_ def Flags: nat = $ u64 $;
@_ def CF (flags: nat): wff = $ 0 e. flags $;
@_ def ZF (flags: nat): wff = $ 6 e. flags $;
@_ def SF (flags: nat): wff = $ 7 e. flags $;
@_ def OF (flags: nat): wff = $ 11 e. flags $;

@_ def setCF (f: nat) (p: wff): nat = $ bitsUpdate 0 1 (nat p) f $;
@_ def setZF (f: nat) (p: wff): nat = $ bitsUpdate 6 1 (nat p) f $;
@_ def setSF (f: nat) (p: wff): nat = $ bitsUpdate 7 1 (nat p) f $;
@_ def setOF (f: nat) (p: wff): nat = $ bitsUpdate 11 1 (nat p) f $;
pub theorem setCF_T (f: nat) (p: wff): $ f e. Flags -> setCF f p e. Flags $ =
'(exp bitsUpdateT @ ian ,norm_num @ mpbir elBits1 boolnat);
pub theorem setZF_T (f: nat) (p: wff): $ f e. Flags -> setZF f p e. Flags $ =
'(exp bitsUpdateT @ ian ,norm_num @ mpbir elBits1 boolnat);
pub theorem setSF_T (f: nat) (p: wff): $ f e. Flags -> setSF f p e. Flags $ =
'(exp bitsUpdateT @ ian ,norm_num @ mpbir elBits1 boolnat);
pub theorem setOF_T (f: nat) (p: wff): $ f e. Flags -> setOF f p e. Flags $ =
'(exp bitsUpdateT @ ian ,norm_num @ mpbir elBits1 boolnat);

theorem CF_setCF: $ CF (setCF f p) <-> p $ = 'el_bitsUpdate1_eq;
theorem ZF_setZF: $ ZF (setZF f p) <-> p $ = 'el_bitsUpdate1_eq;
theorem SF_setSF: $ SF (setSF f p) <-> p $ = 'el_bitsUpdate1_eq;
theorem OF_setOF: $ OF (setOF f p) <-> p $ = 'el_bitsUpdate1_eq;

theorem setF_ne (h1: $ i != j $) (h2: $ i e. f <-> q $):
  $ i e. bitsUpdate j 1 (nat p) f <-> q $ = '(bitr (el_bitsUpdate1_ne h1) h2);
theorem ZF_setCF (h: $ ZF f <-> q $): $ ZF (setCF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem SF_setCF (h: $ SF f <-> q $): $ SF (setCF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem OF_setCF (h: $ OF f <-> q $): $ OF (setCF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem CF_setZF (h: $ CF f <-> q $): $ CF (setZF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem SF_setZF (h: $ SF f <-> q $): $ SF (setZF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem OF_setZF (h: $ OF f <-> q $): $ OF (setZF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem CF_setSF (h: $ CF f <-> q $): $ CF (setSF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem ZF_setSF (h: $ ZF f <-> q $): $ ZF (setSF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem OF_setSF (h: $ OF f <-> q $): $ OF (setSF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem CF_setOF (h: $ CF f <-> q $): $ CF (setOF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem ZF_setOF (h: $ ZF f <-> q $): $ ZF (setOF f p) <-> q $ = '(setF_ne ,norm_num h);
theorem SF_setOF (h: $ SF f <-> q $): $ SF (setOF f p) <-> q $ = '(setF_ne ,norm_num h);

theorem CF_setCZSO: $ CF (setOF (setSF (setZF (setCF f c) z) s) o) <-> c $ = '(CF_setOF @ CF_setSF @ CF_setZF CF_setCF);
theorem ZF_setCZSO: $ ZF (setOF (setSF (setZF (setCF f c) z) s) o) <-> z $ = '(ZF_setOF @ ZF_setSF ZF_setZF);
theorem SF_setCZSO: $ SF (setOF (setSF (setZF (setCF f c) z) s) o) <-> s $ = '(SF_setOF SF_setSF);
theorem OF_setCZSO: $ OF (setOF (setSF (setZF (setCF f c) z) s) o) <-> o $ = 'OF_setOF;

@_ abstract def readBCond (f c: nat): wff =
$ ifp (c < 4)
    (ifp (c < 2) (ifp (c = bcondO) (OF f) (CF f)) (c = bcondNA /\ CF f \/ ZF f))
    (ifp (c = bcondS) (SF f) (c = bcondNG /\ ZF f \/ ~(SF f <-> OF f))) $;
pub theorem readBCondO (f: nat): $ readBCond f bcondO <-> OF f $ =
'(bitr (ifppos d0lt4) @ bitr (ifppos d0lt2) (ifppos eqid));
pub theorem readBCondB (f: nat): $ readBCond f bcondB <-> CF f $ =
'(bitr (ifppos d1lt4) @ bitr (ifppos d1lt2) (ifpneg d1ne0));
pub theorem readBCondE (f: nat): $ readBCond f bcondE <-> ZF f $ =
'(bitr (ifppos d2lt4) @ bitr (ifpneg ltirr) (bior1 @ mt anl (ltne d2lt3)));
pub theorem readBCondNA (f: nat): $ readBCond f bcondNA <-> CF f \/ ZF f $ =
'(bitr (ifppos d3lt4) @ bitr (ifpneg @ ltnlt d2lt3) (oreq1i @ bian1 eqid));
pub theorem readBCondS (f: nat): $ readBCond f bcondS <-> SF f $ =
'(bitr (ifpneg ltirr) (ifppos eqid));
pub theorem readBCondL (f: nat): $ readBCond f bcondL <-> ~(SF f <-> OF f) $ =
'(bitr (ifpneg @ ltnlt d4lt6) @ bitr (ifpneg @ ltner d4lt6) (bior1 @ mt anl @ ltne d6lt7));
pub theorem readBCondNG (f: nat): $ readBCond f bcondNG <-> ZF f \/ ~(SF f <-> OF f) $ =
'(bitr (ifpneg @ ltnlt d4lt7) @ bitr (ifpneg @ ltner d4lt7) (oreq1i @ bian1 eqid));

@_ abstract def readCondF (f c: nat): wff =
$ c e. Option (Sum {x | readBCond f x} {x | ~readBCond f x}) $;
pub theorem readCondFAlways (f: nat): $ readCondF f condAlways $ = (named 'opt0);
pub theorem readCondFPos (f c: nat): $ readCondF f (condPos c) <-> readBCond f c $ =
(named '(bitr optS @ bitr Suml @ elabe readBCondeq2));
pub theorem readCondFNeg (f c: nat): $ readCondF f (condNeg c) <-> ~readBCond f c $ =
(named '(bitr optS @ bitr Sumr @ elabe @ noteqd readBCondeq2));

@_ def Prot: set = $ Bits 3 $;
pub theorem finiteProt: $ finite Prot $ = 'finns;
@(add-eval) def PROT_READ: nat = $ 1 $;
@(add-eval) def PROT_WRITE: nat = $ 2 $;
@(add-eval) def PROT_EXEC: nat = $ 4 $;
theorem PROT_T_lem (h: $ a < 8 $): $ a e. Prot $ = '(mpbir elBits2 @ mpbir (lteq2 d2pow3) h);
pub theorem PROT_READ_T: $ PROT_READ e. Prot $ = '(PROT_T_lem d1lt8);
pub theorem PROT_WRITE_T: $ PROT_WRITE e. Prot $ = '(PROT_T_lem d2lt8);
pub theorem PROT_EXEC_T: $ PROT_EXEC e. Prot $ = '(PROT_T_lem d4lt8);
theorem Prot_ss: $ a C_ b -> b e. Prot -> a e. Prot $ = '(sylibr (imeqi elBits elBits) sstr);
theorem PROT_RX_T: $ PROT_READ + PROT_EXEC e. Prot $ =
'(PROT_T_lem {,norm_num : $ 1 + 4 < 8 $});

@_ def Memory: set = $ Arrow u64 (Xp Prot u8) $;
pub theorem finiteMemory: $ finite Memory $ = '(Arrowfin finns @ xpfin finiteProt finns);
theorem elMemoryT: $ m e. Memory /\ x e. u64 -> m @ x e. Xp Prot u8 $ = 'appT;

@_ def Exception: set = $ upto 3 $;
pub theorem finiteException: $ finite Exception $ = 'finns;
--| Represents the 'syscall' function
@(add-eval) def exSysCall: nat = $ 0 $;
--| General protection fault, issued on invalid read/write
@(add-eval) def exGPF: nat = $ 1 $;
--| Undefined instruction, issued on ud2 instruction
@(add-eval) def exUD: nat = $ 2 $;
pub theorem exSysCallT: $ exSysCall e. Exception $ = '(mpbir elupto d0lt3);
pub theorem exGPF_T: $ exGPF e. Exception $ = '(mpbir elupto d1lt3);
pub theorem exUD_T: $ exUD e. Exception $ = '(mpbir elupto d2lt3);

--| ```
--| data Config = {
--|   ex: Option Exception,   -- nonnull if we are going to do IO on the next step
--|   rip: u64,               -- the intruction pointer
--|   regs: Regs -> u64,      -- the 16 general purpose registers
--|   flags: Flags,           -- the flags CF, ZF, SF, OF
--|   mem: u64 -> Prot * u8 } -- the virtual memory
--| ```
@_ def Config: set = $ Xp (Xp (Option Exception) u64) (Xp (Arrow Regs u64) (Xp Flags Memory)) $;
pub theorem finiteConfig: $ finite Config $ =
'(xpfin (xpfin (optfin finiteException) finns) @
  xpfin (Arrowfin finns finns) @ xpfin finns finiteMemory);
@_ def mkCfg (ex rip regs flags mem: nat): nat = $ (ex, rip), regs, flags, mem $;
pub theorem mkCfgT (ex rip regs flags mem: nat):
  $ mkCfg ex rip regs flags mem e. Config <->
    ex e. Option Exception /\ rip e. u64 /\ regs e. Arrow Regs u64 /\
    flags e. Flags /\ mem e. Memory $ =
'(bitr prelxp @ bitr4 (bitr4 (aneq prelxp @ bitr prelxp @ aneq2i prelxp) anass) anass);

theorem mkCfg_ex: $ E. e E. i E. rs E. f E. m k = mkCfg e i rs f m $ =
'(iexie @ iexde @ iexde @ iexde @ iexde @
  eqcomd @ syl6eq fstsnd @ preqd (syl6eq fstsnd @ preqd an4l an3lr) @
  syl6eq fstsnd @ preqd anllr @ syl6eq fstsnd @ preqd anlr anr);

@_ def readException (k: nat): nat = $ pi11 k $;
@_ def readRIP (k: nat): nat = $ pi12 k $;
@_ def readReg (k r: nat): nat = $ pi21 k @ r $;
@_ def readFlags (k: nat): nat = $ pi221 k $;
@_ def getMemory (k: nat): nat = $ pi222 k $;
@_ def readCond (k c: nat): wff = $ readCondF (readFlags k) c $;
theorem readException_mk: $ readException (mkCfg e i r f m) = e $ = 'pi11pr;
theorem readRIP_mk: $ readRIP (mkCfg e i r f m) = i $ = 'pi12pr;
theorem readReg_mk: $ readReg (mkCfg e i r f m) a = r @ a $ = '(appneq1 pi21pr);
theorem readFlags_mk: $ readFlags (mkCfg e i r f m) = f $ = 'pi221pr;
theorem getMemory_mk: $ getMemory (mkCfg e i r f m) = m $ = 'pi222pr;

pub theorem readExceptionT (k: nat): $ k e. Config -> readException k e. Option Exception $ =
'(syl xpfst xpfst);
pub theorem readRIP_T (k: nat): $ k e. Config -> readRIP k e. u64 $ =
'(syl xpsnd xpfst);
pub theorem readRegT (k r: nat): $ k e. Config /\ r e. Regs -> readReg k r e. u64 $ =
'(syl appT @ anim1 @ syl xpfst xpsnd);
pub theorem readFlagsT (k: nat): $ k e. Config -> readFlags k e. Flags $ =
'(syl xpfst @ syl xpsnd xpsnd);
pub theorem getMemoryT (k: nat): $ k e. Config -> getMemory k e. Memory $ =
'(syl xpsnd @ syl xpsnd xpsnd);

@_ def readMemory1 (ps m a b .prot: nat): wff =
$ m e. Memory /\ a e. u64 /\ E. prot (m @ a = prot, b /\ ps C_ prot) $;
pub theorem readMemory1T (ps m a b: nat):
  $ readMemory1 ps m a b -> ps e. Prot /\ m e. Memory /\ a e. u64 /\ b e. u8 $ =
(named @ focus
  (have 'h '(sylib prelxp @ mpbid (eleq1d anrl) @ anwl elMemoryT))
  '(imp @ eexda @ iand (iand (iand (sylc Prot_ss anrr @ anld h) anll) anlr) (anrd h)));

@_ local def readMemory_aux (ps m l: nat): nat =
$ lrec u64 (\\ b, \\ z, \ ih, sep u64 {a | readMemory1 ps m a b /\ a +_64 1 e. ih}) l $;

@_ abstract def readMemory (ps m a l: nat): wff =
$ ps e. Prot /\ m e. Memory /\ a e. readMemory_aux ps m l $;
pub theorem readMemory0 (ps m a: nat):
  $ readMemory ps m a 0 <-> ps e. Prot /\ m e. Memory /\ a e. u64 $ =
(named '(aneq2i @ elneq2 lrec0));
pub theorem readMemoryS (ps m a b l: nat):
  $ readMemory ps m a (b : l) <->
    readMemory1 ps m a b /\ readMemory ps m (a +_64 1) l $ =
(named @ focus
  '(bitr (aneq2i @ bitr (elneq2 _) _) anlass)
  '(eqtr {lrecS : $ _ = _ @ (_, _, readMemory_aux) $} @
    appslame @ appslamed @ applamed @
    sepeq2d @ abeqd @ aneqd (readMemory1eq4d anll) (elneq2d anr))
  '(bitr elsep @ bitr (aneq2i @ elabe @ aneqd readMemory1eq3 @ eleq1d add64eq1) @
    bian1a @ anwl @ rsyl readMemory1T anlr));
pub theorem readMemoryT (ps m a l: nat):
  $ readMemory ps m a l -> ps e. Prot /\ m e. Memory /\ a e. u64 /\ l e. List u8 $ =
(named @ let ([h '(imeqd readMemoryeq3 @ aneq1d eleq1)])
'(sylibr anass @ iand anl @ eale ,h ,(induct '(listind) 'l
  '(ax_gen @ iand (sylbi readMemory0 anr) @ a1i elList0)
  '(sylbi (cbval ,h) @ iald @ syl5bi readMemoryS @
    rsyl (eale ,h) @ impd @ com12 @ imim2d @
    rsyl readMemory1T @ exp @ iand anllr @ sylibr elListS @ iand anlr anrr))));

@_ def readMem (k a l: nat): wff = $ k e. Config /\ readMemory PROT_READ (getMemory k) a l $;
pub theorem readMemT (k a l: nat):
  $ readMem k a l -> k e. Config /\ a e. u64 /\ l e. List u8 $ =
'(imp @ syl5 readMemoryT @ anim1d @ anim1d ax_1);

@_ def readMemX (k a l: nat): wff =
$ k e. Config /\ readMemory (PROT_READ + PROT_EXEC) (getMemory k) a l $;
pub theorem readMemX_T (k a l: nat):
  $ readMemX k a l -> k e. Config /\ a e. u64 /\ l e. List u8 $ =
'(imp @ syl5 readMemoryT @ anim1d @ anim1d ax_1);

@_ def writeMemory1 (m a b m2 e .prot .b2: nat): wff =
$ m e. Memory /\ a e. u64 /\ b e. u8 /\
  E. prot E. b2 (m @ a = prot, b2 /\
  ifp (PROT_READ + PROT_WRITE C_ prot)
    (m2 == write m a (prot, b) /\ e = 0)
    (m2 == m /\ e = suc exGPF)) $;
theorem write_el_Memory
  (h1: $ G -> m e. Memory $) (h2: $ G -> a e. u64 $)
  (h3: $ G -> prot e. Prot $) (h4: $ G -> b e. u8 $)
  (h5: $ G -> m2 == write m a (prot, b) $): $ G -> m2 e. Memory $ =
'(writeArrow h1 h2 (xpTd h3 h4) (eqscomd h5));
theorem writeMemory1T_sn (m a b m2 e: nat):
  $ writeMemory1 m a b m2 e ->
    m e. Memory /\ a e. u64 /\ b e. u8 /\
    m2 e. Memory /\ e e. Option (sn exGPF) $ =
(named '(sylibr anass @ anim2a @ eexd @ eexd @ impd @ exp @ eorda
  (iand
    (write_el_Memory an4l an3lr
      (anwl @ anld @ sylib prelxp @ mpbid (eleq1d anr) @ anwll elMemoryT) anllr
      (anwr anrl))
    (mpbiri opt0 (eleq1d @ anwr anrr)))
  (iand
    (mpbird (eleq1d @ sylib nsinj @ anwr anrl) an4l)
    (mpbird (eleq1d @ anwr anrr) @ optSd @ a1i snid))));

pub theorem writeMemory1T (m a b m2 e: nat):
  $ writeMemory1 m a b m2 e ->
    m e. Memory /\ a e. u64 /\ b e. u8 /\
    m2 e. Memory /\ e e. Option Exception $ =
'(rsyl writeMemory1T_sn @ anim2 @ ssel @ mpbir optss @ mpbir snss exGPF_T);

@_ local def setMem1 (m a b: nat): nat =
$ if (PROT_READ + PROT_WRITE C_ fst (m @ a))
    (lower (write m a (fst (m @ a), b)), 0)
    (m, suc exGPF) $;

theorem writeMemory1_setMem1: $ writeMemory1 m a b m2 e <->
  m e. Memory /\ a e. u64 /\ b e. u8 /\ m2, e = setMem1 m a b $ =
(named @ focus
  '(aneq2i @ bitr (bian2exi @ bian2exi @ aneq2a @ casesda _ _) @ bian1 expr)
  (def h1 '(syl6eq fstpr @ fsteqd anl))
  (def (f x y z) '(bitr4d (anwr ,x) @
    bitrd (eqeq2d @ syl ,y @ mpbird (rsyl ,h1 ,eqtac) anr) @
    syl6bbr (aneq1i ,z) @ syl6bb prth @ eqeq2d @ rsyl ,h1 ,eqtac))
  (f 'ifppos 'ifpos '(eqlower2 @ writefin finns))
  (f 'ifpneg 'ifneg 'nsinj));

theorem setMem1_T2: $ m e. Memory /\ a e. u64 /\ b e. u8 ->
  setMem1 m a b = m2, e -> m2 e. Memory /\ e e. Option (sn exGPF) $ =
'(syl5 eqcom @ exp @ sylbir writeMemory1_setMem1 @
  rsyl writeMemory1T_sn @ anim1 anr);

theorem setMem1_T: $ m e. Memory /\ a e. u64 /\ b e. u8 ->
  setMem1 m a b e. Xp Memory (Option (sn exGPF)) $ =
'(sylibr elxp @ mpi (eqcom fstsnd) setMem1_T2);

@_ local def setMemAux (l: nat): nat =
$ lrec
  (\. m e. lower Memory, \. a e. u64, m, 0)
  (\\ b, \\ z, \ ih, \. m e. lower Memory, \. a e. u64,
    if (snd (setMem1 m a b) = 0)
      (ih @ fst (setMem1 m a b) @ (a +_64 1))
      (setMem1 m a b))
  l $;
@_ local def setMem (m a l: nat): nat = $ setMemAux l @ m @ a $;

theorem setMem0: $ m e. Memory /\ a e. u64 -> setMem m a 0 = m, 0 $ =
(named '(mpi {lrec0 : $ setMemAux 0 = _ $} @
  apprlamed1 (sylibr (ellower finiteMemory) anl) @
  apprlamed2 anlr ,eqtac));

theorem setMemS: $ m e. Memory /\ a e. u64 ->
  setMem1 m a b = m2, e1 ->
  setMem m a (b : l) = if (e1 = 0) (setMem m2 (a +_64 1) l) (m2, e1) $ =
'(exp @
  mpd (syl5eq {lrecS : $ setMemAux (b : l) = _ @ (_, _, setMemAux l) $} @
    appslamed @ appslamed @ applamed @ rlameq2d @ rlameq2d ,eqtac) @
  apprlamed1 (sylibr (ellower finiteMemory) anll) @
  apprlamed2 anllr @ eqtrd ,eqtac @ rsyl anllr @
  ifeqd (eqeq1d @ syl6eq sndpr sndeq) (setMemeq1d @ syl6eq fstpr fsteq) id);

theorem setMemT: $ m e. Memory /\ a e. u64 /\ l e. List u8 ->
  setMem m a l e. Xp Memory (Option (sn exGPF)) $ =
(named @ focus
  (def (f x) '(eale ,(eqtac-gen x)))
  '(ax_mp ,(f 'm) @ ax_mp ,(f 'a) _)
  (induct '(listind) 'l
    '(ax_gen @ ax_gen @ mpbird (eleq1d @ anwl setMem0) @ xpTd anll opt0d)
    '(sylbi (cbval @ cbvald ,eqtac) @ iald @ iald @
      ealie @ ealde @ sylbid ,eqtac @ a1i @ expcom @
      mpbird (eleq1d @ anwll @ mpi (eqcom fstsnd) setMemS) _))
  (have 'H2 '(sylib elListS anlr))
  (have 'H1 '(sylan setMem1_T anll (anld H2)))
  '(sylan ifT _ @ sylibr (eleq1 fstsnd) H1)
  '(mpd (iand (iand (syl xpfst H1) (a1i add64T)) (anrd H2)) anr));

theorem setMemT2: $ m e. Memory /\ a e. u64 /\ l e. List u8 ->
  setMem m a l = m2, e ->
  m2 e. Memory /\ e e. Option (sn exGPF) $ =
'(syl5ibrcom (bicomd @ syl6bb prelxp @ eleq1) setMemT);

@_ abstract def writeMemory (m a l m2 e: nat): wff =
$ m e. Memory /\ a e. u64 /\ l e. List u8 /\ setMem m a l = m2, e $;

pub theorem writeMemory0 (m a m2 e: nat):
  $ m e. Memory /\ a e. u64 ->
    (writeMemory m a 0 m2 e <-> m2 = m /\ e = 0) $ =
'(bitrd (syl bian1 @ mpi elList0 ian) @
  syl6bb prth @ syl6bb eqcomb @ eqeq1d setMem0);

pub theorem writeMemoryS {m2 e1: nat} (m a b l m3 e: nat):
  $ m e. Memory /\ a e. u64 /\ b e. u8 /\ l e. List u8 ->
    (writeMemory m a (b : l) m3 e <->
      E. m2 E. e1 (writeMemory1 m a b m2 e1 /\
      ifp (e1 = 0)
        (writeMemory m2 (a +_64 1) l m3 e)
        (m3 = m2 /\ e = e1))) $ =
'(bitr4d (syl bian1 @ iand anll @ sylibr elListS @ anim1 anr) @
  syl6bb (bian1 expr) @ bian2exd @ bian2exd @
  bitr4d (aneq1d @ anwl @ bitr4g writeMemory1_setMem1 eqcomb bian1) @
  aneq2da @ bitr4d (eqeq1d @ imp @ anwll setMemS)
  ,(let ([(f x y z) '(bitr4d (anwr ,x) @ bitr4d (eqeq1d @ anwr ,y) ,z)])
  '(casesda
    ,(f 'ifppos 'ifpos '(sylan bian1
      (iand (anld @ mpd anlr @ anw3l setMem1_T2) (a1i add64T)) anllr))
    ,(f 'ifpneg 'ifneg '(a1i @ bitr3 prth eqcomb)))));

theorem writeMemoryT_sn (m a l m2 e: nat):
  $ writeMemory m a l m2 e ->
    m e. Memory /\ a e. u64 /\ l e. List u8 /\ m2 e. Memory /\ e e. Option (sn exGPF) $ =
'(sylibr anass @ anim2a setMemT2);

pub theorem writeMemoryT (m a l m2 e: nat):
  $ writeMemory m a l m2 e ->
    m e. Memory /\ a e. u64 /\ l e. List u8 /\ m2 e. Memory /\ e e. Option Exception $ =
'(rsyl writeMemoryT_sn @ anim2 @ ssel @ mpbir optss @ mpbir snss exGPF_T);

theorem writeMemory02 (m a m2 e: nat):
  $ writeMemory m a 0 m2 e <-> m e. Memory /\ a e. u64 /\ m2 = m /\ e = 0 $ =
'(rbid (rsyl writeMemoryT an3l) anll @ syl6bbr anass @ bitr4d writeMemory0 bian1);

theorem writeMemoryS2 {m2 e1: nat} (m a b l m3 e: nat):
  $ writeMemory m a (b : l) m3 e <->
    m e. Memory /\ a e. u64 /\ b e. u8 /\ l e. List u8 /\
    E. m2 E. e1 (writeMemory1 m a b m2 e1 /\
    ifp (e1 = 0)
      (writeMemory m2 (a +_64 1) l m3 e)
      (m3 = m2 /\ e = e1)) $ =
'(rbid (rsyl writeMemoryT @ anwll @ sylibr anass @ bi1i @ aneq2i elListS) anl @
  bitr4d writeMemoryS bian1);

@_ def writeMem (k a l k2 .ip .r .f .m .m2 .e: nat): wff =
$ k e. Config /\ a e. u64 /\ l e. List u8 /\
  E. ip E. r E. f E. m E. m2 E. e (writeMemory m a l m2 e /\
  k = mkCfg 0 ip r f m /\ k2 = mkCfg e ip r f m2) $;
pub theorem writeMemT (k a l k2: nat):
  $ writeMem k a l k2 -> k e. Config /\ a e. u64 /\ l e. List u8 /\ k2 e. Config $ =
(named '(anim2a @ eexd @ eexd @ eexd @ eexd @ eexd @ eexda @
  mpbird (eleq1d anrr) @ sylan
    (sylibr mkCfgT @ iand (iand (iand (iand anrr an4lr) an3lr) anllr) (anwr anlr))
    (sylib mkCfgT @ mpbid (eleq1d @ anwr anlr) an3l)
    (anwr @ anwll writeMemoryT)));

@_ local def setMemory (k m: nat): nat = $ fst k, pi21 k, pi221 k, m $;
theorem setMemoryT:
  $ k e. Config /\ m e. Memory -> setMemory k m e. Config $ =
'(xpTd (anwl xpfst) @ xpTd (anwl xppi21) @ xpTd (anwl xppi221) anr);
theorem setMemory_mk: $ setMemory (mkCfg e ip r f m) m2 = mkCfg e ip r f m2 $ =
'(preq fstpr @ preq pi21pr @ preq1 pi221pr);
theorem readException_setMemory: $ readException (setMemory k m) = readException k $ =
'(fsteq fstpr);
theorem readRIP_setMemory: $ readRIP (setMemory k m) = readRIP k $ = '(sndeq fstpr);
theorem readReg_setMemory: $ readReg (setMemory k m) r = readReg k r $ = '(appneq1 pi21pr);
theorem readFlags_setMemory: $ readFlags (setMemory k m) = readFlags k $ = 'pi221pr;
theorem get_setMemory: $ getMemory (setMemory k m2) = m2 $ = 'pi222pr;
theorem set_setMemory: $ setMemory (setMemory k m2) m3 = setMemory k m3 $ =
'(preq fstpr @ preq pi21pr @ preq1 pi221pr);
theorem set_getMemory: $ setMemory k (getMemory k) = k $ =
'(eqtr (preq2 @ eqtr (preq2 fstsnd) fstsnd) fstsnd);

@_ def EA: set = $ Sum u64 (Sum Regs u64) $;
@_ def EA_i (q: nat): nat = $ b0 q $;
@_ def EA_r (r: nat): nat = $ b1 (b0 r) $;
@_ def EA_m (q: nat): nat = $ b1 (b1 q) $;
pub theorem EA_iT (q: nat): $ EA_i q e. EA <-> q e. u64 $ = 'Suml;
pub theorem EA_rT (r: nat): $ EA_r r e. EA <-> r e. Regs $ = '(bitr Sumr Suml);
pub theorem EA_mT (q: nat): $ EA_m q e. EA <-> q e. u64 $ = '(bitr Sumr Sumr);

@_ abstract def EA_addr (ea: nat): nat = $ if (E. a ea = EA_m a) (ea // 2 // 2) 0 $;
pub theorem EA_addrm (a: nat): $ EA_addr (EA_m a) = a $ =
(named '(eqtr (ifpos @ iexe (eqeq2d EA_meq) eqid) @ eqtr (diveq1 b1div2) b1div2));
pub theorem EA_addr0 {a: nat} (ea: nat): $ ~(E. a ea = EA_m a) -> EA_addr ea = 0 $ = 'ifneg;
pub theorem EA_addrT (ea: nat): $ ea e. EA -> EA_addr ea e. u64 $ =
(named '(casesd
  (eexda @ mpbird (eleq1d @ syl6eq EA_addrm @ EA_addreqd anr) @
    sylib EA_mT @ impcom @ bi1d eleq1)
  (a1i @ mpbiri elBits01 @ eleq1d EA_addr0)));

@_ abstract def readIndex (k si: nat): nat =
$ obind si (\\ sc, \ r, chop 64 (shl (readReg k r) sc)) $;
pub theorem readIndex0 (k: nat): $ readIndex k 0 = 0 $ = (named 'obind0);
pub theorem readIndexS (k sc r: nat):
  $ readIndex k (suc (sc, r)) = chop 64 (shl (readReg k r) sc) $ =
(named '(eqtr obindS @ appslame @ applamed @ chopeq2d @ shleqd (readRegeq2d anr) anl));
pub theorem readIndexT (k si: nat):
  $ k e. Config /\ si e. Option ScaleIndex -> readIndex k si e. u64 $ =
(split-sop 'si
  (fn (h1 h2) '(syl5ibrcom (eleq1d @ syl6eq ,h1 @ readIndexeq2) @ a1i ,h2))
  '{($0$ => readIndex0 elBits01) o
    (2 as $suc (sc, r)$ => readIndexS chopT)});

@_ abstract def readBase (k b: nat): nat =
$ obind b (ocase (readRIP k) (\ r, readReg k r)) $;
pub theorem readBase0 (k: nat): $ readBase k 0 = 0 $ = (named 'obind0);
pub theorem readBaseRIP (k: nat): $ readBase k base_RIP = readRIP k $ =
(named '(eqtr obindS ocase0));
pub theorem readBaseReg (k r: nat): $ readBase k (base_reg r) = readReg k r $ =
(named '(eqtr obindS @ eqtr ocaseS @ applame readRegeq2));
pub theorem readBaseT (k b: nat):
  $ k e. Config /\ b e. Base -> readBase k b e. u64 $ =
(split-sop 'b
  (fn (h1 h2) '(exp @ mpbird (eleq1d @ syl6eq ,h1 @ readBaseeq2d anr) ,h2))
  '{($0$ => readBase0 (a1i elBits01)) o
    ($base_RIP$ => readBaseRIP (anwll readRIP_T)) o
    ($base_reg r$ => readBaseReg
      (sylan readRegT anll @ sylib base_regT @ mpbid (eleq1d anr) anlr))});

@_ abstract def RM_EA (k rm: nat): nat =
$ case
    (\ r, EA_r r)
    (\\ si, \\ base, \ q, EA_m (readIndex k si +_64 readBase k base +_64 q))
  @ rm $;
pub theorem RM_EAreg (k r: nat): $ RM_EA k (RM_reg r) = EA_r r $ =
(named '(eqtr casel @ applame EA_req));
pub theorem RM_EAmem (k si base q: nat): $ RM_EA k (RM_mem si base q) =
  EA_m (readIndex k si +_64 readBase k base +_64 q) $ =
(named '(eqtr caser @ appslame @ appslamed @ applamed @ EA_meqd @
  add64eqd (add64eqd (readIndexeq2d anll) (readBaseeq2d anlr)) anr));
pub theorem RM_EA_T (k rm: nat):
  $ k e. Config /\ rm e. RM -> RM_EA k rm e. EA $ =
(split-sop _
  (fn (h1 h2) '(exp @ mpbird (eleq1d @ syl6eq ,h1 @ RM_EAeq2d anr) ,h2))
  '{($RM_reg r$ => RM_EAreg
      (sylibr EA_rT @ sylib RM_regT @ mpbid (eleq1d anr) anlr)) +
    ($RM_mem si base q$ => RM_EAmem (a1i @ mpbir EA_mT add64T))});

@_ abstract def immRM_EA (k irm: nat): nat = $ case (\ rm, RM_EA k rm) (\ q, EA_i q) @ irm $;
pub theorem immRM_EArm (k rm: nat): $ immRM_EA k (immRM_rm rm) = RM_EA k rm $ =
(named '(eqtr casel @ applame RM_EAeq2));
theorem immRM_EAreg: $ immRM_EA k (immRM_rm (RM_reg r)) = EA_r r $ = '(eqtr immRM_EArm RM_EAreg);
pub theorem immRM_EAimm (k q: nat): $ immRM_EA k (immRM_imm q) = EA_i q $ =
(named '(eqtr caser @ applame EA_ieq));
pub theorem immRM_EA_T (k irm: nat): $ k e. Config /\ irm e. ImmRM -> immRM_EA k irm e. EA $ =
(split-sop
  (def (f h1 h2 h3) '(mpbird (eleq1d @ syl6eq ,h1 @ immRM_EAeq2d anr) @
      mpand (sylib ,h2 @ mpbid (eleq1d anr) anlr) ,h3))
  '{($immRM_rm rm$ => ,(f 'immRM_EArm 'immRM_rmT '(sylan RM_EA_T an3l anr))) +
    ($immRM_imm q$ => ,(f 'immRM_EAimm 'immRM_immT '(sylibr EA_iT anr)))});

@_ local def destsrcIRM (ds: nat): nat =
$ case (\\ v, case
    (\ q, v, immRM_imm q)
    (\ r, v, immRM_rm (RM_reg r)))
  (\\ r, \ rm, RM_reg r, immRM_rm rm) @ ds $;
theorem destsrcIRMm_i (v q: nat): $ destsrcIRM (Rm_i v q) = v, immRM_imm q $ =
(named '(eqtr casel @ appslame @ syl5eq casel @ applamed ,eqtac));
theorem destsrcIRMm_r (v r: nat): $ destsrcIRM (Rm_r v r) = v, immRM_rm (RM_reg r) $ =
(named '(eqtr casel @ appslame @ syl5eq caser @ applamed ,eqtac));
theorem destsrcIRM_rm (r rm: nat): $ destsrcIRM (R_rm r rm) = RM_reg r, immRM_rm rm $ =
(named '(eqtr caser @ appslame @ applamed ,eqtac));
theorem destsrcIRM_T (ds: nat):
  $ ds e. DestSrc -> destsrcIRM ds e. Xp RM ImmRM $ =
(named
  (def (f x h1 h2 h3 h4)
    '(! exp _ (eq _ ,x) _ @ mpbird (eleq1d @ syl6eq ,h1 @ destsrcIRMeqd anr) @
      mpand (sylib ,h2 @ mpbid (eleq1d anr) anl) @ xpTd ,h3 ,h4))
  -- TODO: make (split-sop) handle this
  '(splitb (splitpr @ splitb
    (eqerd @ splitb0 @ splitpr2 @ splitb0
      ,(f $Rm_i v q$ 'destsrcIRMm_i 'Rm_iT '(anrl) '(sylibr immRM_immT anrr)))
    (eqerd @ splitb1 @ splitpr2 @ splitb0
      ,(f $Rm_r v r$ 'destsrcIRMm_r 'Rm_rT '(anrl) '(sylibr immRM_rmT @ sylibr RM_regT anrr))))
    (splitpr @ splitb1
      ,(f $R_rm r rm$ 'destsrcIRM_rm 'R_rmT '(sylibr RM_regT anrl) '(sylibr immRM_rmT anrr)))));

@_ local def destRM (ds: nat): nat = $ fst (destsrcIRM ds) $;
theorem destRMm_i (v q: nat): $ destRM (Rm_i v q) = v $ = '(eqtr (fsteq destsrcIRMm_i) fstpr);
theorem destRMm_r (v r: nat): $ destRM (Rm_r v r) = v $ = '(eqtr (fsteq destsrcIRMm_r) fstpr);
theorem destRM_rm (r rm: nat): $ destRM (R_rm r rm) = RM_reg r $ = '(eqtr (fsteq destsrcIRM_rm) fstpr);
theorem destRM_T (ds: nat): $ ds e. DestSrc -> destRM ds e. RM $ = '(syl xpfst destsrcIRM_T);

@_ local def srcIRM (ds: nat): nat = $ snd (destsrcIRM ds) $;
theorem srcIRMm_i (v q: nat): $ srcIRM (Rm_i v q) = immRM_imm q $ = '(eqtr (sndeq destsrcIRMm_i) sndpr);
theorem srcIRMm_r (v r: nat): $ srcIRM (Rm_r v r) = immRM_rm (RM_reg r) $ = '(eqtr (sndeq destsrcIRMm_r) sndpr);
theorem srcIRM_rm (r rm: nat): $ srcIRM (R_rm r rm) = immRM_rm rm $ = '(eqtr (sndeq destsrcIRM_rm) sndpr);
theorem srcIRM_T (ds: nat): $ ds e. DestSrc -> srcIRM ds e. ImmRM $ = '(syl xpsnd destsrcIRM_T);

@_ abstract def destEA (k ds: nat): nat = $ RM_EA k (destRM ds) $;
pub theorem destEAm_i (k v q: nat): $ destEA k (Rm_i v q) = RM_EA k v $ = '(RM_EAeq2 destRMm_i);
pub theorem destEAm_r (k v r: nat): $ destEA k (Rm_r v r) = RM_EA k v $ = '(RM_EAeq2 destRMm_r);
pub theorem destEA_rm (k r rm: nat): $ destEA k (R_rm r rm) = EA_r r $ = '(eqtr (RM_EAeq2 destRM_rm) RM_EAreg);
pub theorem destEA_T (k ds: nat): $ k e. Config /\ ds e. DestSrc -> destEA k ds e. EA $ = '(syl RM_EA_T @ anim2 destRM_T);

@_ abstract def srcEA (k ds: nat): nat = $ immRM_EA k (srcIRM ds) $;
pub theorem srcEAm_i (k v q: nat): $ srcEA k (Rm_i v q) = EA_i q $ = '(eqtr (immRM_EAeq2 srcIRMm_i) immRM_EAimm);
pub theorem srcEAm_r (k v r: nat): $ srcEA k (Rm_r v r) = EA_r r $ = '(eqtr (immRM_EAeq2 srcIRMm_r) immRM_EAreg);
pub theorem srcEA_rm (k r rm: nat): $ srcEA k (R_rm r rm) = RM_EA k rm $ = '(eqtr (immRM_EAeq2 srcIRM_rm) immRM_EArm);
pub theorem srcEA_T (k ds: nat): $ k e. Config /\ ds e. DestSrc -> srcEA k ds e. EA $ = '(syl immRM_EA_T @ anim2 srcIRM_T);

@_ def readRegSz (k sz r: nat): nat =
$ chop (wsizeBits sz)
    (if (sz = wSz8 F. /\ 2 e. r) (shr (readReg k (r - 4)) 8) (readReg k r)) $;
theorem readRegSzT2: $ readRegSz k sz r e. Bits (wsizeBits sz) $ = 'chopT;
pub theorem readRegSzT (k sz r: nat):
  $ k e. Config /\ sz e. WSize /\ r e. Regs ->
    readRegSz k sz r e. Bits (wsizeBits sz) $ = '(a1i readRegSzT2);

@_ abstract def readEA (k sz ea v: nat): wff =
$ k e. Config /\ ea e. EA /\ sz e. WSize /\
  ea e. Sum {q | v = chop (wsizeBits sz) q}
    (Sum {r | v = readRegSz k sz r}
      {q | v e. Bits (wsizeBits sz) /\
        readMem k q (toBytes (wsizeBytes sz) v)}) $;
theorem readEA_i2 (k q sz v: nat):
  $ readEA k sz (EA_i q) v <->
    k e. Config /\ q e. u64 /\ sz e. WSize /\ v = chop (wsizeBits sz) q $ =
(named '(aneq (aneq1i @ aneq2i EA_iT) @ bitr Suml @ elabe ,eqtac));
theorem readEA_r2 (k sz r v: nat):
  $ readEA k sz (EA_r r) v <->
    k e. Config /\ r e. Regs /\ sz e. WSize /\ v = readRegSz k sz r $ =
(named '(aneq (aneq1i @ aneq2i EA_rT) @ bitr Sumr @ bitr Suml @ elabe ,eqtac));
theorem readEA_m2 (k a sz v: nat):
  $ readEA k sz (EA_m a) v <->
    k e. Config /\ a e. u64 /\ sz e. WSize /\
    (v e. Bits (wsizeBits sz) /\ readMem k a (toBytes (wsizeBytes sz) v)) $ =
(named '(aneq (aneq1i @ aneq2i EA_mT) @ bitr Sumr @ bitr Sumr @ elabe ,eqtac));
pub theorem readEA_i (k q sz v: nat):
  $ k e. Config /\ q e. u64 /\ sz e. WSize ->
    (readEA k sz (EA_i q) v <-> v = chop (wsizeBits sz) q) $ = '(syl5bb readEA_i2 bian1);
pub theorem readEA_r (k sz r v: nat):
  $ k e. Config /\ r e. Regs /\ sz e. WSize ->
    (readEA k sz (EA_r r) v <-> v = readRegSz k sz r) $ = '(syl5bb readEA_r2 bian1);
pub theorem readEA_m (k a sz v: nat):
  $ k e. Config /\ a e. u64 /\ sz e. WSize ->
    (readEA k sz (EA_m a) v <->
      v e. Bits (wsizeBits sz) /\ readMem k a (toBytes (wsizeBytes sz) v)) $ =
'(syl5bb readEA_m2 bian1);
pub theorem readEA_T (k sz ea v: nat): $ readEA k sz ea v ->
  k e. Config /\ ea e. EA /\ sz e. WSize /\ v e. Bits (wsizeBits sz) $ =
(named '(mpand anl @ iand anr @ impcom ,(split-sop
  (def (f h1 h2 h3) '(syld (bi1d @ readEAeq3d anr) @
    rsyl (impcom @ bi1d @ aneq1d @ aneq2d @ syl6bb ,h2 eleq1) @
    syld (bi1d ,h1) @ exp ,h3))
  '{($EA_i q$ => ,(f 'readEA_i 'EA_iT '(mpbiri chopT @ eleq1d anr))) +
   {($EA_r r$ => ,(f 'readEA_r 'EA_rT '(mpbiri chopT @ eleq1d anr))) +
    ($EA_m a$ => ,(f 'readEA_m 'EA_mT 'anrl))}})));

theorem readEA_T64 (k sz ea v: nat): $ readEA k sz ea v ->
  k e. Config /\ ea e. EA /\ sz e. WSize /\ v e. u64 $ =
'(rsyl readEA_T @ anim2a @ anwr @ syl ssel @ syl Bitsss wsizeBits_le64);

@_ def readEA64 (k ea v: nat): wff = $ readEA k wSz64 ea v $;
pub theorem readEA64T (k ea v: nat): $ readEA64 k ea v ->
  k e. Config /\ ea e. EA /\ v e. u64 $ =
'(rsyl readEA_T64 @ anim1 anl);

@_ def setException (k e: nat): nat = $ (e, readRIP k), snd k $;
pub theorem setExceptionVal (ex ip rs f m e: nat):
  $ setException (mkCfg ex ip rs f m) e = mkCfg e ip rs f m $ =
'(preq (preq2 readRIP_mk) sndpr);
pub theorem setExceptionT (k e: nat):
  $ k e. Config /\ e e. Option Exception -> setException k e e. Config $ =
(named '(mpi mkCfg_ex @ eexd @ eexd @ eexd @ eexd @ eexda @
  mpbird (eleq1d @ syl6eq setExceptionVal @ setExceptioneq1d anr) @ sylibr mkCfgT @
  mpd (mpbid (syl6bb mkCfgT @ eleq1d anr) anll) @
  anim1d @ anim1d @ anim1d @ anim1d @ a1d anlr));
theorem setException_mk: $ setException (mkCfg e ip r f m) e2 = mkCfg e2 ip r f m $ =
'(preq (preq2 readRIP_mk) sndpr);
theorem getMem_setException: $ getMemory (setException k e) = getMemory k $ =
'(sndeq @ sndeq sndpr);
theorem read_setException: $ readException (setException k e) = e $ = 'pi11pr;
theorem readRIP_setException: $ readRIP (setException k e) = readRIP k $ = 'pi12pr;
theorem readReg_setException: $ readReg (setException k e) r = readReg k r $ = '(appneq1 @ fsteq sndpr);
theorem readFlags_setException: $ readFlags (setException k e) = readFlags k $ = '(pi21eq sndpr);
theorem getMemory_setException: $ getMemory (setException k e) = getMemory k $ = '(pi22eq sndpr);

theorem writeMem_setMem:
  $ setMem (getMemory k) a l = m2, e ->
    (writeMem k a l k2 <->
      k e. Config /\ a e. u64 /\ l e. List u8 /\ readException k = 0 /\
      k2 = setException (setMemory k m2) e) $ =
(named @ focus
  '(syl6bbr anass @ aneq2da @ bitr3g (bian1 ax_6) (bian1 mkCfg_ex) @
    bitr3g exan2 exan2 @ exeqd @ bitr3d
      (bian1exd @ bian1exd @ bian1exd @ bian1exd _)
      (bian2exd @ bian2exd @ bian2exd @ bian2exd biidd))
  '(bitr4g
    (aneq2a @
      aneqd (eqeq1d @ syl6eq readException_mk readExceptioneq) @
      eqeq2d @ syl6eq setException_mk @ setExceptioneq1d @
      syl6eq setMemory_mk setMemoryeq1)
    (bitr4 (bian12i @ bian1exi @ bian1exi @ bian11i ancomb) @
      aneq1a @ anwl @ eqeq2d mkCfgeq1) @
    bicomd @ aneq2da @ aneq2da @ syl6bb (bian1 @ !! expr y z) @
    bian2exd @ bian2exd @ bitrd (aneq1d @
      bitr3d (writeMemoryeq1d @ syl6eq getMemory_mk @ getMemoryeqd anlr) @
      syl bian1 @ rsyl anllr @ anim1 @ anim1 getMemoryT) @
    aneq2da @ rsyl (eqtr3d anr an4l) @ sylbi prth ,eqtac));

@_ abstract def setReg (k r q: nat): nat =
$ fst k, lower (write (pi21 k) r q), pi22 k $;
pub theorem setRegVal (ex ip rs f m r q: nat):
  $ setReg (mkCfg ex ip rs f m) r q = mkCfg ex ip (lower (write rs r q)) f m $ =
'(preq fstpr @ preq (lowereq @ writeeq1 @ nseq pi21pr) pi22pr);
pub theorem setRegT (k r q: nat):
  $ k e. Config /\ r e. Regs /\ q e. u64 -> setReg k r q e. Config $ =
(named '(mpi mkCfg_ex @ eexd @ eexd @ eexd @ eexd @ eexda @
  mpbird (eleq1d @ syl6eq setRegVal @ setRegeq1d anr) @ sylibr mkCfgT @
  mpd (mpbid (syl6bb mkCfgT @ eleq1d anr) an3l) @
  anim1d @ anim1d @ anim2d @ exp @
  writeArrow anr an3lr anllr @ a1i @ mpbi eqlower @ writefin finns));

theorem setRegMem: $ getMemory (setReg k r q) = getMemory k $ =
'(sndeq pi22pr);

theorem readRIP_setReg: $ readRIP (setReg k r q) = readRIP k $ = '(sndeq fstpr);
theorem readFlags_setReg: $ readFlags (setReg k r q) = readFlags k $ = '(fsteq pi22pr);
theorem getMemory_setReg: $ getMemory (setReg k r q) = getMemory k $ = '(sndeq pi22pr);
theorem readException_setReg: $ readException (setReg k r q) = readException k $ = '(fsteq fstpr);
theorem read_setReg_ne: $ r2 != r -> readReg (setReg k r q) r2 = readReg k r2 $ =
'(syl5eq (appeq1 @ mpbir (eqlower2 @ writefin finns) pi21pr) writeNe);
theorem read_setReg: $ readReg (setReg k r q) r = q $ =
'(eqtr (appeq1 @ mpbir (eqlower2 @ writefin finns) pi21pr) writeEq);

@_ abstract def writeReg (k sz r v: nat): nat =
$ if (wsizeBits sz = 8)
    (if (~true (snd sz) /\ 2 e. r)
      (setReg k (r - 4) (bitsUpdate 8 8 v (readReg k (r - 4))))
      (setReg k r (bitsUpdate 0 8 v (readReg k r))))
  (setReg k r (if (wsizeBits sz = 16) (bitsUpdate 0 16 v (readReg k r)) v)) $;
pub theorem writeReg8 (k r v: nat) (have_rex: wff):
  $ writeReg k (wSz8 have_rex) r v = if (~have_rex /\ 2 e. r)
      (setReg k (r - 4) (bitsUpdate 8 8 v (readReg k (r - 4))))
      (setReg k r (bitsUpdate 0 8 v (readReg k r))) $ =
'(eqtr (ifpos wSz8Bits) @ ifeq1 @ aneq1i @ noteq @ bitr (trueeq sndpr) truenat);
pub theorem writeReg16 (k r v: nat):
  $ writeReg k wSz16 r v = setReg k r (bitsUpdate 0 16 v (readReg k r)) $ =
'(eqtr (ifneg @ ltner @ mpbir (lteq2 wSz16Bits) d8lt16) @ setRegeq3 @ ifpos wSz16Bits);
theorem writeReg_gt: $ 16 < wsizeBits sz -> writeReg k sz r v = setReg k r v $ =
'(eqtrd (syl ifneg @ syl ltner @ lttr d8lt16) @ setRegeq3d @ syl ifneg ltner);
pub theorem writeReg32 (k r v: nat): $ writeReg k wSz32 r v = setReg k r v $ =
'(writeReg_gt @ mpbir (lteq2 wSz32Bits) d16lt32);
pub theorem writeReg64 (k r v: nat): $ writeReg k wSz64 r v = setReg k r v $ =
'(writeReg_gt @ mpbir (lteq2 wSz64Bits) d16lt64);
pub theorem writeRegT (k sz r v: nat): $ k e. Config /\ sz e. WSize /\
  r e. Regs /\ v e. Bits (wsizeBits sz) -> writeReg k sz r v e. Config $ =
(focus
  '(ifbothd eleq1 eleq1 _ @ anwl @
    sylan setRegT (iand an3l anlr) @
    ifbothd eleq1 eleq1 _ @ anwl _)
  (focus
    (have 'h $ r e. Regs -> r - 4 e. Regs $ '(Bitsle1 subleid))
    (def (f h1)
      '(sylan setRegT (iand an4l ,h1) @
        sylan bitsUpdateT (syl (ian ,norm_num) @ mpbid (elneq2d @ Bitseqd anr) anlr) @
        syl readRegT @ iand an4l ,h1))
    '(sylan ifT ,(f '(syl h anllr)) ,(f 'anllr)))
  (focus
    '(sylan bitsUpdateT (syl (ian ,norm_num) @ mpbid (elneq2d @ Bitseqd anr) anlr) @
      syl readRegT @ iand an4l anllr))
  (focus '(imp @ syl ssel @ syl Bitsss @ syl wsizeBits_le64 anlr)));

@_ abstract def writeEASz (k sz ea v k2: nat): wff =
$ k e. Config /\ sz e. WSize /\ ea e. EA /\ v e. Bits (wsizeBits sz) /\
  ea e. Sum {i | F.} (Sum {r | k2 = writeReg k sz r v}
    {a | writeMem k a (toBytes (wsizeBits sz) v) k2}) $;
pub theorem writeEASz_i (k sz i v k2: nat): $ ~ writeEASz k sz (EA_i i) v k2 $ =
-- (named '(inot @ imp @ syl5bi Suml @ eelabd @ a1i efal));
(named '(inot @ imp @ syl5bi Suml @ eelabd @ a1i efal));
theorem writeEASz_r2:
  $ writeEASz k sz (EA_r r) v k2 <->
    k e. Config /\ sz e. WSize /\ r e. Regs /\ v e. Bits (wsizeBits sz) /\
    k2 = writeReg k sz r v $ =
(named '(aneq (aneq1i @ aneq2i EA_rT) @ bitr Sumr @ bitr Suml @ elabe ,eqtac));
theorem writeEASz_m2:
  $ writeEASz k sz (EA_m a) v k2 <->
    k e. Config /\ sz e. WSize /\ a e. u64 /\ v e. Bits (wsizeBits sz) /\
    writeMem k a (toBytes (wsizeBits sz) v) k2 $ =
(named '(aneq (aneq1i @ aneq2i EA_mT) @ bitr Sumr @ bitr Sumr @ elabe ,eqtac));
pub theorem writeEASz_r (k sz r v k2: nat):
  $ k e. Config /\ sz e. WSize /\ r e. Regs /\ v e. Bits (wsizeBits sz) ->
    (writeEASz k sz (EA_r r) v k2 <-> k2 = writeReg k sz r v) $ =
'(syl5bb writeEASz_r2 bian1);
pub theorem writeEASz_m (k sz a v k2: nat):
  $ k e. Config /\ sz e. WSize /\ a e. u64 /\ v e. Bits (wsizeBits sz) ->
    (writeEASz k sz (EA_m a) v k2 <->
     writeMem k a (toBytes (wsizeBits sz) v) k2) $ =
'(syl5bb writeEASz_m2 bian1);
pub theorem writeEASzT (k sz ea v k2: nat):
  $ writeEASz k sz ea v k2 ->
    k e. Config /\ sz e. WSize /\ ea e. EA /\ v e. Bits (wsizeBits sz) /\
    k2 e. Config $ =
(named '(mpand anl @ iand anr @ impcom ,(split-sop 'ea
  (def (f h1 h2 h3) '(syld (bi1d @ writeEASzeq3d anr) @
    rsyl (impcom @ bi1d @ aneq1d @ aneq2d @ syl6bb ,h2 eleq1) @
    syld (bi1d ,h1) @ exp ,h3))
  '{($EA_i i$ => (syl absurd @ mpbiri writeEASz_i @ noteqd @ writeEASzeq3d anr)) +
   {($EA_r r$ => ,(f 'writeEASz_r 'EA_rT '(mpbird (eleq1d anr) @ anwl writeRegT))) +
    ($EA_m a$ => ,(f 'writeEASz_m 'EA_mT '(anwr @ anrd writeMemT)))}})));

@_ def writeEA (k sz ea v k2: nat): wff =
$ v e. u64 /\ writeEASz k sz ea (chop (wsizeBits sz) v) k2 $;
pub theorem writeEA_T (k sz ea v k2: nat):
  $ writeEA k sz ea v k2 ->
    k e. Config /\ sz e. WSize /\ ea e. EA /\ v e. u64 /\
    k2 e. Config $ = '(imp @ syl5 writeEASzT @ anim1d @ com12 @ anwl ian);

@_ abstract def writeRIP (k q: nat): nat = $ (pi11 k, q), snd k $;
pub theorem writeRIPVal (ex ip rs f m q: nat):
  $ writeRIP (mkCfg ex ip rs f m) q = mkCfg ex q rs f m $ = '(preq (preq1 pi11pr) sndpr);
pub theorem writeRIP_T (k q: nat):
  $ k e. Config /\ q e. u64 -> writeRIP k q e. Config $ =
(named '(impcom @ mpi mkCfg_ex @ eexd @ eexd @ eexd @ eexd @ eexd @
  syl5ibrcom (imeqd (syl6bb mkCfgT eleq1)
     (syl6bb mkCfgT @ eleq1d @ syl6eq writeRIPVal writeRIPeq1)) @
  anim1d @ anim1d @ anim1d @ anim2d ax_1));

theorem read_writeRIP: $ readRIP (writeRIP k v) = v $ = 'pi12pr;
theorem readReg_writeRIP: $ readReg (writeRIP k v) r = readReg k r $ = '(appneq1 @ fsteq sndpr);
theorem readFlags_writeRIP: $ readFlags (writeRIP k v) = readFlags k $ = '(pi21eq sndpr);
theorem getMemory_writeRIP: $ getMemory (writeRIP k v) = getMemory k $ = '(pi22eq sndpr);
theorem readException_writeRIP: $ readException (writeRIP k v) = readException k $ = 'pi11pr;

@_ abstract def EA_callDest (k ea v: nat): wff =
$ k e. Config /\ ea e. EA /\
  ea e. Sum {i | v = readRIP k +_64 i} (Sum {r | v = readReg k r}
    {a | v e. u64 /\ readMem k a (u64Bytes v)}) $;
theorem EA_callDest_i2:
  $ EA_callDest k (EA_i i) v <-> k e. Config /\ i e. u64 /\ v = readRIP k +_64 i $ =
(named '(aneq (aneq2i EA_iT) @ bitr Suml @ elabe ,eqtac));
theorem EA_callDest_r2:
  $ EA_callDest k (EA_r r) v <-> k e. Config /\ r e. Regs /\ v = readReg k r $ =
(named '(aneq (aneq2i EA_rT) @ bitr Sumr @ bitr Suml @ elabe ,eqtac));
theorem EA_callDest_m2:
  $ EA_callDest k (EA_m a) v <-> k e. Config /\ a e. u64 /\
    (v e. u64 /\ readMem k a (u64Bytes v)) $ =
(named '(aneq (aneq2i EA_mT) @ bitr Sumr @ bitr Sumr @ elabe ,eqtac));
pub theorem EA_callDest_i (k i v: nat):
  $ k e. Config /\ i e. u64 -> (EA_callDest k (EA_i i) v <-> v = readRIP k +_64 i) $ =
'(syl5bb EA_callDest_i2 bian1);
pub theorem EA_callDest_r (k r v: nat):
  $ k e. Config /\ r e. Regs -> (EA_callDest k (EA_r r) v <-> v = readReg k r) $ =
'(syl5bb EA_callDest_r2 bian1);
pub theorem EA_callDest_m (k a v: nat):
  $ k e. Config /\ a e. u64 ->
    (EA_callDest k (EA_m a) v <-> v e. u64 /\ readMem k a (u64Bytes v)) $ =
'(syl5bb EA_callDest_m2 bian1);
pub theorem EA_callDestT (k ea v: nat):
  $ EA_callDest k ea v -> k e. Config /\ ea e. EA /\ v e. u64 $ =
(named '(mpand anl @ iand anr @ impcom ,(split-sop 'ea
  (fn (h1 h2 h3) '(exp @ syld (bi1d @ EA_callDesteq2d anr) @
    rsyl (impcom @ bi1d @ aneq2d @ syl6bb ,h2 eleq1) @
    syld (bi1d ,h1) @ exp ,h3))
  '{($EA_i i$ => EA_callDest_i EA_iT (mpbiri add64T @ eleq1d anr)) +
   {($EA_r r$ => EA_callDest_r EA_rT (mpbird (eleq1d anr) @ anwl readRegT)) +
    ($EA_m a$ => EA_callDest_m EA_mT anrl)}})));

@_ def EA_jump (k ea k2 .v: nat): wff =
$ E. v (EA_callDest k ea v /\ k2 = writeRIP k v) $;
pub theorem EA_jumpT (k ea k2: nat):
  $ EA_jump k ea k2 -> k e. Config /\ ea e. EA /\ k2 e. Config $ =
'(!! eex v @ mpand (anwl EA_callDestT) @ iand anrl @
  mpbird (eleq1d anlr) @ anwr @ syl writeRIP_T @ anim1 anl);

@_ abstract def writeFlags (k f: nat): nat =
$ fst k, pi21 k, f, pi222 k $;
pub theorem writeFlagsVal (ex ip rs f m f2: nat):
  $ writeFlags (mkCfg ex ip rs f m) f2 = mkCfg ex ip rs f2 m $ =
'(preq fstpr @ preq pi21pr @ preq2 pi222pr);
pub theorem writeFlagsT (k f: nat):
  $ k e. Config /\ f e. Flags -> writeFlags k f e. Config $ =
(named '(impcom @ mpi mkCfg_ex @ eexd @ eexd @ eexd @ eexd @ eexd @
  syl5ibrcom (imeqd (syl6bb mkCfgT eleq1)
     (syl6bb mkCfgT @ eleq1d @ syl6eq writeFlagsVal writeFlagseq1)) @
  anim1d @ anim2d ax_1));

theorem readRIP_writeFlags: $ readRIP (writeFlags k f) = readRIP k $ = '(sndeq fstpr);
theorem readReg_writeFlags: $ readReg (writeFlags k f) r = readReg k r $ = '(appneq1 pi21pr);
theorem read_writeFlags: $ readFlags (writeFlags k f) = f $ = 'pi221pr;
theorem getMemory_writeFlags: $ getMemory (writeFlags k f) = getMemory k $ = 'pi222pr;
theorem readException_writeFlags: $ readException (writeFlags k f) = readException k $ = '(fsteq fstpr);

@_ abstract def setCZSO (k: nat) (c z s o: wff): nat =
$ writeFlags k (setOF (setSF (setZF (setCF (readFlags k) c) z) s) o) $;
pub theorem setCZSOVal (ex ip rs f m: nat) (c z s o: wff):
  $ setCZSO (mkCfg ex ip rs f m) c z s o =
    mkCfg ex ip rs (setOF (setSF (setZF (setCF f c) z) s) o) m $ =
'(eqtr writeFlagsVal @ mkCfgeq4 @ setOFeq1 @ setSFeq1 @ setZFeq1 @ setCFeq1 readFlags_mk);
pub theorem setCZSO_T (k: nat) (c z s o: wff):
  $ k e. Config -> setCZSO k c z s o e. Config $ =
'(sylan writeFlagsT id @ syl setOF_T @ syl setSF_T @ syl setZF_T @ syl setCF_T readFlagsT);

@_ def MSB (sz w: nat): wff = $ bitsMSB (wsizeBits sz) w $;

@_ def writeResultFlags (k sz w: nat) (c o: wff): nat =
$ setCZSO k c (chop (wsizeBits sz) w = 0) (MSB sz w) o $;
pub theorem writeResultFlagsT (k sz w: nat) (c o: wff):
  $ k e. Config /\ sz e. WSize /\ w e. u64 ->
    writeResultFlags k sz w c o e. Config $ = '(anwll setCZSO_T);

@_ def eraseFlags (k k2 .f2: nat): wff =
$ k e. Config /\ E. f2 (f2 e. Flags /\ k2 = writeFlags k f2) $;
pub theorem eraseFlagsT (k k2: nat):
  $ eraseFlags k k2 -> k e. Config /\ k2 e. Config $ =
(named '(anim2a @ eexda @ mpbird (eleq1d anrr) @ sylan writeFlagsT anl anrl));

@_ def addCarry (sz a b w c o: nat): wff =
$ sz e. WSize /\ a e. u64 /\ b e. u64 /\
  w = a +_64 b /\ c = nat (2 ^ wsizeBits sz <= a + b) /\
  o = nat ((MSB sz a <-> MSB sz b) /\ ~(MSB sz (a +_64 b) <-> MSB sz a)) $;
pub theorem addCarryT (sz a b w c o: nat):
  $ addCarry sz a b w c o ->
    sz e. WSize /\ a e. u64 /\ b e. u64 /\
    w e. u64 /\ bool c /\ bool o $ =
'(anim (anim (anim2 @ mpbiri add64T eleq1)
    (mpbiri boolnat booleq)) (mpbiri boolnat booleq));

@_ def subBorrow (sz a b w c o: nat): wff =
$ sz e. WSize /\ a e. u64 /\ b e. u64 /\
  w = a -_64 b /\ c = nat (a < b) /\
  o = nat (~(MSB sz a <-> MSB sz b) /\ ~(MSB sz (a -_64 b) <-> MSB sz a)) $;
pub theorem subBorrowT (sz a b w c o: nat):
  $ subBorrow sz a b w c o ->
    sz e. WSize /\ a e. u64 /\ b e. u64 /\
    w e. u64 /\ bool c /\ bool o $ =
'(anim (anim (anim2 @ mpbiri add64T eleq1)
    (mpbiri boolnat booleq)) (mpbiri boolnat booleq));

@_ def writeCFOFResult (k sz ea w: nat) (c o: wff) (k2: nat): wff =
$ k e. Config /\ writeEA (writeResultFlags k sz w c o) sz ea w k2 $;
pub theorem writeCFOFResultT (k sz ea w: nat) (c o: wff) (k2: nat):
  $ writeCFOFResult k sz ea w c o k2 ->
    k e. Config /\ sz e. WSize /\ ea e. EA /\ w e. u64 /\
    k2 e. Config $ =
'(imp @ syl5 writeEA_T @ anim1d @ anim1d @ anim1d @ anim1d ax_1);

@_ def maskShift (sz w: nat): nat = $ chop (if (wsizeBits sz = 64) 6 5) w $;

do {
  (def writeBinop_clauses '(
    [binopAdd $ E. w E. c E. o (addCarry sz a b w c o /\ writeCFOFResult k sz ea w (true c) (true o) k2) $]
    [binopOr $ writeCFOFResult k sz ea (bitOr a b) F. F. k2 $]
    [binopAdc $F.$] [binopSbb $F.$]
    [binopAnd $ writeCFOFResult k sz ea (bitAnd a b) F. F. k2 $]
    [binopSub $ E. w E. c E. o (subBorrow sz a b w c o /\ writeCFOFResult k sz ea w (true c) (true o) k2) $]
    [binopXor $ writeCFOFResult k sz ea (bitXor a b) F. F. k2 $]
    [binopCmp $ E. w E. c E. o (subBorrow sz a b w c o /\ k2 = writeResultFlags k sz w (true c) (true o)) $]
    [binopRol $F.$] [binopRor $F.$] [binopRcl $F.$] [binopRcr $F.$]
    [binopShl $ E. k3 (eraseFlags k k3 /\ writeEA k3 sz ea (shl a (maskShift sz b)) k2) $]
    [binopShr $ E. k3 (eraseFlags k k3 /\ writeEA k3 sz ea (shr a (maskShift sz b)) k2) $]
    [binopTst $ k2 = writeResultFlags k sz (bitAnd a b) F. F. $]
    [binopSar $ E. k3 (eraseFlags k k3 /\ writeEA k3 sz ea (bitsSar (wsizeBits sz) a (maskShift sz b)) k2) $]
  ))
  (def writeUnop_clauses '(
    [unopInc $ E. w E. c E. o (addCarry sz a 1 w c o /\ writeCFOFResult k sz ea w (CF (readFlags k)) (true o) k2) $]
    [unopDec $ E. w E. c E. o (subBorrow sz a 1 w c o /\ writeCFOFResult k sz ea w (CF (readFlags k)) (true o) k2) $]
    [unopNot $ writeEA k sz ea (bitsNot (wsizeBits sz) a) k2 $]
    [unopNeg $ E. b (b = bitsNeg (wsizeBits sz) a /\ writeCFOFResult k sz ea b (a != 0) (MSB sz a /\ ~MSB sz b) k2) $]
  ))
  (def ((writeOp_stmt clauses lhs) n)
    @ match (nth n clauses) @ (x e) (if {e == $F.$} $~,(lhs x)$ $ ,(lhs x) <-> ,e $))
  (def writeBinop_stmt @ writeOp_stmt writeBinop_clauses @ fn (x) $ writeBinop k ,x sz ea a b k2 $)
  (def writeUnop_stmt @ writeOp_stmt writeUnop_clauses @ fn (x) $ writeUnop k ,x sz ea a k2 $)
  (def (writeOp_def clauses n)
    @ letrec ([(f i n) @ if {n = 1}
      (nth 1 @ nth i clauses)
      (let ([m {n // 2}])
        $ ifp (op < ,(dn {i + m})) ,(f i m) ,(f {i + m} m) $)])
    (f 0 n))
  (def ((writeOp_pf clauses m) n) @ named
    @ match (nth n clauses) @ (x e)
    @ letrec ([(f off len)
      @ if {len = 1} 'biid @ begin
      (def half {len // 2})
      @ if {n < {off + half}}
        '(bitr (ifppos
          {,norm_num : $ ,(dn n) < ,(dn {off + half}) $}) ,(f off half))
        '(bitr (ifpneg @ mpbi lenlt
          {,norm_num : $ ,(dn {off + half}) <= ,(dn n) $}) ,(f {off + half} half))])
    (if {e == $F.$} '(mpbi eqfal ,(f 0 m)) (f 0 m)))
  (def writeBinop_pf @ writeOp_pf writeBinop_clauses 16)
  (def writeUnop_pf @ writeOp_pf writeUnop_clauses 4)
};
@_ abstract def writeBinop (k op sz ea a b k2: nat) {.w .c .o: nat}: wff = (writeOp_def writeBinop_clauses 16);
pub theorem writeBinopAdd {w c o: nat} (k sz ea a b k2: nat): $,(writeBinop_stmt 0)$  = (writeBinop_pf 0);
pub theorem writeBinopSub {w c o: nat} (k sz ea a b k2: nat): $,(writeBinop_stmt 5)$  = (writeBinop_pf 5);
pub theorem writeBinopCmp {w c o: nat} (k sz ea a b k2: nat): $,(writeBinop_stmt 7)$  = (writeBinop_pf 7);
pub theorem writeBinopOr               (k sz ea a b k2: nat): $,(writeBinop_stmt 1)$  = (writeBinop_pf 1);
pub theorem writeBinopAnd              (k sz ea a b k2: nat): $,(writeBinop_stmt 4)$  = (writeBinop_pf 4);
pub theorem writeBinopXor              (k sz ea a b k2: nat): $,(writeBinop_stmt 6)$  = (writeBinop_pf 6);
pub theorem writeBinopTst              (k sz ea a b k2: nat): $,(writeBinop_stmt 14)$ = (writeBinop_pf 14);
pub theorem writeBinopShl {k3: nat}    (k sz ea a b k2: nat): $,(writeBinop_stmt 12)$ = (writeBinop_pf 12);
pub theorem writeBinopShr {k3: nat}    (k sz ea a b k2: nat): $,(writeBinop_stmt 13)$ = (writeBinop_pf 13);
pub theorem writeBinopSar {k3: nat}    (k sz ea a b k2: nat): $,(writeBinop_stmt 15)$ = (writeBinop_pf 15);
pub theorem writeBinopAdc              (k sz ea a b k2: nat): $,(writeBinop_stmt 2)$  = (writeBinop_pf 2);
pub theorem writeBinopSbb              (k sz ea a b k2: nat): $,(writeBinop_stmt 3)$  = (writeBinop_pf 3);
pub theorem writeBinopRol              (k sz ea a b k2: nat): $,(writeBinop_stmt 8)$  = (writeBinop_pf 8);
pub theorem writeBinopRor              (k sz ea a b k2: nat): $,(writeBinop_stmt 9)$  = (writeBinop_pf 9);
pub theorem writeBinopRcl              (k sz ea a b k2: nat): $,(writeBinop_stmt 10)$ = (writeBinop_pf 10);
pub theorem writeBinopRcr              (k sz ea a b k2: nat): $,(writeBinop_stmt 11)$ = (writeBinop_pf 11);
pub theorem writeBinopT (k op sz ea a b k2: nat):
  $ k e. Config /\ op e. Binop /\ sz e. WSize /\ a e. u64 /\ b e. u64 /\
    ea e. EA /\ writeBinop k op sz ea a b k2 -> k2 e. Config $ =
(named @ focus
  '(imp ,(iterate 4 (fn (x) '(eord (syl5 anr ,x) (syl5 anr ,x))) _))
  (def A '(a1i @ eex @ eex @ eex @ anwr @ anrd writeCFOFResultT))
  (def B '(eexd @ eexd @ eexd @ impd @ exp @ syl5ibrcom eleq1 @
    sylan writeResultFlagsT (anwl @ iand an5l an3lr) @ anwr @ rsyl subBorrowT anllr))
  (def C '(a1i @ anrd writeCFOFResultT))
  (def D '(a1i @ eex @ anwr @ anrd writeEA_T))
  (def E '(syl5ibrcom eleq1 @ sylan writeResultFlagsT (iand an5l an3lr) @ syl bitAndT2 anlr))
  (def F '(a1i efal))
  (refine A C F F C A C B F F F F D D E D));

@_ abstract def writeUnop (k op sz ea a k2: nat): wff = (writeOp_def writeUnop_clauses 4);
pub theorem writeUnopInc {w c o: nat} (k sz ea a k2: nat): $,(writeUnop_stmt 0)$ = (writeUnop_pf 0);
pub theorem writeUnopDec {w c o: nat} (k sz ea a k2: nat): $,(writeUnop_stmt 1)$ = (writeUnop_pf 1);
pub theorem writeUnopNot              (k sz ea a k2: nat): $,(writeUnop_stmt 2)$ = (writeUnop_pf 2);
pub theorem writeUnopNeg {b: nat}     (k sz ea a k2: nat): $,(writeUnop_stmt 3)$ = (writeUnop_pf 3);
pub theorem writeUnopT (k op sz ea a k2: nat):
  $ k e. Config /\ op e. Unop /\ sz e. WSize /\ a e. u64 /\
    ea e. EA /\ writeUnop k op sz ea a k2 -> k2 e. Config $ =
(named @ focus
  '(imp ,(iterate 2 (fn (x) '(eord (syl5 anr ,x) (syl5 anr ,x))) '(a1i _)))
  (def A '(eex @ eex @ eex @ anwr @ anrd writeCFOFResultT))
  (def C '(eex @ anwr @ anrd writeCFOFResultT))
  (def D '(anrd writeEA_T))
  (refine A A D C));

@_ def popAux (k q k2: nat): wff =
$ readEA64 k (EA_m (readReg k RSP)) q /\
  k2 = setReg k RSP (readReg k RSP +_64 8) $;
pub theorem popAuxT (k q k2: nat):
  $ popAux k q k2 -> k e. Config /\ q e. u64 /\ k2 e. Config $ =
'(mpand (anwl @ rsyl readEA64T @ anim1 anl) @ iand anr @
  mpbird (eleq1d anlr) @ sylan setRegT (iand anrl (a1i RSP_T)) (a1i add64T));

@_ def popWrite (k rm k3 .q .k2: nat): wff =
$ rm e. RM /\ E. k2 E. q (popAux k q k2 /\ writeEA k2 wSz64 (RM_EA k2 rm) q k3) $;
pub theorem popWriteT (k rm k2: nat):
  $ popWrite k rm k2 -> k e. Config /\ rm e. RM /\ k2 e. Config $ =
(named '(imp @ eexd @ eexda @ sylibr anass @
  iand (rsyl anrl @ rsyl popAuxT anll) @ anim2 @ anwr @ anrd writeEA_T));

@_ def popRIP (k k3 .q .k2: nat): wff =
$ E. k2 E. q (popAux k q k2 /\ k3 = writeRIP k2 q) $;
pub theorem popRIP_T (k k2: nat):
  $ popRIP k k2 -> k e. Config /\ k2 e. Config $ =
(named '(eex @ eex @ imp @ syl5ibrcom (aneq2d eleq1) @ rsyl popAuxT @
  iand anll @ sylan writeRIP_T anr anlr));

@_ def pushAux (k q k2 .sp: nat): wff =
$ k e. Config /\
  E. sp (sp = readReg k RSP -_64 8 /\
    writeEA (setReg k RSP sp) (EA_m sp) wSz64 q k2) $;
pub theorem pushAuxT (k q k2: nat):
  $ pushAux k q k2 -> k e. Config /\ q e. u64 /\ k2 e. Config $ =
(named '(imp @ eexda @ sylibr anass @ anim2 @ anwr @ rsyl writeEA_T @ anim1 anr));

@_ def pushImmRM (k irm k2 .q: nat): wff =
$ irm e. ImmRM /\ E. q (readEA64 k (immRM_EA k irm) q /\ pushAux k q k2) $;
pub theorem pushImmRM_T (k irm k2: nat):
  $ pushImmRM k irm k2 -> k e. Config /\ irm e. ImmRM /\ k2 e. Config $ =
(named '(sylibr anass @ sylib anlass @ anim2 @ eex @ anwr @ rsyl pushAuxT @ anim1 anl));

@_ def pushRIP (k k2: nat): wff = $ pushAux k (readRIP k) k2 $;
pub theorem pushRIP_T (k k2: nat):
  $ pushRIP k k2 -> k e. Config /\ k2 e. Config $ = '(rsyl pushAuxT @ anim1 anl);

@_ def divModSz (sz a b d m: nat): wff =
$ b != 0 /\ d e. Bits (wsizeBits sz) /\ d = a // b /\ m = a % b $;

do {
  (def execXAST_clauses
    -- XASTArith
    '{{{{((op sz rm) => (xastUnop q)
          $ E. q (readEA k sz (RM_EA k rm) q /\ writeUnop k op sz (RM_EA k rm) q k2) $)
       + ((op sz ds) => (xastBinop d s)
          $ E. d E. s (
            readEA k sz (destEA k ds) d /\
            readEA k sz (srcEA k ds) s /\
            writeBinop k op sz (destEA k ds) d s k2) $)}
      + {(<> =>
        {(#f => (sz rm) => (xastMul n src res lo hi)
          $ E. n E. src E. res (
            n = wsizeBits sz /\
            readEA k sz (RM_EA k rm) src /\
            res = readRegSz k sz RAX * src /\
            ifp (n = 8)
              (k2 = writeReg k wSz16 RAX res)
              (E. lo E. hi (
                splitBits ((n, lo) : (n, hi) : 0) res /\
                k2 = writeReg (writeReg k sz RAX lo) sz RDX hi))) $)
       + (#t => (sz rm) => (xastDiv n a b d m)
          $ E. n E. a E. b E. d E. m (
            n = wsizeBits sz /\
            readEA k sz (RM_EA k rm) b /\
            divModSz sz a b d m /\
            ifp (n = 8)
              (a = readRegSz k wSz16 RAX /\
                eraseFlags (writeReg k sz RAX (shl m 8 + d)) k2)
              (splitBits ((n, readRegSz k sz RAX) :
                          (n, readRegSz k sz RDX) : 0) a /\
                eraseFlags (writeReg (writeReg k sz RAX d) sz RDX m) k2)) $)})
      + (<> => sz =>
        {(0 => (xastCDX n src lo hi)
          $ E. n E. src E. lo E. hi (
            n = wsizeBits sz /\ n != 8 /\
            lo = readRegSz k sz RAX /\
            splitBits ((n, lo) : (n, hi) : 0) (sExt n (2 * n) lo) /\
            k2 = writeReg k sz RDX hi) $)
       > (ds => (xastLea)
          $ writeEA k sz (destEA k ds) (EA_addr (srcEA k ds)) k2 $)})}}

    -- XASTData
     + {(<> => sz =>
       {(<> =>
        {(#f => (ds sz2) => (xastMovZX src)
          $ E. src (readEA k sz (srcEA k ds) src /\
            writeEA k sz2 (destEA k ds) src k2) $)
       + (#t => (ds sz2) => (xastMovSX src)
          $ E. src (readEA k sz (srcEA k ds) src /\
            writeEA k sz2 (destEA k ds) (sExt (wsizeBits sz) (wsizeBits sz2) src) k2) $)})
     + (<> =>
        {(0 => (rm r) => (xastXchg v)
          $ E. v (readEA k sz (RM_EA k rm) v /\
            writeEA (writeReg k sz r v) sz (RM_EA k rm) (readRegSz k sz r) k2) $)
       + (1 => (rm r) => (xastCmpXchg src acc dst ki)
          $ E. src E. acc E. dst E. ki (
            acc = readRegSz k sz RAX /\
            readEA k sz (RM_EA k rm) dst /\
            writeBinop k binopCmp sz (EA_r r) acc dst ki /\
            ifp (acc = dst)
              (writeEA ki sz (RM_EA k rm) (readRegSz k sz r) k2)
              (writeEA ki sz (EA_r RAX) dst k2)) $)
       + (2 => (rm r) => (xastXadd v)
          $ E. v (readEA k sz (RM_EA k rm) v /\
            writeBinop k binopAdd sz (RM_EA k rm) (readRegSz k sz r) v k2) $)})})
    + (<> => c =>
        {((sz ds) => (xastCMov v)
          $ E. v (readEA k sz (if (readCond k c) (srcEA k ds) (destEA k ds)) v /\
            writeEA k sz (destEA k ds) v k2) $)
       + ((b rm) => (xastSetCC)
          $ writeEA k (wSz8 (true b)) (RM_EA k rm) (nat (readCond k c)) k2 $)})}}

    -- XASTFlow
   + {{{{(rm => (xastJump v)
          $ E. v (readEA k wSz64 (RM_EA k rm) v /\ k2 = writeRIP k v) $)
       + ((c q) => (xastJCC)
          $ k2 = if (readCond k c) (writeRIP k (readRIP k +_64 q)) k $)}
      + {(irm => (xastCall ki)
          $ E. ki (pushRIP k ki /\ EA_jump ki (immRM_EA k irm) k2) $)
       + (q => (xastRet ki)
          $ E. ki (popRIP k ki /\ k2 = setReg ki RSP (readReg ki RSP +_64 q)) $)}}
      + {(0 => (xastLeave)
          $ popWrite (setReg k RSP (readReg k RBP)) (RM_reg RBP) k2 $)
      > {(irm => (xastPush) $ pushImmRM k irm k2 $)
       + (rm => (xastPop)   $ popWrite k rm k2 $)}}}

    -- XASTMisc
      + {(0 => (xastCMC) $ k2 = writeFlags k (setCF (readFlags k) (~CF (readFlags k))) $)
       + (1 => (xastCLC) $ k2 = writeFlags k (setCF (readFlags k) F.) $)
       + (2 => (xastSTC) $ k2 = writeFlags k (setCF (readFlags k) T.) $)
       + (3 => (xastUD2) $ k2 = setException k (suc exUD) $)
       + (4 => (xastSysCall r11)
          $ E. r11 (r11 e. u64 /\
            k2 = setException (setReg (setReg k RCX (readRIP k)) 11 r11) (suc exSysCall)) $)}}})

  (def (mk-cases-def clauses)
    @ letrec (
      [(var n) (atom-app '_ n)]
      [(mk n hs next) @ match hs
        ['{(0 => . ,es1) > ,es2}
          $ ocasep ,(done n next es1) ,(mk n es2 next) $]
        [('+ . (and es '((0 => . ,_) . ,_)))
          @ letrec ([f @ match-fn
            [((_ => . es)) $ {,(var n) | ,(done {n + 1} next es)} $]
            [((_ => . es) . es2) $ ocasep ,(done n next es) ,(f es2) $]])
          (f es)]
        ['{(#f => . ,es1) + (#t => . ,es2)}
          $ ocasep ,(done n next es1) {,(var n) | ,(done {n + 1} next es2)} $]
        [{es1 '+ es2} $ Sum ,(mk n es1 next) ,(mk n es2 next) $]
        ['(<> => . ,es)
          (def y (var n))
          (def z (var {n + 1}))
          $ S\ ,y, {,z | ,y e. ,(mk {n + 2} es (cons z next))} $]
        [((? atom? y) '=> . es) $ {,y | ,(done n next es)} $]
        [((and ls (...)) '=> . es)
          @ letrec ([f @ match-fn
            [((? atom? y)) $ {,y | ,(done n next es)} $]
            [((? atom? y) . ls) $ S\ ,y, ,(f ls) $]])
          (f ls)]
        [(es) (mk n es next)]]
      [done @ match-fn*
        [(n () ((name . dummies) e)) e]
        [(n (z . next) es) $ ,z e. ,(mk n es next) $]])
    @ mk 0 clauses ())

  (def (mk-cases-eqns clauses done) @ letrec (
    [((then th ctx) x) @ ctx '(syl5bb ,th ,x)]
    [(mk vars hs next ctx)
      @ match hs
      ['{(0 => . ,es1) > ,es2}
        (next vars es1 (then 'ocasep0 ctx))
        (mk vars es2 next (then 'ocasepS ctx))]
      [('+ . (and es '((0 => . ,_) . ,_)))
        @ letrec ([f @ match-fn*
          [(((_ '=> . es)) ctx)
            (next vars es @ fn (x) @ ctx '(elabed @ anwl ,x))]
          [(((_ '=> . es) . es2) ctx)
            (next vars es (then 'ocasep0 ctx))
            (f es2 (then 'ocasepS ctx))]])
        (f es ctx)]
      ['{(#f => . ,es1) + (#t => . ,es2)}
        (next vars es1 (then 'ocasep0 ctx))
        (next vars es2 @ fn (x) @ ctx '(syl5bb ocasepS @ elabed @ anwl ,x))]
      [{es1 '+ es2}
        (mk vars es1 next (then 'Suml ctx))
        (mk vars es2 next (then 'Sumr ctx))]
      ['(<> => . ,es)
        @ mk vars es
          (fn (vars2 es2 ctx2)
            @ mk vars2 es2 next
            (fn (x) @ ctx
              (def rot @ iterate {(len vars2) - (len vars)}
                (fn (x) '(anroti ,x)) '(anim1 anl))
              '(elsabed @ elabed @ bitrd (eleq1d anlr)
                ,(ctx2 '(rsyl ,rot @ bitrd (eleq1d anr) @ anwl ,x)))))
          id]
      [((? atom? y) '=> . es)
        (def z (dummy! 'nat))
        (next (cons y vars) es @ fn (x) @ ctx '(!! elabed ,z ,x))]
      [((and ls (...)) '=> . es)
        @ letrec ([f @ match-fn*
          [(vars ((? atom? y)) ctx)
            (def z (dummy! 'nat))
            (next (cons y vars) es @ fn (x) @ ctx '(!! elabed ,z ,x))]
          [(vars ((? atom? y) . ls) ctx)
            (def z (dummy! 'nat))
            (f (cons y vars) ls @ fn (x) @ ctx '(!! elsabed ,z ,x))]])
        (f vars ls ctx)]
      [(es) (mk vars es next ctx)]])
    (mk () clauses done id))
};

@_ abstract def execXAST {.res} (k ast k2: nat): wff = $ ast e. ,(mk-cases-def execXAST_clauses) $;

do (mk-cases-eqns execXAST_clauses @ match-fn* @ (rvars ((name . dummies) stmt) ctx)
  (def vars (rev rvars))
  (def sname (->string name))
  (def thname (atom-app 'execXAST @ substr 4 (string-len sname) sname))
  (def bis @ append (map (fn (x) '(,x nat)) dummies)
    '((k nat ())) (map (fn (x) '(,x nat ())) vars) '((k2 nat ())))
  (def stmt $ execXAST k ,'(,name . ,vars) k2 <-> ,stmt $)
  (add-tac-thm! thname bis () stmt 'pub @ fn ()
    (named '(trud ,(ctx eqtac)))));

theorem splitSum
  (h0: $ G /\ a // 2 e. A -> a = b0 (a // 2) -> p $)
  (h1: $ G /\ a // 2 e. B -> a = b1 (a // 2) -> p $):
  $ G /\ a e. Sum A B -> p $ =
(let ([(f l h) '(com12 @ syld (anim2d @ bi1d @ syl6bb ,l eleq1) @ com12 ,h)])
  '(splitb ,(f 'Suml 'h0) ,(f 'Sumr 'h1)));

theorem splitEq {x} (h: $ G /\ x e. A -> a = x -> p $): $ G /\ a e. A -> p $ =
'(sbeth h (imeqd (aneq2d eleq1) @ syl biim1 eqcom));

theorem splitXp1 (h: $ G /\ fst a e. A -> snd a e. B -> p $): $ G /\ a e. Xp A B -> p $ =
'(imp @ syl5bi elxp @ impd @ exp h);

theorem splitXp2 (h: $ G -> a = b, c -> p $): $ G -> snd a = c -> fst a = b -> p $ =
'(com23 @ expd @ syl5bir prth @ syl5bi (eqeq1 fstsnd) h);

theorem splitXpE {x} (h: $ G /\ x e. A /\ snd a e. B -> fst a = x -> p $): $ G /\ a e. Xp A B -> p $ =
'(splitXp1 @ splitEq @ com23 @ exp h);

theorem splitOpt
  (h0: $ G -> a = 0 -> p $)
  (h1: $ G /\ a - 1 e. A -> a = suc (a - 1) -> p $):
  $ G /\ a e. Option A -> p $ =
'(splitopt (anwl h0) @ com12 @ syld (anim2d @ bi1d @ syl6bb optS eleq1) @ com12 h1);

theorem splitupto
  (h0: $ G -> a = 0 -> p $)
  (h1: $ G /\ a - 1 e. upto n -> a = suc (a - 1) -> p $):
  $ G /\ a e. upto (suc n) -> p $ =
'(sylbir (aneq2i @ eleq2 optupto) @ splitOpt h0 h1);

theorem splitupto0: $ G /\ a e. upto 0 -> p $ =
'(syl (absurd lt02) @ sylib elupto anr);

theorem splitupto1 (h0: $ G -> a = 0 -> p $): $ G /\ a e. upto 1 -> p $ =
'(splitupto h0 splitupto0);

theorem splitBool (h0: $ G -> a = 0 -> p $) (h1: $ G -> a = 1 -> p $): $ G /\ a e. Bool -> p $ =
'(imp @ syl5bi elBool @ syl5bi bool01 @ eord h0 h1);

do (def (mk-cases-split clauses next)
  (def ((then th ctx) x) '(,th ,(ctx x)))
  @ letrec ([(mk hs next ctx) @ match hs
    ['{(0 => . ,es1) > ,es2}
      '(splitOpt ,(ctx @ next es1) ,(mk es2 next @ then 'splitoptS ctx))]
    [('+ . (and es '((0 => . ,_) . ,_)))
      @ letrec ([f @ match-fn*
        [(((_ => . es)) ctx) '(splitupto1 ,(ctx @ next es))]
        [(((_ => . es) . es2) ctx)
          '(splitupto ,(ctx @ next es) ,(f es2 @ then 'splitoptS ctx))]])
      (f es ctx)]
    ['{(#f => . ,es1) + (#t => . ,es2)}
      '(splitBool ,(ctx @ next es1) ,(ctx @ next es2))]
    [{es1 '+ es2}
      '(splitSum ,(mk es1 next @ then 'splitb0 ctx) ,(mk es2 next @ then 'splitb1 ctx))]
    ['(<> => . ,es)
      (def (next2 es2)
        '(com23 @ exp ,(mk es2 next @ then 'splitXp2 ctx)))
      '(splitXp1 ,(mk es next2 id))]
    [((? atom? y) '=> . es) '(!! splitEq ,y ,(ctx @ next es))]
    [((and ls (...)) '=> . es)
      @ letrec ([f @ match-fn*
        [(((? atom? y)) ctx) '(!! splitEq ,y ,(ctx @ next es))]
        [(((? atom? y) . ls) ctx)
          '(!! splitXpE ,y ,(f ls @ then 'splitXp2 ctx))]])
      (f ls ctx)]
    [(es) (mk es next ctx)]])
  @ mk clauses next id);

pub theorem execXAST_T (k ast k2: nat):
  $ k e. Config /\ ast e. XAST /\ execXAST k ast k2 -> k2 e. Config $ =
(named @ focus
  '(imp ,(mk-cases-split execXAST_clauses
    @ match-fn @ ((name . _) _)
    (def sname (->string name))
    (def thname (atom-app 'execXAST @ substr 4 (string-len sname) sname))
    '(syl5ibrcom (imeq1d @ syl6bb ,thname execXASTeq2) _)))
  (focus -- Unop
    '(eexda @ sylan writeUnopT _ anrr)
    '(sylibr anass @ iand anll (rsyl anrl @ rsyl readEA_T64 @ iand anr anllr)))
  (focus -- Binop
    '(eexd @ eexda @ sylan writeBinopT _ anrr)
    '(iand _ @ sylan destEA_T an4l anlr)
    '(iand _ @ anwr @ rsyl anlr @ anrd readEA_T64)
    '(iand _ @ anwr @ anwll @ anrd readEA_T64)
    '(iand an3l anllr))
  (focus -- Mul
    '(eexd @ eexd @ eexd @ impd @ exp @ eord _ _)
    (focus
      '(exp @ mpbird (eleq1d anrr) @
        sylan writeRegT (iand (iand an4l @ a1i wSz16T) @ a1i RAX_T) @
        mpbird (elneqd (rsyl anlr anr) @ Bitseqd _) @
        sylan mulBitsT (sylan readRegSzT an3l @ a1i RAX_T) @
        rsyl anlr @ rsyl anlr @ anrd readEA_T)
      (have 'h1 '(eqtr3d anrl @ rsyl anlr anll))
      '(syl5eq wSz16Bits @ syl5eqr d8add8 @ addeqd h1 h1))
    (focus
      '(syl5 anr @ eexd @ eexda @ mpbird (eleq1d anrr) _)
      (have 'h2 '(Bitseqd @ rsyl anlr anll))
      (have 'h3 '(sylib elListS @ rsyl anrl anl))
      '(sylan writeRegT (iand (iand _ an3lr) @ a1i RDX_T) @
        mpbid (elneq2d h2) @ sylib elBitvec2 @ elListHd @ anrd h3)
      '(sylan writeRegT (iand an3l @ a1i RAX_T) @
        mpbid (elneq2d h2) @ sylib elBitvec2 @ anld h3)))
  (focus -- Div
    (def h '(rsyl anrr @ anrd eraseFlagsT))
    '(a1i @ eex @ eex @ eex @ eex @ eex @ anwr @ eor ,h ,h))
  (focus -- CDX
    '(eexd @ eexd @ eexd @ eexda @ mpbird (eleq1d anrr) @
      sylan writeRegT (iand anl @ a1i RDX_T) @
      mpbid (elneq2d @ Bitseqd @ anwr an4l) @ anwr @ rsyl anlr @ anwl @
      sylbi elListS @ sylib elBitvec2 @ anld @ sylib elListS anr))
  (focus '(a1i @ anrd writeEA_T)) -- Lea
  (focus '(a1i @ eex @ anwr @ anrd writeEA_T)) -- MovZX
  (focus '(a1i @ eex @ anwr @ anrd writeEA_T)) -- MovSX
  (focus '(a1i @ eex @ anwr @ anrd writeEA_T)) -- Xchg
  (focus -- CmpXchg
    (def h '(rsyl anrr @ anrd writeEASzT))
    '(a1i @ eex @ eex @ eex @ eex @ anwr @ eor ,h ,h))
  (focus -- Xadd
    '(eexd @ exp @ sylan writeBinopT _ anrr)
    '(iand _ @ rsyl anrl @ syl anllr readEA_T64)
    '(iand _ @ rsyl anrl @ anrd readEA_T64)
    '(iand _ @ mpi readRegSzT2 @ syl ssel @ syl Bitsss @ syl wsizeBits_le64 an3lr)
    '(iand (iand an4l @ a1i binopAddT) @ an3lr))
  (focus '(a1i @ eex @ anwr @ anrd writeEA_T)) -- CMov
  (focus '(a1i @ anrd writeEA_T)) -- SetCC
  (focus -- Jump
    '(eexda @ mpbird (eleq1d anrr) @
      sylan writeRIP_T anll @ rsyl anrl @ anrd readEA_T64))
  (focus -- JCC
    '(syl5ibrcom eleq1 @ sylan ifT (sylan writeRIP_T anll @ a1i add64T) anll))
  (focus '(a1i @ eex @ anwr @ anrd EA_jumpT)) -- Call
  (focus -- Ret
    '(a1i @ eex @ imp @ syl5ibrcom eleq1 @
      sylan setRegT (iand (anrd popRIP_T) @ a1i RSP_T) (a1i add64T)))
  (focus '(a1i @ anrd popWriteT)) -- Leave
  (focus '(a1i @ anrd pushImmRM_T)) -- Push
  (focus '(a1i @ anrd popWriteT)) -- Pop
  (focus '(syl5ibrcom eleq1 @ sylan writeFlagsT id @ syl setCF_T readFlagsT)) -- CMC
  (focus '(syl5ibrcom eleq1 @ sylan writeFlagsT id @ syl setCF_T readFlagsT)) -- CLC
  (focus '(syl5ibrcom eleq1 @ sylan writeFlagsT id @ syl setCF_T readFlagsT)) -- STC
  (focus '(syl5ibrcom eleq1 @ sylan setExceptionT id @ a1i @ mpbir optS exUD_T)) -- UD2
  (focus -- SysCall
    '(eexda @ mpbird (eleq1d anrr) _)
    '(sylan setExceptionT _ @ a1i @ mpbir optS exSysCallT)
    '(sylan setRegT (iand _ @ a1i R11_T) anrl)
    '(sylan setRegT (anim2 @ a1i RCX_T) @ anwl readRIP_T)));

--| This is the step relation for the x86 semantic model, excluding IO.
--| `step k k2` means that k2 is a possible next state after k. Multiple
--| next states may exist in the case of undefined/nondeterministic behavior,
--| and no next states means the state is either invalid or an IO call.
@_ def step (k k2 .l .ast: nat): wff =
$ k e. Config /\ readException k = 0 /\ E. l E. ast (
  readMemX k (readRIP k) l /\
  decode ast l /\
  execXAST (writeRIP k (readRIP k +_64 len l)) ast k2) $;
pub theorem stepT (k k2: nat): $ step k k2 -> k e. Config /\ k2 e. Config $ =
(named @ focus
  '(imp @ eexd @ eexda @ iand anll @ sylan execXAST_T _ anrr)
  '(iand (sylan writeRIP_T anll @ a1i add64T) @ anwr @ rsyl anlr @ anld decodeT));

----------------------------------------
-- IO semantics
----------------------------------------

@_ def PageMapping (M .m .a .p .v: nat): set =
$ {m | m e. Arrow u64 (Option Prot) /\
  A. a A. p (a, suc p e. m -> E. v M @ a = p, v)} $;
theorem elPageMapping:
  $ m e. PageMapping M <-> m e. Arrow u64 (Option Prot) /\
    A. a A. p (a, suc p e. m -> E. v M @ a = p, v) $ =
'(elabe ,eqtac);
theorem PageMappingss: $ PageMapping M C_ Arrow u64 (Option Prot) $ =
(named '(ax_gen @ sylbi elPageMapping anl));
theorem finPageMapping: $ finite (PageMapping M) $ =
'(finss PageMappingss @ Arrowfin finns @ optfin finiteProt);

theorem elPageMapping0: $ \. a e. u64, 0 e. PageMapping M $ =
(named '(mpbir elPageMapping @ iani (mpbir rlamArrow @ ax_gen @ a1i opt0) @
  ax_gen @ ax_gen @ sylbi elrlam @ eex @ anwr @ sylbi prth @ anwr @ absurd peano1));

theorem writePM
  (h1: $ G -> m @ a = prot, x $)
  (h2: $ G -> m2 == write m a (prot, y) $):
  $ G -> PageMapping m C_ PageMapping m2 $ =
(named '(iald @ syl5bi elPageMapping @ syl6ibr elPageMapping @
  anim2d @ alimd @ alimd @ imim2d @ casesda
    (syld (eexda @ anld @ sylib prth @
      eqtr3d anr @ eqtrd (appeq2d anlr) @ anwll h1) @
      exp @ iexde @ eqtr4d (appeqd (rsyl an3l h2) anllr) @
      syl6eqr writeEq @ preqd anlr anr)
    (eximd @ bi2d @ eqeq1d @ eqtrd (appeq1d @ anwl h2) @ anwr writeNe)));

theorem writeMemory1PM: $ writeMemory1 m a b m2 e -> PageMapping m C_ PageMapping m2 $ =
(named '(imp @ eexd @ eexd @ impd @ exp @ eorda
  (writePM anlr @ anwr anrl)
  (anwr @ syl eqssr @ PageMappingeqd @ sylib nsinj anrl)));

theorem setMem1PM: $ m e. Memory /\ a e. u64 /\ b e. u8 ->
  PageMapping m C_ PageMapping (fst (setMem1 m a b)) $ =
'(syl writeMemory1PM @ sylibr writeMemory1_setMem1 @ mpi fstsnd ian);

theorem writeMemoryPM: $ writeMemory m a l m2 e -> PageMapping m C_ PageMapping m2 $ =
(named '(ax_mp (eale ,(eqtac-gen 'm)) @ ax_mp (eale ,(eqtac-gen 'a)) ,(induct '(listind) 'l
  '(ax_gen @ ax_gen @ sylbi writeMemory02 @ syl eqssr @ PageMappingeqd anlr)
  '(sylbi (cbval @ cbvald ,eqtac) @
    iald @ iald @ syl5bi writeMemoryS2 @ syl5 anr @
    rsyl (eale ,eqtac) @ sylibr eexb @ alimi @ eexd @ com12 @ imp @
    rsyl writeMemory1PM @ eorda
      (eimd anrr @ anwl sstr)
      (a1d @ impcom @ bi2d @ sseq2d @ PageMappingeqd anrl)))));

theorem setMemPM: $ m e. Memory /\ a e. u64 /\ l e. List u8 ->
  PageMapping m C_ PageMapping (fst (setMem m a l)) $ =
'(syl writeMemoryPM @ mpi (eqcom fstsnd) ian);

theorem writeMemPM: $ writeMem k a l k2 -> PageMapping (getMemory k) C_ PageMapping (getMemory k2) $ =
(named '(anwr @ eex @ eex @ eex @ eex @ eex @ eex @
  mpbird (sseqd
    (PageMappingeqd @ syl6eq getMemory_mk @ getMemoryeqd anlr)
    (PageMappingeqd @ syl6eq getMemory_mk @ getMemoryeqd anr)) @
  anwll writeMemoryPM));

-- Now we model enough of the Linux kernel to interpret a few IO system calls@_ .

def KernelState {.k: nat}: set =
$ Xp (Xp (List u8) (List u8)) (X\ k e. Config, PageMapping (getMemory k)) $;
@_ def mkKS (i o k m: nat): nat = $ (i, o), k, m $;
pub theorem mkKS_T (i o k m: nat):
  $ mkKS i o k m e. KernelState <->
    i e. List u8 /\ o e. List u8 /\ k e. Config /\ m e. PageMapping (getMemory k) $ =
'(bitr prelxp @ bitr4 (aneq prelxp @ elxabe ,eqtac) anass);

@_ def ksIn (k: nat): nat = $ pi11 k $;
@_ def ksOut (k: nat): nat = $ pi12 k $;
@_ def ksCfg (k: nat): nat = $ pi21 k $;
@_ def ksMapping (k: nat): nat = $ pi22 k $;
pub theorem ksInT (k: nat): $ k e. KernelState -> ksIn k e. List u8 $ = (named 'xppi11);
pub theorem ksOutT (k: nat): $ k e. KernelState -> ksOut k e. List u8 $ = (named 'xppi12);
pub theorem ksCfgT (k: nat): $ k e. KernelState -> ksCfg k e. Config $ =
'(sylbir (bitr3 mkKS_T @ eleq1 @ eqtr (preq fstsnd fstsnd) fstsnd) anlr);
pub theorem ksMappingT (k: nat):
  $ k e. KernelState -> ksMapping k e. PageMapping (getMemory (ksCfg k)) $ =
'(sylbir (bitr3 mkKS_T @ eleq1 @ eqtr (preq fstsnd fstsnd) fstsnd) anr);

theorem ksIn_mk: $ ksIn (mkKS i o k m) = i $ = 'pi11pr;
theorem ksOut_mk: $ ksOut (mkKS i o k m) = o $ = 'pi12pr;
theorem ksCfg_mk: $ ksCfg (mkKS i o k m) = k $ = 'pi21pr;
theorem ksMapping_mk: $ ksMapping (mkKS i o k m) = m $ = 'pi22pr;
theorem eq_mkKS: $ mkKS (ksIn k) (ksOut k) (ksCfg k) (ksMapping k) = k $ =
'(eqtr (preq fstsnd fstsnd) fstsnd);

theorem mkKS_ex: $ E. i E. o E. k E. m ks = mkKS i o k m $ =
'(iexie @ iexde @ iexde @ iexde @ mpbiri (eqcom eq_mkKS) ,eqtac);

theorem ex_ksCfg: $ k e. Config <-> E. ks (ks e. KernelState /\ k = ksCfg ks) $ =
(named '(ibii (iexde @ iand (mpbird (eleq1d anr) @ sylibr mkKS_T @
      iand (iand (a1i @ iani elList0 elList0) anl) @ a1i elPageMapping0) @
    syl5eqr ksCfg_mk @ eqcomd @ ksCfgeqd anr) @
  eex @ mpbird (eleq1d anr) @ anwl @ ksCfgT));

@_ local def setMapping (ks k2 m2: nat): nat =
$ mkKS (ksIn ks) (ksOut ks) k2 m2 $;
theorem setMapping_mk: $ setMapping (mkKS i o k m) k2 m2 = mkKS i o k2 m2 $ =
'(mkKSeq ksIn_mk ksOut_mk eqid eqid);
theorem set_setMapping:
  $ setMapping (setMapping ks k2 m2) k3 m3 = setMapping ks k3 m3 $ = 'setMapping_mk;
theorem setMappingT:
  $ ks e. KernelState ->
    (setMapping ks k2 m2 e. KernelState <->
      k2 e. Config /\ m2 e. PageMapping (getMemory k2)) $ =
'(syl5bb mkKS_T @ aneq1d @ sylan bian1 ksInT ksOutT);

@_ def writeMapping (ks k2 m2 ks2: nat): wff =
$ ks e. KernelState /\ k2 e. Config /\ m2 e. PageMapping (getMemory k2) /\
  ks2 = mkKS (ksIn ks) (ksOut ks) k2 m2 $;
pub theorem writeMappingT (ks m k ks2: nat):
  $ writeMapping ks k m ks2 ->
    ks e. KernelState /\ k e. Config /\
    m e. PageMapping (getMemory k) /\ ks2 e. KernelState $ =
'(anim2a @ syl5ibrcom eleq1 @ mpbird (anwll setMappingT) @ anim1 anr);
theorem writeMapping_val:
$ writeMapping ks k2 m2 ks2 <->
  ks e. KernelState /\ k2 e. Config /\ m2 e. PageMapping (getMemory k2) /\
  ks2 = setMapping ks k2 m2 $ = 'biid;

@_ local def setCfg (ks k2: nat): nat = $ setMapping ks k2 (ksMapping ks) $;
theorem setCfg_mk: $ setCfg (mkKS i o k m) k2 = mkKS i o k2 m $ =
'(eqtr setMapping_mk @ mkKSeq4 ksMapping_mk);
theorem ksIn_setCfg: $ ksIn (setCfg ks k2) = ksIn ks $ = 'pi11pr;
theorem ksOut_setCfg: $ ksOut (setCfg ks k2) = ksOut ks $ = 'pi12pr;
theorem ksCfg_setCfg: $ ksCfg (setCfg ks k2) = k2 $ = 'pi21pr;
theorem ksMapping_setCfg: $ ksMapping (setCfg ks k2) = ksMapping ks $ = 'pi22pr;
theorem set_setCfg: $ setCfg (setCfg ks k2) k3 = setCfg ks k3 $ =
'(eqtr set_setMapping @ setMappingeq3 ksMapping_setCfg);
theorem set_ksCfg: $ setCfg k (ksCfg k) = k $ = '(eqtr (preq fstsnd fstsnd) fstsnd);
theorem setCfgT:
  $ ks e. KernelState -> (setCfg ks k2 e. KernelState <->
      k2 e. Config /\ ksMapping ks e. PageMapping (getMemory k2)) $ = 'setMappingT;
theorem setCfgExceptionT:
  $ ks e. KernelState /\ e e. Option Exception ->
    setCfg ks (setException (ksCfg ks) e) e. KernelState $ =
'(mpbird (anwl setCfgT) @ iand (sylan setExceptionT (anwl ksCfgT) anr) @
  sylibr (eleq2 @ PageMappingeq getMem_setException) @ anwl ksMappingT);

@_ def writeCfg (ks k2 ks2: nat): wff =
$ writeMapping ks k2 (ksMapping ks) ks2 $;
pub theorem writeCfgT (ks k ks2: nat):
  $ writeCfg ks k ks2 -> ks e. KernelState /\ k e. Config /\ ks2 e. KernelState $ =
'(rsyl writeMappingT @ anim1 anl);
theorem writeCfg_val:
$ writeCfg ks k2 ks2 <->
  ks e. KernelState /\ k2 e. Config /\ ksMapping ks e. PageMapping (getMemory k2) /\
  ks2 = setCfg ks k2 $ = 'writeMapping_val;

@(add-eval) def stdin: nat = $ 0 $;
@(add-eval) def stdout: nat = $ 1 $;

@_ def isIOError (n: nat): wff = $ n e. u64 /\ bitsNeg 64 (2 ^ 12) < n $;
pub theorem isIOErrorT (n: nat): $ isIOError n -> n e. u64 $ = 'anl;

@_ def toCStr (s l .c: nat): wff = $ all {c | c != 0} s /\ l = s |> 0 $;
pub theorem toCStrT (s l: nat):
  $ toCStr s l -> (s e. List u8 <-> l e. List u8) $ =
(named '(anwr @ bicomd @ syl6bb (bitr snocT @ bian2 elBits01) eleq1));

@_ def readCStr (k a s .l: nat): wff = $ E. l (toCStr s l /\ readMem k a l) $;
pub theorem readCStrT (k a s: nat):
  $ readCStr k a s -> k e. Config /\ a e. u64 /\ s e. List u8 $ =
(named '(eex @ imp @ syl5 readMemT @ bi2d @ aneq2d toCStrT));

@(add-eval) def O_RDONLY: nat = $ 0 $;
@(add-eval) def O_WRONLY: nat = $ 1 $;
@(add-eval) def O_CREAT: nat = $ shl 1 6 $;
@(add-eval) def O_TRUNC: nat = $ shl 1 9 $;

@(add-eval) def sys_open: nat = $ 2 $;
@_ def execOpen (k ret .filename .flags: nat): wff =
$ k e. Config /\ readReg k RAX = sys_open /\
  E. filename E. flags (
    readCStr k (readReg k RDI) filename /\
    flags = readReg k RSI /\ readReg k RDX = 0 /\
    (flags = O_RDONLY \/ flags = O_WRONLY + O_CREAT + O_TRUNC) /\
    ret e. u64) $;
pub theorem execOpenT (k ret: nat):
  $ execOpen k ret -> k e. Config /\ ret e. u64 $ =
(named '(anim anl @ eex @ eex anr));

--| If `fd` is the tracked file descriptor, reading/writing `l1` from `fd`
--| results in the accumulated input.output `l2`.
@_ def extendIfFD (tgt fd l l1 l2: nat): wff =
$ l e. List u8 /\ l1 e. List u8 /\ l2 = if (fd = tgt) (l ++ l1) l $;
pub theorem extendIfFD_T (tgt fd l l1 l2: nat):
  $ extendIfFD tgt fd l l1 l2 -> l e. List u8 /\ l1 e. List u8 /\ l2 e. List u8 $ =
'(anim2a @ syl5ibrcom eleq1 @ sylan ifT (bi2i appendT) anl);

@(add-eval) def sys_read: nat = $ 0 $;
@_ def execRead (l k l2 k2 ret .fd .buf .count .l1: nat): wff =
$ l e. List u8 /\ readReg k RAX = sys_read /\
  E. fd E. buf E. count (readReg k RDI = fd /\
    readMem k (readReg k RSI) buf /\ buf e. Array u8 count /\
    count = readReg k RDX /\
    ifp (isIOError ret)
      (l2 = l /\ k2 = k)
      (ret <= count /\ E. l1 (extendIfFD stdin fd l l1 l2 /\
        writeMem k (readReg k RSI) l1 k2))) $;
theorem execReadT2 (l k l2 k2 ret: nat):
  $ execRead l k l2 k2 ret ->
    l e. List u8 /\ k e. Config /\
    l2 e. List u8 /\ k2 e. Config /\ ret e. u64 /\
    PageMapping (getMemory k) C_ PageMapping (getMemory k2) $ =
(named @ focus
  '(sylibr anass @ sylibr anass @ sylibr anass @ sylibr anass @
    sylbi anass @ anim2a @ syl5 anr @ eexd @ eexd @ eexda @ sylbir anass @ _)
  (have 'h1 '(anwr @ rsyl anllr @ rsyl readMemT anll))
  '(iand (anwl h1) @ imp @ eord _ _)
  (focus '(exp @ iand (mpbird (eleq1d @ anld anrr) anll) @
    iand (mpbird (eleq1d @ anrd anrr) @ anwl h1) @
    iand (rsyl anrl isIOErrorT) @
    syl eqssr @ PageMappingeqd @ getMemoryeqd @ anrd anrr))
  (focus '(syl5 anr @ impd @ exp @ eexda @ iand (rsyl anrl @ anrd extendIfFD_T) @
    iand (rsyl anrr @ anrd writeMemT) @
    iand (sylc Bitsle1 anlr @ mpbird (eleq1d @ anrd anllr) @
      sylan readRegT (anwll h1) @ a1i RDX_T) @
    rsyl anrr writeMemPM)));
pub theorem execReadT (l k l2 k2 ret: nat):
  $ execRead l k l2 k2 ret ->
    l e. List u8 /\ k e. Config /\
    l2 e. List u8 /\ k2 e. Config /\ ret e. u64 $ =
'(anld execReadT2);
pub theorem execReadPM (l k l2 k2 ret: nat):
  $ execRead l k l2 k2 ret ->
    PageMapping (getMemory k) C_ PageMapping (getMemory k2) $ =
'(anrd execReadT2);

@(add-eval) def sys_write: nat = $ 1 $;
@_ def execWrite (l k l2 ret .fd .buf .count .l1: nat): wff =
$ l e. List u8 /\ readReg k RAX = sys_write /\
  E. fd E. buf E. count (
    fd = readReg k RDI /\ count = readReg k RDX /\
    readMem k (readReg k RSI) buf /\ buf e. Array u8 count /\
    ifp (isIOError ret) (l2 = l)
      (ret <= count /\ E. l1 (extendIfFD stdout fd l l1 l2 /\
        readMem k (readReg k RSI) l1))) $;
pub theorem execWriteT (l k l2 ret: nat):
  $ execWrite l k l2 ret -> l e. List u8 /\ k e. Config /\ l2 e. List u8 /\ ret e. u64 $ =
(named @ focus
  '(sylibr anass @ sylibr anass @ rsyl (anim1 anl) @ anim2a @
    eexd @ eexd @ eexda @ sylbir anass _)
  (have 'h '(anwr @ rsyl anlr @ rsyl readMemT anll))
  '(iand (anwl h) @ imp @ eorda
    (iand (mpbird (eleq1d anrr) anll) @ rsyl anrl isIOErrorT)
    (iand (anwr @ anwr @ anwr @ eex @ anwl @ anrd extendIfFD_T) @
      sylc Bitsle1 (anwr anrl) @ mpbird (eleq1d @ rsyl anlr anllr) @
      sylan readRegT (anwl h) @ a1i RDX_T)));

@_ def Stat: set = $ Array u8 (8 * 10) $;
@(add-eval) def sys_fstat: nat = $ 5 $;
@_ def execFStat (k k2 ret .fd .stat .stat2: nat): wff =
$ readReg k RAX = sys_fstat /\ E. fd E. stat E. stat2 (
    fd = readReg k RDI /\ fd e. u32 /\
    readMem k (readReg k RSI) stat /\
    stat e. Stat /\ stat2 e. Stat /\
    ret e. u64 /\ writeMem k (readReg k RSI) stat2 k2) $;
theorem execFStatT2 (k k2 ret: nat):
  $ execFStat k k2 ret -> k2 e. Config /\ ret e. u64 /\
    PageMapping (getMemory k) C_ PageMapping (getMemory k2) $ =
(named '(anwr @ eex @ eex @ eex @ iand
  (iand (anwr @ anrd writeMemT) anlr) (anwr writeMemPM)));

pub theorem execFStatT (k k2 ret: nat):
  $ execFStat k k2 ret -> k2 e. Config /\ ret e. u64 $ =
'(anld execFStatT2);
pub theorem execFStatPM (k k2 ret: nat):
  $ execFStat k k2 ret ->
    PageMapping (getMemory k) C_ PageMapping (getMemory k2) $ =
'(anrd execFStatT2);

@_ def mapMemory1 (prot m a b: nat): nat =
$ lower (write (fst m) a (prot, b)), lower (write (snd m) a (suc prot)) $;
pub theorem mapMemory1T {x: nat} (prot m a b: nat):
  $ prot e. Prot /\ m e. X\ x e. Memory, PageMapping x /\ a e. u64 /\ b e. u8 ->
    mapMemory1 prot m a b e. X\ x e. Memory, PageMapping x $ =
(named '(rsyl (anroti @ anroti id) @ imp @
  sylibr (imeqi (elxabe2 ,eqtac) (elxabe ,eqtac)) @
  sylibr (imeqi (aneq2i elPageMapping) (aneq2i elPageMapping)) @
  exp @ iand (writeArrow anrl anllr (xpTd an3l anlr) @
    a1i @ mpbi eqlower @ writefin finns) @
  iand (writeArrow (anwr anrl) anllr (sylibr optS an3l) @
    a1i @ mpbi eqlower @ writefin finns) @
  sylbir anass @ sylbir anass @ imp @ alimd @ alimd @
  syl6ibr (imeq1i @ bitr (ellower @ writefin finns) elwrite) @
  com23 @ eorda
    (a1d @ iexde @ syl5eqr (appeq1 @ mpbi eqlower @ writefin finns) @
      eqtr4d (syl6eq writeEq @ appeq2d @ anld anlr) @
      preqd (sylib peano2 @ anrd anlr) anr)
    (eimd anrr @ bi2d @ exeqd @ eqeq1d @
      syl5eqr (appeq1 @ mpbi eqlower @ writefin finns) @
      syl writeNe anrl)));

@_ local def mapMemory_aux (prot l: nat): nat =
$ lrec
  (\. m e. lower (X\ x e. Memory, PageMapping x), \. a e. u64, m)
  (\\ b, \\ z, \ ih,
    \. m e. lower (X\ y e. Memory, PageMapping y), \. a e. u64,
    ih @ mapMemory1 prot m a b @ (a +_64 1))
  l $;

theorem finMPageMapping: $ finite (X\ x e. Memory, PageMapping x) $ =
'(trud @ xabfin (a1i finiteMemory) @ a1i finPageMapping);

@_ abstract def mapMemory (prot m a l: nat): nat = $ mapMemory_aux prot l @ m @ a $;
pub theorem mapMemory0 {x: nat} (prot m a: nat):
  $ prot e. Prot /\ m e. X\ x e. Memory, PageMapping x /\ a e. u64 ->
    mapMemory prot m a 0 = m $ =
(named '(mpi {lrec0 : $ mapMemory_aux _ _ = _ $} @
  apprlamed1 (sylibr (ellower finMPageMapping) anlr) @ apprlamed2 anlr anlr));

pub theorem mapMemoryS {x: nat} (prot m a b l: nat):
  $ prot e. Prot /\ m e. X\ x e. Memory, PageMapping x /\ a e. u64 /\ b e. u8 /\ l e. List u8 ->
    mapMemory prot m a (b : l) =
    mapMemory prot (mapMemory1 prot m a b) (a +_64 1) l $ =
(named '(mpi (eqtr {lrecS : $ mapMemory_aux _ _ = _ @ (_, _, mapMemory_aux _ _) $} @
  appslame @ appslamed @ applamed ,eqtac) @
  apprlamed1 (sylibr (ellower finMPageMapping) an3lr) @
  apprlamed2 an3lr ,eqtac));
pub theorem mapMemoryT {x: nat} (prot m a l: nat):
  $ prot e. Prot /\ m e. X\ x e. Memory, PageMapping x /\ a e. u64 /\ l e. List u8 ->
    mapMemory prot m a l e. X\ x e. Memory, PageMapping x $ =
(named '(ax_mp (eale ,(eqtac-gen 'm)) @ ax_mp (eale ,(eqtac-gen 'a))
  ,(induct '(listind) 'l
    '(ax_gen @ ax_gen @ anwl @ mpbird (eleq1d mapMemory0) anlr)
    '(sylbi (cbval @ cbvald ,eqtac) @ iald @ iald @
      com12 @ sylbi (bitr4 (aneq2i elListS) anass) @
      ealde @ ealde @ syld (bi1d ,eqtac) @ anwll @
      eimd (iand (iand (iand an4l @ anwl mapMemory1T) @ a1i add64T) anr) @
      bi2d @ eleq1d mapMemoryS))));

@_ def mapMem (prot k km a l k2 km2 .e .ip .r .f .m .m2: nat): wff =
$ prot e. Prot /\ k e. Config /\ km e. PageMapping (getMemory k) /\ a e. u64 /\ l e. List u8 /\
  E. e E. ip E. r E. f E. m E. m2 (
  k = mkCfg e ip r f m /\
  mapMemory prot (m, km) a l = m2, km2 /\
  k2 = mkCfg e ip r f m2) $;
pub theorem mapMemT (prot k km a l k2 km2: nat):
  $ mapMem prot k km a l k2 km2 ->
    prot e. Prot /\ k e. Config /\ km e. PageMapping (getMemory k) /\ a e. u64 /\ l e. List u8 /\
    k2 e. Config /\ km2 e. PageMapping (getMemory k2) $ =
(named @ focus
  '(sylibr anass @ anim2a @ eexd @ eexd @ eexd @ eexd @ eexd @ eexd @
    com12 @ mpbird ,eqtac @ rsyl anlr @ expcom _)
  (have 'h '(sylib mkCfgT an4lr))
  (def pm '(eleq2 @ PageMappingeq getMemory_mk))
  (suffices 'h2)
  '(iand (sylibr mkCfgT @ iand (anld h) @ anld h2) @ sylibr ,pm @ anrd h2)
  '(sylib (elxabe ,(eqtac-gen 'm2)) @ mpbid (eleq1d anr) @
    sylan mapMemoryT (iand (iand an5l _) anllr) anlr)
  '(sylibr (elxabe ,eqtac) @ iand (anrd h) @ sylib ,pm an3lr));

@(add-eval) def sys_mmap: nat = $ 9 $;
@(add-eval) def MAP_PRIVATE: nat = $ 2 $;
@(add-eval) def MAP_ANONYMOUS: nat = $ 32 $;
@(add-eval) def MAP_FAILED: nat = $ bitsNeg 64 1 $;
@_ def execMMap (k m k2 m2 ret .len .prot .flags .fd .off .buf .i: nat): wff =
$ k e. Config /\ m e. PageMapping (getMemory k) /\
  readReg k RAX = sys_mmap /\ E. len E. prot E. flags E. fd E. off (
    readReg k RDI = 0 /\ len = readReg k RSI /\
    prot = readReg k RDX /\ flags = readReg k 10 /\
    fd = readReg k 8 /\ off = readReg k 9 /\
    flags = MAP_PRIVATE + nat (fd = bitsNeg 32 1) * MAP_ANONYMOUS /\
    prot e. Prot /\ off = 0 /\ ret e. u64 /\
    ifp (isIOError ret) (k2 = k /\ m2 = m /\ ret = MAP_FAILED)
      (E. buf (buf e. Array u8 len /\ (fd = bitsNeg 32 1 -> all (sn 0) buf) /\
        A. i (i < len -> m @ (ret +_64 i) = 0) /\
        mapMem prot k m ret buf k2 m2))) $;
pub theorem execMMapT (k m k2 m2 ret: nat):
  $ execMMap k m k2 m2 ret ->
    k e. Config /\ m e. PageMapping (getMemory k) /\
    k2 e. Config /\ m2 e. PageMapping (getMemory k2) /\ ret e. u64 $ =
(named @ focus
  '(sylibr (aneq1i anass) @ sylibr anass @ sylbi anass @ anim2a @ syl5 anr @
    eexd @ eexd @ eexd @ eexd @ eexda @ iand _ (anwr anlr))
  '(imp @ syl5 anr @ eorda (mpbird ,eqtac anl) @
    rsyl anrr @ eex @ anwr @ rsyl mapMemT @ anim1 anr));

@_ def execIO (ks ks2 .i .o .k .m .ret .k2 .k3 .i2 .o2 .m2: nat): wff =
$ E. i E. o E. k E. m E. ret (ks = mkKS i o k m /\ readException k = suc exSysCall /\
  E. k2 E. k3 (k3 = setException (setReg k2 RAX ret) 0 /\ (
    execOpen k ret /\ k2 = k /\ ks2 = mkKS i o k3 m \/
    E. i2 (execRead i k i2 k2 ret /\ ks2 = mkKS i2 o k3 m) \/
    E. o2 (execWrite o k o2 ret /\ k2 = k /\ ks2 = mkKS i o2 k3 m) \/
    execFStat k k2 ret /\ ks2 = mkKS i o k3 m \/
    E. m2 (execMMap k m k2 m2 ret /\ ks2 = mkKS i o k3 m2)))) $;
pub theorem execIO_T (ks ks2: nat):
  $ ks e. KernelState /\ execIO ks ks2 -> ks2 e. KernelState $ =
(named @ focus
  '(imp @ !! eexd i @ eexd @ eexd @ eexd @ eexd @ impd @ expcom @ eexd @ eexd @
    impd @ exp _)
  (have 'he $ _ -> k2 e. Config /\ ret e. u64 -> k3 e. Config $
    '(exp @ mpbird (eleq1d anlr) @ anwr @
      sylan setExceptionT (syl setRegT @ anim1 @ mpi RAX_T ian) @ a1i opt0))
  (have 'hs '(sylib mkKS_T @ mpbid (eleq1d an3l) anlr))
  (def (f a b c io d e)
    '(,a @ mpbird (eleq1d anrr) @ sylibr mkKS_T @ mpand (anwr ,b) @
      iand (iand ,io @ mpd (iand ,d @ anwr ,c) @ anwll he) @
      mpbird (eleq2d @ PageMappingeqd @
        syl6eq setRegMem @ syl6eq getMem_setException @
        getMemoryeqd anllr) ,e))
  '(eord (eord (eord (eord _ _) _) _) _)
  -- Open
  (f 'exp '(anwll execOpenT) 'anr '(anwll @ rsyl hs anll)
    '(mpbird (eleq1d @ rsyl anlr anlr) anrl)
    '(mpbird (eleq2d @ PageMappingeqd @ getMemoryeqd @ rsyl anlr anlr) @
      anwll @ anrd hs))
  -- Read
  (f 'eexda '(anwl execReadT2) 'anlr
    '(iand (anwr an3lr) @ anwll @ rsyl hs anllr)
    '(anwr anllr)
    '(sseld anrr @ anwll @ anrd hs))
  -- Write
  (f 'eexda '(anwll execWriteT) 'anr
    '(iand (anwll @ rsyl hs an3l) @ anwr anlr)
    '(mpbird (eleq1d @ rsyl anlr anlr) @ anwr anllr)
    '(mpbird (eleq2d @ PageMappingeqd @ getMemoryeqd @ rsyl anlr anlr) @
      anwll @ anrd hs))
  -- FStat
  (f 'exp '(anwl execFStatT2) 'anlr '(anwll @ rsyl hs anll)
    '(anwr anll) '(sseld anrr @ anwll @ anrd hs))
  -- MMap
  (f 'eexda '(anwl execMMapT) 'anr '(anwll @ rsyl hs anll)
    '(anwr anllr) '(anwr anlr)));

@_ def sys_exit: nat = $ ch x3 xc $;
--| We consider protection faults as a valid way to exit with a nonzero exit code
--| (usually `0xD` or `0xE` but often reported as `0x8D` and `0x8E` by shells).
@_ def execExit (k ret: nat): wff =
$ k e. Config /\ ret e. u32 /\ (
    readException k = suc exGPF /\ ret != 0 \/
    readException k = suc exSysCall /\ readReg k RAX = sys_exit /\ ret = readReg k RDI) $;
pub theorem execExitT (k ret: nat):
  $ execExit k ret -> k e. Config /\ ret e. u32 $ = 'anl;

theorem execExit_determ (k ret: nat):
  $ execExit k ret /\ execExit k 0 -> ret = 0 $ =
'(impcom @ anwr @ eor (anwr @ absurdr eqid) @
  syl5 anr @ eorda (syl (absurd d1ne0) @ sylib peano2 @ eqtr3d anrl an3l) @
  eqtr4d anrr anlr);

--| This is the composite step relation for the extended state.
--| This mixes regular steps of the machine with IO steps where
--| we hand control to the (POSIX-compliant) Linux kernel and axiomatize
--| the behavior. (We could avoid this, but if we go any lower level than
--| this we won't be able to run the result as a normal program - we will have
--| to replace the bootloader and so on to make a single program OS.)
@_ def ksStep (ks ks2 .k2: nat): wff =
$ ks e. KernelState /\ (
    E. k2 (step (ksCfg ks) k2 /\ writeCfg ks k2 ks2) \/
    execIO ks ks2) $;
pub theorem ksStepT (ks ks2: nat):
  $ ksStep ks ks2 -> ks e. KernelState /\ ks2 e. KernelState $ =
(named '(anim2a @ eord (a1i @ eex @ anrd @ anwr writeCfgT) @ exp execIO_T));

theorem ksStep_no_exit: $ ksStep ks ks2 -> ~execExit (ksCfg ks) ret $ =
(named @ focus
  '(anwr @ eor
    (eex @ anwl @ rsyl anlr @ con2 @ anwr @ eor (anwl sucne0) (anwll sucne0))
    (eex @ eex @ eex @ eex @ eex _))
  '(mpbird (noteqd @ execExiteq1d @ syl6eq ksCfg_mk @ ksCfgeqd anll) @
    syl inot @ syl5 anr @ eorda
    (syl (absurd d1ne0) @ sylib peano2 @ eqtr3d anrl @ anwl anlr)
    (imp @ syl5 anlr @ syl absurd @ anwr @ eex @ eex @ anwr _))
  (def (f x) '(mpi {,norm_num : $ ,x != ch x3 xc $} @ con3d eqtr3))
  '(eor (eor (eor (eor
    (rsyl an3lr ,(f $2$))
    (eex @ rsyl anllr ,(f $0$)))
    (eex @ rsyl an3lr ,(f $1$)))
    (anwll ,(f $5$)))
    (eex @ rsyl anllr ,(f $9$))));

theorem step_no_IO: $ step (ksCfg ks) k2 -> ~execIO ks ks2 $ =
(named '(anwl @ anwr @ con2 @ syl sucne0 @ eex @ eex @ eex @ eex @ eex @
  anwl @ eqtrd (readExceptioneqd @ syl6eq ksCfg_mk @ ksCfgeqd anl) anr));

@_ local def ksPath_aux (ksl ks2: nat): wff =
$ srecp (S\ i, {ih |
  snd i e. ocasep (ks2 = fst i)
    (S\ ks, {l2 | ksStep (fst i) ks /\ ks, l2 e. ih})}) ksl $;
theorem ksPath_aux_val:
$ ksPath_aux (ks1, l) ks2 <->
  l e. ocasep (ks2 = ks1)
    (S\ ks, {l2 | ksStep ks1 ks /\
      ks, l2 e. sep (upto (ks1, l)) {i | ksPath_aux i ks2}}) $ =
(focus
  '(bitr {srecpval : (iff _ @ el (pr _ @ sep _ @ ab _ ksPath_aux) _)} @
    !! elsabe x @ !! elabed y _)
  (have 'h1 $ _ -> fst x = _ $ '(syl6eq fstpr @ fsteqd anl))
  (have 'h2 $ _ -> snd x = _ $ '(syl6eq sndpr @ sndeqd anl))
  (eqtac-with #t 'h1 'h2));

@_ local def ksPath (ks l ks2: nat): wff =
$ ks2 e. KernelState /\ ksPath_aux (ks, l) ks2 $;
theorem ksPath0 (ks ks2: nat):
  $ ksPath ks 0 ks2 <-> ks e. KernelState /\ ks2 = ks $ =
(named '(bitr (aneq2i @ bitr ksPath_aux_val ocasep0) @ aneq1a eleq1));
theorem ksPathS (ks ks2 l ks3: nat):
  $ ksPath ks (ks2 : l) ks3 <-> ksStep ks ks2 /\ ksPath ks2 l ks3 $ =
(focus
  '(bitr (aneq2i @ bitr ksPath_aux_val @ bitr ocasepS _) anlass)
  '(elsabe @ elabed @ bitrd ,eqtac @ aneq2d @
    syl5bb elsep @ syl5bb (bian1 @ mpbir elupto @ ltpr2tr ltsucid) @
    elabed ,eqtac));
theorem ksPathT (ks l ks2: nat):
  $ ksPath ks l ks2 ->
    ks e. KernelState /\ all KernelState l /\ ks2 e. KernelState $ =
(named '(ax_mp (eale ,(eqtac-gen 'ks)) ,(induct '(listind) 'l
  '(ax_gen @ sylbi ksPath0 @ iand (iand anl @ a1i all0) @ impcom @ bi2d eleq1)
  '(sylbi (cbval ,eqtac) @ iald @ com12 @ sylbi ksPathS @
    syl5 (eale ,eqtac) @ eimd anr @
    anim1d @ exp @ iand (anwll @ anld ksStepT) @ sylibr allS anr))));

@_ abstract def ksReachable (ks ks2 .l: nat): wff = $ E. l ksPath ks l ks2 $;
pub theorem ksReachable0: $ ks e. KernelState -> ksReachable ks ks $ =
'(syl (iexe ,eqtac) @ sylibr ksPath0 @ mpi eqid ian);
pub theorem ksReachableS:
  $ ksStep ks ks2 -> ksReachable ks2 ks3 -> ksReachable ks ks3 $ =
(named '(eexda @ sylbir ksPathS @ iexe ,eqtac));
pub theorem ksReachableInd {ks1 ks2: nat} (ks ks3: nat) (A: set):
  $ ks e. A /\ A. ks1 A. ks2 (ksStep ks1 ks2 -> ks1 e. A -> ks2 e. A) /\
    ksReachable ks ks3 -> ks3 e. A $ =
(named '(imp @ !! eexd l @ impcom @ syl (eale ,(eqtac-gen 'ks))
  ,(induct '(listindd) 'l
    '(a1i @ ax_gen @ syl5ibrcom (sylbi ksPath0 @ eleq1d anr) id)
    '(sylibr (cbval ,eqtac) @ impcom @ alimd @
      rsyl (eale ,eqtac) @ syl5 (com23 @ eale ,eqtac) @
      exp @ exp @ syl5bi ksPathS @ exp @ mpd anrr @
      mpd (mpd anrl @ mpd anlr anllr) an3l))));

theorem ksReachable_ind (p: wff x) (p1: wff ks1) (p2: wff ks2)
  (hr: $ G -> ksReachable ks ks3 $)
  (e3: $ x = ks3 -> (p <-> p3) $)
  (e0: $ x = ks -> (p <-> p0) $)
  (e1: $ x = ks1 -> (p <-> p1) $)
  (e2: $ x = ks2 -> (p <-> p2) $)
  (h1: $ G -> p0 $)
  (h2: $ G /\ ksStep ks1 ks2 /\ p1 -> p2 $): $ G -> p3 $ =
'(sylib (elabe e3) @ sylan ksReachableInd (iand (sylibr (elabe e0) h1) @
  iald @ ialda @ syl5bi (elabe e1) @ exp @ sylibr (elabe e2) h2) hr);

theorem ksReachableInd_rev:
  $ ksr e. A /\ A. ks1 A. ks2 (ksStep ks1 ks2 -> ks2 e. A -> ks1 e. A) /\
    ksReachable ks ksr -> ks e. A $ =
'(mpd anll @ sylib (elabe ,(eqtac-gen 'ksr)) @
  sylan ksReachableInd (rsyl anlr @
    syl (ian @ mpbir (elabe ,eqtac) id) @ alimi @ alimi @ imim2i @
    sylibr (imeqi (elabe ,eqtac) (elabe ,eqtac)) imim1) anr);

theorem ksReachable_rind (p: wff x) (p1: wff ks1) (p2: wff ks2)
  (hr: $ G -> ksReachable ks ks3 $)
  (e0: $ x = ks -> (p <-> p0) $)
  (e1: $ x = ks1 -> (p <-> p1) $)
  (e2: $ x = ks2 -> (p <-> p2) $)
  (e3: $ x = ks3 -> (p <-> p3) $)
  (h1: $ G -> p3 $)
  (h2: $ G /\ ksStep ks1 ks2 /\ p2 -> p1 $): $ G -> p0 $ =
'(mpd h1 @ ksReachable_ind hr (imeq1d e3) (imeq1d e0) (imeq1d e1) (imeq1d e2)
  idd (imp @ imim1d @ exp h2));

pub theorem ksReachableT (ks ks2: nat):
  $ ksReachable ks ks2 -> ks e. KernelState /\ ks2 e. KernelState $ =
'(!! eex l @ rsyl ksPathT @ anim1 anl);

theorem ksReachable_hd: $ ksReachable ks ks3 <->
  ks e. KernelState /\ ks = ks3 \/ E. ks2 (ksStep ks ks2 /\ ksReachable ks2 ks3) $ =
(named '(ibii
  (! anrd _ $ksReachable ks ks3$ _ ,(induct '(ksReachable_rind id) _
    '(rsyl ksReachableT @ anwr @ iand ksReachable0 @ orld @ iand id eqidd)
    '(rsyl (anim anr anl) @ iand (imp ksReachableS) @ orrd @ iexe ,eqtac)))
  (eor (mpbid (ksReachableeq2d anr) @ anwl ksReachable0) @ eex @ imp ksReachableS)));

theorem ksReachable1: $ ksStep ks ks2 -> ksReachable ks ks2 $ =
'(mpd (syl ksReachable0 @ anrd ksStepT) ksReachableS);

theorem ksReachable_tr: $ ksReachable ks ks2 ->
  ksReachable ks2 ks3 -> ksReachable ks ks3 $ =
(named '(exp ,(induct '(ksReachable_rind anl) _ 'anr '(imp @ anwr ksReachableS))));

theorem ksReachable_exit:
  $ execExit (ksCfg ks) ret -> ksReachable ks ks2 -> ks2 = ks $ =
(named '(exp @ sylib elsn @ syl ksReachableInd @ anim1 @
  iand (sylibr elsn eqidd) @ iald @ iald @ com23 @
  syl5ibrcom (imeq1d @ sylbi elsn ksStepeq1) @
  com12 @ syl absurd ksStep_no_exit));

--| `terminates_ensuring k P` asserts that starting from initial configuration `k`
--| containing the value on input, with the ability to read more files as
--| necessary, the program always reaches the exit point and returns a value,
--| and moreover, if it returns `0`, then the relation `P` holds of the final
--| input and output.
@_ def terminates_ensuring (k .k2 .k3 .exit_code: nat) (P: set): wff =
$ k e. KernelState /\
  A. k2 (ksReachable k k2 ->
    E. k3 E. exit_code (ksReachable k2 k3 /\
      execExit (ksCfg k3) exit_code /\
      (exit_code = 0 -> ksIn k3, ksOut k3 e. P))) $;
pub theorem terminates_ensuringT (k: nat) (P: set):
  $ terminates_ensuring k P -> k e. KernelState $ = (named 'anl);

@_ local def can_terminate_ensuring (k .k2 .exit_code: nat) (P: set): wff =
$ E. k2 E. exit_code (ksReachable k k2 /\
    execExit (ksCfg k2) exit_code /\
    (exit_code = 0 -> ksIn k2, ksOut k2 e. P)) $;

theorem can_terminate_ensuringT:
  $ can_terminate_ensuring k P -> k e. KernelState $ =
(named '(eex @ eex @ anwll @ anld ksReachableT));

theorem can_terminate_ensuring_I:
  $ ksReachable k k2 /\ execExit (ksCfg k2) exit_code /\
    (exit_code = 0 -> ksIn k2, ksOut k2 e. P) ->
    can_terminate_ensuring k P $ = '(trud @ iexdde @ iexdde @ bi2d ,eqtac);

theorem can_terminate_ensuring_R: $ ksReachable k k2 ->
  can_terminate_ensuring k2 P -> can_terminate_ensuring k P $ =
(named '(eximd @ eximd @ anim1d @ anim1d ksReachable_tr));

theorem can_terminate_ensuring_mono:
  $ P C_ Q -> can_terminate_ensuring ks P -> can_terminate_ensuring ks Q $ =
(named '(eximd @ eximd @ anim2d @ imim2d ssel));

theorem terminates_ensuring_val:
  $ terminates_ensuring k P <-> k e. KernelState /\
    A. k2 (ksReachable k k2 -> can_terminate_ensuring k2 P) $ = (named 'biid);

theorem terminates_ensuring_E:
  $ terminates_ensuring k P -> ksReachable k k2 ->
    can_terminate_ensuring k2 P $ = (named '(anwr @ eale ,eqtac));

theorem terminates_ensuring_can:
  $ terminates_ensuring k P -> can_terminate_ensuring k P $ =
'(mpd (syl ksReachable0 @ terminates_ensuringT) terminates_ensuring_E);

theorem terminates_ensuring_R: $ ksReachable k k2 ->
  terminates_ensuring k P -> terminates_ensuring k2 P $ =
(named '(animd (a1d @ anrd ksReachableT) @ alimd @ imim1d ksReachable_tr));

theorem terminates_ensuring_mono:
  $ P C_ Q -> terminates_ensuring ks P -> terminates_ensuring ks Q $ =
(named '(anim2d @ alimd @ imim2d can_terminate_ensuring_mono));

theorem terminates_ensuring_fail:
  $ k e. KernelState /\ execExit (ksCfg k) exit_code /\ exit_code != 0 ->
    terminates_ensuring k P $ =
(named '(sylbi anass @ anim2a @ exp @ ialda @
  iexde @ iexde @ mpbird ,eqtac @ anwll @ sylibr anass @
  iand (mpbird (ksReachableeq1d @ sylc ksReachable_exit (anld anlr) anr) @
    anwll ksReachable0) @
  rsyl anlr @ anim2 absurd));

theorem can_terminate_ensuring_fail:
  $ k e. KernelState /\ execExit (ksCfg k) exit_code /\ exit_code != 0 ->
    can_terminate_ensuring k P $ =
'(syl terminates_ensuring_can terminates_ensuring_fail);

--| `succeeds k i o` asserts that starting from initial configuration `k`,
--| the program reaches the exit point and returns success (exit code 0), and
--| puts `o` on standard out and leaves `i` on standard in.
@_ def succeeds (k i o .k2: nat): wff =
$ E. k2 (ksReachable k k2 /\
  ksIn k2 = i /\ ksOut k2 = o /\ execExit (ksCfg k2) 0) $;
pub theorem succeedsT (k i o: nat):
  $ succeeds k i o -> k e. KernelState /\ i e. List u8 /\ o e. List u8 $ =
(named '(eex @ anwl @ mpand (anwll ksReachableT) @
  iand (iand anrl @ mpbid (eleq1d anllr) @ rsyl anrr ksInT) @
  mpbid (eleq1d anlr) @ rsyl anrr ksOutT));

--| The basic relation between `terminates_ensuring k P` and `succeeds k i o`:
--| together they imply that the property `P` is satisfied.
pub theorem terminates_ensuring_succeeds (k i o: nat) (P: set):
  $ terminates_ensuring k P /\ succeeds k i o -> i, o e. P $ =
(named @ focus
  (have 'h '(sylc ksReachable_exit anllr (anwr anll)))
  '(imp @ sylibr eexb @ imp @ alimd @ com23 @ expcom @ eimd an4l @
    eexd @ eexda @ mpbid (eleq1d @
      preqd (eqtrd (ksIneqd h) an4lr) (eqtrd (ksOuteqd h) an3lr)) @
    mpd (sylan execExit_determ
      (mpbid (execExiteq1d @ ksCfgeqd h) @ anwr anlr) anllr) anrr));

----------------------------------------
-- ELF file format and the initial state
----------------------------------------

theorem elArraySi (h1: $ a e. A $) (h2: $ b e. Array A n $): $ a : b e. Array A (suc n) $ =
'(mpbir elArrayS @ ian h1 h2);

theorem appendArrayi (h1: $ a e. Array A m $) (h2: $ b e. Array A n $):
  $ a ++ b e. Array A (m + n) $ = '(appendArray h1 h2);

@_ def ELF_MAGIC: nat = $ ch x7 xf : ch x4 x5 : ch x4 xc : ch x4 x6 : 0 $;
theorem ELF_MAGIC_T: $ ELF_MAGIC e. Array u8 4 $ =
(iterate 4 (fn (x) '(elArraySi c2nT ,x)) 'elArray0);

@(add-eval) def ELF_CLASS_64: nat = $ 2 $;
theorem ELF_CLASS_64_T: $ ELF_CLASS_64 e. u8 $ = 'd2elu8;
@(add-eval) def ELF_DATA_2LSB: nat = $ 1 $;
theorem ELF_DATA_2LSB_T: $ ELF_DATA_2LSB e. u8 $ = 'd1elu8;
@(add-eval) def ELF_VERSION: nat = $ 1 $;
theorem ELF_VERSION_T: $ ELF_VERSION e. u8 $ = 'd1elu8;
@_ def ELF_IDENT: nat =
$ ELF_MAGIC ++ ELF_CLASS_64 : ELF_DATA_2LSB : ELF_VERSION : repeat 0 9 $;
pub theorem ELF_IDENT_T: $ ELF_IDENT e. Array u8 16 $ =
'(mpbi (eleq2 @ ! Arrayeq2 _ $4 + 12$ _ ,norm_num) @
  appendArray ELF_MAGIC_T @
  elArraySi ELF_CLASS_64_T @ elArraySi ELF_DATA_2LSB_T @
  elArraySi ELF_VERSION_T @ repeatArray elBits01);

@_ def ET_EXEC: nat = $ u16Bytes 2 $;
@_ def EM_X86_64: nat = $ u16Bytes (ch x3 xe) $;
@_ def E_VERSION: nat = $ u32Bytes 1 $;
@_ def E_FLAGS: nat = $ u32Bytes 0 $;
@(add-eval) def EH_SIZE: nat = $ 64 $;
@(add-eval) def PH_SIZE: nat = $ ch x3 x8 $;
@(add-eval) def SH_SIZE: nat = $ 64 $;
--| This checks the ELF header assuming x86 architecture.
@_ def elfHeader (l entry phoff shoff phnum shnum .shstrndx: nat): wff =
$ entry e. u64 /\ phoff e. u64 /\ shoff e. u64 /\
  phnum e. u16 /\ phnum < bitsNeg 16 1 /\
  shnum e. u16 /\ shnum < bitsNeg 16 1 /\
  E. shstrndx (shstrndx e. u16 /\
    l = ELF_IDENT ++ ET_EXEC ++ EM_X86_64 ++ E_VERSION ++
        u64Bytes entry ++ u64Bytes phoff ++ u64Bytes shoff ++
        E_FLAGS ++ u16Bytes EH_SIZE ++ u16Bytes PH_SIZE ++ u16Bytes phnum ++
        u16Bytes SH_SIZE ++ u16Bytes shnum ++ u16Bytes shstrndx) $;
pub theorem elfHeaderT (l entry phoff shoff phnum shnum: nat):
  $ elfHeader l entry phoff shoff phnum shnum ->
    l e. Array u8 EH_SIZE /\ entry e. u64 /\ phoff e. u64 /\ shoff e. u64 /\
    phnum e. u16 /\ shnum e. u16 $ =
(named @ focus
  '(imp @ anwl @ rsyl (anim1 anl) @ eexd @ impd @ exp @ syl5 (mpbiri _ eleq1) @
    anwl @ exp @ anrotri @ anrotri @ anrotri @ anrotri ancom)
  (def A 'u16BytesT) (def B 'u32BytesT) (def C 'u64BytesT)
  '(mpbir (eleq2 @ Arrayeq2 {_ : $ 64 = _ $})
    ,(foldr '(ELF_IDENT_T ,A ,A ,B ,C ,C ,C ,B ,A ,A ,A ,A ,A) A
      @ fn (a b) '(appendArrayi ,a ,b)))
  norm_num);

-- sadly the protection flag bits for ELF are different than the memory page
-- protection flags: R=4, W=2, X=1 for ELF; R=1, W=2, X=4 for the syscall
@_ def protToFlags (prot: nat): nat =
$ consBit (PROT_EXEC C_ prot) (
    consBit (PROT_WRITE C_ prot) (nat (PROT_READ C_ prot))) $;

@(add-eval) def PT_LOAD: nat = $ 1 $;
@_ def pHeader (l type prot off vaddr filesz memsz .i: nat): wff =
$ type e. u32 /\ prot e. Prot /\ off e. u64 /\ vaddr e. u64 /\
  filesz e. u64 /\ memsz e. u64 /\ filesz <= memsz /\
  E. i (i < 64 /\ 2 ^ i || bitsSub 64 vaddr off /\
    l = u32Bytes type ++ u32Bytes (protToFlags prot) ++
        u64Bytes off ++ u64Bytes vaddr ++ u64Bytes 0 ++
        u64Bytes filesz ++ u64Bytes memsz ++ u64Bytes (2 ^ i)) $;
pub theorem pHeaderT (l type prot off vaddr filesz memsz: nat):
  $ pHeader l type prot off vaddr filesz memsz ->
    l e. Array u8 PH_SIZE /\ type e. u32 /\ prot e. Prot /\ off e. u64 /\
    vaddr e. u64 /\ filesz e. u64 /\ memsz e. u64 $ =
(named @ focus
  '(imp @ anwl @ eexd @ syl5 anr @ syl5 (mpbiri _ eleq1) @
    exp @ anrotri @ anrotri @ anrotri @ anrotri @ anrotri ancom)
  (def B 'u32BytesT) (def C 'u64BytesT)
  '(mpbir (eleq2 @ Arrayeq2 {_ : $ ch _ _ = _ $})
    ,(foldr '(,B ,B ,C ,C ,C ,C ,C) C
      @ fn (a b) '(appendArrayi ,a ,b)))
  norm_num);

@_ def basicElfEH (file entry phoff .eh: nat): wff =
$ file e. List u8 /\
  E. eh (sublistAt 0 file eh /\ elfHeader eh entry phoff 0 1 0) $;
pub theorem basicElfEH_T (file entry phoff: nat):
  $ basicElfEH file entry phoff ->
    file e. List u8 /\ entry e. u64 /\ phoff e. u64 $ =
(named '(sylibr anass @ anim2 @ eex @ anwr @ rsyl elfHeaderT @ iand an4lr an3lr));

@_ def basicElf (entry prot off seg: nat): wff =
$ entry e. u64 /\ prot e. Prot /\ seg e. List u8 /\ off + len seg e. u64 /\
  off <= entry /\ entry < off + len seg $;
pub theorem BasicElfT (entry prot off seg: nat):
  $ basicElf entry prot off seg ->
    entry e. u64 /\ prot e. Prot /\ off e. u64 /\ seg e. List u8 $ =
'(iand (iand an4l @ sylc Bitsle1 anlr an5l) an3lr);

--| This defines a basic ELF file (only one program segment, no sections)
--| and extracts the program segment and its protection and location.
@_ def parseBasicElf (file entry prot vaddr seg: nat)
  (.off .eh .ph .phoff .fseg .memsz: nat): wff =
$ file e. List u8 /\
  E. eh E. ph E. phoff E. off E. fseg E. memsz (
    sublistAt 0 file eh /\ elfHeader eh entry phoff 0 1 0 /\
    sublistAt phoff file ph /\
    pHeader ph PT_LOAD prot off vaddr (len fseg) memsz /\
    sublistAt off file fseg /\
    vaddr + memsz e. u64 /\ vaddr <= entry /\ entry < vaddr + memsz /\
    seg = fseg ++ repeat 0 (memsz - len fseg)) $;
pub theorem parseBasicElfT (file entry prot vaddr seg: nat):
  $ parseBasicElf file entry prot vaddr seg -> file e. List u8 /\
    basicElf entry prot vaddr seg $ =
(named @ focus
  '(anim2a @ !! eexd eh @ !! eexd ph @ !! eexd phoff @ !! eexd off @
    !! eexd fseg @ !! eexd memsz @ impd @ exp @ syl5ibrcom basicElfeq4 @
    sylbi (aneq2i @ bian11i anass) @ rsyl ancom _)
  (have 'h1 '(rsyl an5lr elfHeaderT))
  (have 'h2 '(rsyl an3lr pHeaderT))
  (have 'h3 '(syl5eq appendlen @ syl5eq (addeq2 repeatlen) @ syl pncan3 @ rsyl an3lr anlr))
  '(iand (iand (iand (iand _ _) _) _) _)
  (focus '(iand (syl an4lr h1) (syl an4lr h2)))
  (focus
    '(sylibr appendT @ iand (sylc sublistAtT anllr anr) @
      a1i @ repeatT elBits01))
  (focus '(mpbird (eleq1d @ addeq2d h3) @ rsyl anlr anll))
  (focus '(rsyl anlr anlr))
  (focus '(mpbird (lteq2d @ addeq2d h3) @ rsyl anlr anr)));

--| `isBasicElf elf` means that `elf` is a string that satisfies the
--| ELF specification.
def isBasicElf (elf: string) (.entry .prot .off .seg: nat): wff =
$ E. entry E. prot E. off E. seg parseBasicElf elf entry prot off seg $;

local def isBasicElfN (elf: nat): wff =
$ E. entry E. prot E. off E. seg parseBasicElf elf entry prot off seg $;
theorem isBasicElfN_iff:
  $ isBasicElf elf <-> isBasicElfN elf $ = (named 'biid);

@_ def blankConfig (entry k .f .m .r: nat): wff =
$ E. f E. m (f e. Flags /\ m e. Memory /\
    k = mkCfg 0 entry (\. r e. Regs, 0) f m) $;
pub theorem blankConfigT (entry k: nat):
  $ entry e. u64 /\ blankConfig entry k -> k e. Config $ =
(named '(imp @ eexd @ eexd @ impd @ exp @ syl5ibrcom eleq1 @
  sylibr mkCfgT @ sylibr anass @ anim1 @ iand (ian opt0) @
  sylibr rlamArrow @ iald @ a1i @ a1i elBits01));

@_ def allocStack (k m k3 km3: nat): wff =
$ k e. Config /\ E. sp E. low E. stack E. argc E. k2 E. km2 (
    low e. List u8 /\ 2 ^ 12 + len low <= sp /\ sp + len stack e. u64 /\
    mapMem (PROT_READ + PROT_WRITE) (setReg k RSP sp) m
      (sp - len low) (low ++ stack) k2 km2 /\
    E. guard (guard e. Array u8 (2 ^ 12) /\
      mapMem 0 k2 km2 (sp - len low - 2 ^ 12) guard k3 km3) /\
    argc e. u64 /\ sublistAt 0 stack (u64Bytes argc) /\
    A. x (x < argc -> E. arg E. cstr (
      sublistAt (8 * suc x) stack (u64Bytes (sp + arg)) /\
      sublistAt arg stack cstr /\ E. str toCStr str cstr))) $;
pub theorem allocStackT (k m k3 km3: nat):
  $ allocStack k m k3 km3 ->
    k e. Config /\ m e. PageMapping (getMemory k) /\
    k3 e. Config /\ km3 e. PageMapping (getMemory k3) $ =
(named '(imp @ eexd @ eexd @ eexd @ eexd @ eexd @ eexd @ syl5 an3l @ exp @
  sylibr anass @ sylbir anass @ anim
    (anim2 @ anwr @ rsyl mapMemT @ sylib (eleq2 @ PageMappingeq setRegMem) an4lr)
    (eex @ anwr @ rsyl mapMemT @ anim1 anr)));

--| This defines the initial state set up from a basic ELF file (only one
--| program segment, no sections).
def initialConfig (elf: string) (ks: nat)
  (.entry .prot .off .seg .k0 .k1 .km1 .k2 .km2 .a: nat): wff =
$ E. entry E. prot E. off E. seg E. k0 E. k1 E. km1 E. k2 E. km2 (
    parseBasicElf elf entry prot off seg /\
    blankConfig entry k0 /\ allocStack k0 (\. a e. u64, 0) k1 km1 /\
    mapMem prot k1 km1 off seg k2 km2 /\
    ks = mkKS 0 0 k2 km2) $;

@_ local def initialConfigN (elf ks: nat): wff =
$ E. entry E. prot E. off E. seg E. k0 E. k1 E. km1 E. k2 E. km2 (
    parseBasicElf elf entry prot off seg /\
    blankConfig entry k0 /\ allocStack k0 (\. a e. u64, 0) k1 km1 /\
    mapMem prot k1 km1 off seg k2 km2 /\
    ks = mkKS 0 0 k2 km2) $;
theorem initialConfigNT:
  $ initialConfigN elf ks -> ks e. KernelState $ =
(named '(eex @ eex @ eex @ eex @ eex @ eex @ eex @ eex @ eex @
  imp @ syl5ibrcom ,eqtac @ sylibr mkKS_T @ sylibr anass @
  anim (a1i @ ian elList0 elList0) @ rsyl mapMemT @ anim1 anr));
theorem initialConfigN_iff:
  $ initialConfig elf ks <-> initialConfigN elf ks $ = (named 'biid);
pub theorem initialConfigT (elf: string) (ks: nat):
  $ initialConfig elf ks -> ks e. KernelState $ =
'(sylbi initialConfigN_iff initialConfigNT);